1. Assessing Code Quality and Technical Debt Using SonarQube
Guy Smith-Ferrier

2. About… Author of .NET Internationalization Author of NCLDR
Visit to download the complete source code
Author of NCLDR
An open source .NET implementation of CLDR

3. Agenda Introduction to SonarQube Demo: Installing SonarQube
Demo: C# Analysis using SonarQube
Rule Repositories
SonarQube, StyleCop, FxCop, Refactoring Essentials, Code Cracker, ReSharper, NDepend, Wintellect
Duplicate Rules
Holy Wars
Analyzing Unit Test Projects
Code Quality Erosion

4. SonarQube An open source project since 2006 SonarSource formed in 2008
Based on Switzerland
60+ employees (2017)
First commercial plugin in 2009
700,000 downloads, 140,000 downloads in 2016
80,000 organisations use SonarQube
800+ customers
7 customers in Fortune 10
47 customers in Fortune 100
60+ open source plugins

5. SonarQube Language Support
Actively developed
Java, C#, JavaScript, COBOL, C/C++
Developed according to demand
PL/SQL, PHP, ABAP, VB.NET, Python, RPG, Flex, Objective-C, Swift, Web, CSS, Erlang, Groovy, Lua, Puppet
Planned for 2017?
TypeScript, T-SQL
Third Party
Clojure, F#, Perl, Ruby

6. Demo

7. Suppressing Rules 1. SuppressMessage attribute 2. #pragma
Works in Visual Studio and on the Build Server
Includes an ‘optional’ Justification parameter
2. #pragma
No Justification parameter
Not easily trackable
3. SonarQube suppressions
Has no effect in Visual Studio
4. ReSharper “disable” comments
Only affect ReSharper

8. SonarQube C# Rules 238 rules Implemented in Roslyn
Rule Help is excellent
6 ‘common’ (server-side only) rules

9. (Roslyn) StyleCop 187 rules Implemented in Roslyn
Rule Help is excellent

10. ‘Classic’ FxCop
233 rules
Implemented in Code Analysis in Visual Studio
Errors/warnings appear in Visual Studio’s Error List window
Rules only show in a clean build
SonarLint deletes all non-Roslyn rules from rulesets
Implemented in FxCopCmd.exe on the Build Server
Requires Visual Studio to be installed on the server
FxCop does not always respect SuppressMessages that include a scope
High degree of overlap with SonarQube ruleset

11. Roslyn FxCop 140 rules Implemented in Roslyn
Not all rules ported (e.g. CAS)
Implemented in Roslyn
Match the version of the analyser to the version of Microsoft.CodeAnalysis supported by Visual Studio
Visual Studio 2013: Not supported
Visual Studio 2015: Microsoft.CodeAnalysis 1.2
Visual Studio 2017: Microsoft.CodeAnalysis 2.2
Spread over 6 NuGet packages

12. Refactoring Essentials
168 rules
Implemented in Roslyn
Rule Help is poor

13. Code Cracker
76 rules
Implemented in Roslyn
Rule Help is poor

14. ReSharper 675 rules Implemented in ReSharper
Errors / warnings appear in ReSharper’s dedicated window
Implemented in InspectCode.exe on the Build Server
A free download (see ReSharper Command Line Tools)
Rule Help is good
The SonarSource Plugin is no longer available
Download Greg Bartlett’s replacement from:-

15. Wintellect Analyzers 14 rules Implemented in Roslyn Rule Help is good
Some rules are counted as errors
The build breaks (even if these rules are disabled)

16. NDepend 145 rules Implemented in NDepend
Errors / warnings appear in NDepend’s dedicated window
Implemented in NDepend’s runner on the Build Server
Requires a separate NDepend “Build Server” licence
Rule Help is available through the NDepend project file
Rules cannot be suppressed (yet)

17. Duplicate Rules
SonarQube
ReSharper
NDepend
StyleCop
FxCop

18. .NET Ruleset Inspector

19. My Favourite Holy Wars 1. var vs. Explicit Types 2. this vs. not this
3. Tabs vs. spaces
4. XML code comments
5. Ketchup: in the cupboard or in the fridge?

20. Analyzing Unit Test Projects
To analyse or not to analyse?
It’s not production code
It *is* an asset of the company
Analyse but use a reduced ruleset
via a standard set of suppressions
by disabling rules according to their file path

21. Code Quality Erosion

22. Code Quality Erosion

23. Information Sources Twitter Newsletters Support
@SonarLint
Newsletters
Support
SonarQube Google Groups
Bug Tracking and Development

24. Summary SonarQube analyses Code Quality and assesses Technical Debt
SonarQube exposes statistical data to all stakeholders (not just developers)
SonarQube tracks metrics over time
At least half of the effort spent on SonarQube Administration centres on the socialisation of Code Quality

25. It’s More Readable
There is no such thing as empirically “more readable”
“More readable” only applies to individuals
Code is “more readable” if it looks like what you are used to reading