Assessing Code Quality and Technical Debt Using SonarQube Guy Smith-Ferrier guy@guysmithferrier.com http://www.guysmithferrier.com

About… Author of .NET Internationalization Author of NCLDR Visit http://www.dotneti18n.com to download the complete source code Author of NCLDR http://www.ncldr.com An open source .NET implementation of CLDR

Agenda Introduction to SonarQube Demo: Installing SonarQube Demo: C# Analysis using SonarQube Rule Repositories SonarQube, StyleCop, FxCop, Refactoring Essentials, Code Cracker, ReSharper, NDepend, Wintellect Duplicate Rules Holy Wars Analyzing Unit Test Projects Code Quality Erosion

SonarQube An open source project since 2006 SonarSource formed in 2008 Based on Switzerland 60+ employees (2017) First commercial plugin in 2009 700,000 downloads, 140,000 downloads in 2016 80,000 organisations use SonarQube 800+ customers 7 customers in Fortune 10 47 customers in Fortune 100 60+ open source plugins

SonarQube Language Support Actively developed Java, C#, JavaScript, COBOL, C/C++ Developed according to demand PL/SQL, PHP, ABAP, VB.NET, Python, RPG, Flex, Objective-C, Swift, Web, CSS, Erlang, Groovy, Lua, Puppet Planned for 2017? TypeScript, T-SQL Third Party Clojure, F#, Perl, Ruby

Demo

Suppressing Rules 1. SuppressMessage attribute 2. #pragma Works in Visual Studio and on the Build Server Includes an ‘optional’ Justification parameter 2. #pragma No Justification parameter Not easily trackable 3. SonarQube suppressions Has no effect in Visual Studio 4. ReSharper “disable” comments Only affect ReSharper

SonarQube C# Rules 238 rules Implemented in Roslyn Rule Help is excellent 6 ‘common’ (server-side only) rules

(Roslyn) StyleCop 187 rules Implemented in Roslyn Rule Help is excellent

‘Classic’ FxCop 233 rules Implemented in Code Analysis in Visual Studio Errors/warnings appear in Visual Studio’s Error List window Rules only show in a clean build SonarLint deletes all non-Roslyn rules from rulesets Implemented in FxCopCmd.exe on the Build Server Requires Visual Studio to be installed on the server FxCop does not always respect SuppressMessages that include a scope High degree of overlap with SonarQube ruleset

Roslyn FxCop 140 rules Implemented in Roslyn Not all rules ported (e.g. CAS) Implemented in Roslyn Match the version of the analyser to the version of Microsoft.CodeAnalysis supported by Visual Studio Visual Studio 2013: Not supported Visual Studio 2015: Microsoft.CodeAnalysis 1.2 Visual Studio 2017: Microsoft.CodeAnalysis 2.2 Spread over 6 NuGet packages

Refactoring Essentials 168 rules Implemented in Roslyn Rule Help is poor

Code Cracker 76 rules Implemented in Roslyn Rule Help is poor

ReSharper 675 rules Implemented in ReSharper Errors / warnings appear in ReSharper’s dedicated window Implemented in InspectCode.exe on the Build Server A free download (see ReSharper Command Line Tools) Rule Help is good The SonarSource Plugin is no longer available Download Greg Bartlett’s replacement from:- https://github.com/GregBartlett/sonar-resharper

Wintellect Analyzers 14 rules Implemented in Roslyn Rule Help is good Some rules are counted as errors The build breaks (even if these rules are disabled)

NDepend 145 rules Implemented in NDepend Errors / warnings appear in NDepend’s dedicated window Implemented in NDepend’s runner on the Build Server Requires a separate NDepend “Build Server” licence Rule Help is available through the NDepend project file Rules cannot be suppressed (yet)

Duplicate Rules SonarQube ReSharper NDepend StyleCop FxCop

.NET Ruleset Inspector https://github.com/GuySmithFerrier/RulesetInspector

My Favourite Holy Wars 1. var vs. Explicit Types 2. this vs. not this 3. Tabs vs. spaces 4. XML code comments 5. Ketchup: in the cupboard or in the fridge?

Analyzing Unit Test Projects To analyse or not to analyse? It’s not production code It *is* an asset of the company Analyse but use a reduced ruleset via a standard set of suppressions by disabling rules according to their file path

Code Quality Erosion

Code Quality Erosion

Information Sources Twitter Newsletters Support @SonarSource, @SonarQube, @SonarLint Newsletters http://www.sonarsource.com/resources/product-news http://www.sonarsource.com/resources/newsletter Support SonarQube Google Groups Bug Tracking and Development http://jira.sonarsource.com

Summary SonarQube analyses Code Quality and assesses Technical Debt SonarQube exposes statistical data to all stakeholders (not just developers) SonarQube tracks metrics over time At least half of the effort spent on SonarQube Administration centres on the socialisation of Code Quality

It’s More Readable There is no such thing as empirically “more readable” “More readable” only applies to individuals Code is “more readable” if it looks like what you are used to reading