Continuous inspection of Code Quality using SonarQube – Techcedence

SonarQube is an open-source software introduced by Sonar Source for continuous inspection of code quality. Continuous inspection of code refers to constant checking of code for defects.

In software development, it is necessary to evaluate the code to measure software quality. Software quality is measured by checking for duplicate code, whether the code follows good practices and specific principles. Static code analysis is done as a part of the code review to analyze the code for errors and potential vulnerabilities. Static code analysis is done using algorithms and techniques to examine the code without executing the program.  Static code analysis takes time but there are many code analysis tools available that can identify errors and save time.

SonarQube

SonarQube is a widely used tool for performing automated code reviews by analyzing source code, inspecting the code quality and providing reports. It uses static code analysis to detect bugs, code smells, styling errors, code duplication, security vulnerabilities, lack of test coverage and design errors. It provides clear guidance for developers at each level with metrics and identifies the problematic areas enabling them to understand and fix issues. It enables developers to own the quality and security standards through clean as they code.

Advantages of using SonarQube

• Increases maintainability of the software
• Increases the lifetime of the application by reducing complexities, bugs and security vulnerabilities
• Empowers the developers to write cleaner and maintainable code.
• Implements continuous code quality management
• Automatically detects bugs and alerts before moving into production thereby reducing the project risk.

Features of SonarQube

• SonarQube is an open-source platform available for use by developers to monitor code quality
• It provides support for 27 programming languages including C, C++, Java, TSQL, TypeScript, JavaScript, .NET, Python and COBOL
• Quality Gate provides the ability to enforce code practices and standards and tells whether the project is ready for production.
• It comes with additional plugins to enhance the experience of the user. More than 60 plugins are available to provide features including extra languages, metrics, and pages.
• SonarQube easily integrates with existing tools like Jenkins, Azure DevOps, GitLab, eclipse, bitbucket, maven, etc.
• Provides software quality metrics with drill-down capabilities.

Functionalities

SonarQube helps to manage code quality through several functionalities that include code analyzers, reporting tools, activity page, defect hunting, time machine and dashboard.

Dashboards

SonarQube comes with a global dashboard and project dashboard. Dashboards are made up of widgets and are customizable. The project dashboard provides project-specific metrics. The dashboard provides a consolidated view of bugs, vulnerabilities, code smells and duplications.

Source Code Analysis

A set of source code analyzers are stored in a plugin. The analysis begins by triggering the plugin and performs a full analysis of the code and saves the results to the database. It is necessary to download and install SonarQube Runner to run the analysis.

Quality Gate

This feature allows enforcing a quality policy to ensure that standards are met across the projects.  Quality gate can be accessed by any user of the project.  It allows to define a set of Boolean conditions against which the project is measured. SonarQube will ascertain if the code meets all the quality thresholds set for the project. The project should pass the quality gate to move on to the next phase.

Duplication of Code

It is important to have clean code without duplications in a project. Code duplication occurs in every project due to reusing code from other projects. SonarQube helps to identify repeated code blocks by scanning the code and reports duplication metrics as an absolute number of lines, blocks and files. 

Manage Project history

Project Activity Page maintains a history of project data from all previous analyzes.  It provides a comprehensive list of code analyzes performed on the project since it was created in SonarQube.  This helps to analyze the project’s health and measures taken over time.

Hunting Tools

Sonar provides hunting toolset to drill down the issues. Drill down every measure using filters, option to narrow down which modules, packages, and files are poorly covered and duplication drill down.

Time Machine

This functionality helps to analyze history in a graphical format which is easy to understand.  It helps to analyze the evolution of metrics and helps to compare the version of the project.

Managing source code quality gives better visibility into your project and optimizes ROI. SonarQube helps to manage source code quality with lesser effort. Implementing the SonarQube platform enables organizations to get insights on application quality and reduces the time required for code reviews.