About code quality analysis
Code quality analysis helps you to make your code:
- less error-prone
- more sustainable
- more reliable
- more readable
- more welcoming to new contributors
It is also a mandatory step for projects willing to enter the PolarSys Maturity Assessment, as the analysis process relies on code metrics extracted by SonarQube.
Code quality analysis mainly relies on a set of tools that look at your code and give you hints. The most famous tools are Findbugs, PMD, Checkstyle; but also code coverage tools such as JaCoCo. JDT itself provides very powerful quality checks, but there are not enabled by default. You should go to Error/Warnings in preferences and replace all "ignore" by "Warning". You can (and should) enable such tools in IDE.
Code quality can also be analyzed out of the IDE, running those tools and using their reports to find out the "hot spots" in your code.
SonarQube (formerly known as Sonar) is an open-source product which is used to gather several metrics about code quality, put them all in a single dashboard, and provide some tips to help you making your code better, more sustainable, more reliable, less bugged.
Enable Jenkins SonarQube plugin on your job or running mvn sonar:sonar on your Maven build will result in the following flow of actions:
- SonarQube will locally analyze code and generate reports from many analyzers
- SonarQube will push those reports to the SonarQube dashboard
Setting up SonarQube for Eclipse.org projects
SonarQube can be found on https://sonar.eclipse.org . Several projects already have quality reports enabled. You can drill-down on code to see SonarQube annotations on each class, or navigate through the different widgets on the dashboard to focus on specific issues.
The project must have a Jenkins instance. See how to get a dedicated JIPP. You should first setup a normal build to make sure the project compiles correctly.
Optional: it may be a good thing to add a SonarQube goal in your pom.xml, so you can run the SonarQube analyser whenever you want, independently of the Jenkins build.
There are two ways to setup SonarQube on Jenkins for your project, depending on the build tool used: Tycho builds can use the SonarQube/Maven integration, while other tools (e.g. Buckminster) have to setup a SonarQube Runner build step.
You can check the SonarQube documentation for the plugin here:
Enable SonarQube for your project with Tycho
The only prerequisite for this method is to use Tycho as a building tool, which allows to automatically retrieve all information about the build and its dependencies.
A dedicated job has to be defined for the quality analysis -- because you don't want to execute SonarQube every time the project is built. In the update center, install the Sonar plugin and restart the Jenkins instance. In the job configuration, check the SonarQube post-build action, click on advanced and fulfill the fields according to your project configuration. The following example screenshot shows the configuration used by the emf-compare project.
Then post a new bug entry in the community bugzilla to ask an administrator to add the Eclipse SonarQube instance parameters to the Sonar plugin.
SonarQube is currently (and will remain) public to all and by default only Eclipse Webmaster can administrate the analysis projects. If you need admin permissions on some analysis projects, drop a bug on bugzilla, specifying which analysis projects you want to administrate. The name of the analysis must be close enough to the project's name. If you are not the project lead your project, don't forget to ask him to +1 your request. The admin permissions will be granted for all committers on the project.
The initial documentation referenced Mickael Istria's blog entry at http://mickaelistria.wordpress.com/2012/10/08/sonar-at-eclipse-org/ . The information in it regarding the Eclipse process is outdated, but the article is still a good reading to understand how SonarQube works and what it can bring to you.
Infrastructure and maintenance
SonarQube is installed on a VM accessible from inside Eclipse infrastructure. The database is made accessible from Eclipse.org servers and has a user for SonarQube, and another user for Jenkins. When running the Jenkins Sonar plugin, the plugin uses this user to push to the SonarQube database the metrics about your project.
- Open issues: https://bugs.eclipse.org/bugs/buglist.cgi?list_id=6604883&classification=Eclipse%20Foundation&query_format=advanced&component=Sonar&product=Community
- User to follow to get notified of new bugs on Sonar component: firstname.lastname@example.org
- Database requires to be tweak to add some "GRANT" permissions to the sonar user. Sonar could start otherwise.
- March 2013: https://bugs.eclipse.org/bugs/show_bug.cgi?id=407658 . Removed big log file and restarted Sonar,
- July 2013: Got an OutOfMemory on Sonar side while running Platform-Sonar job. Increased max memory in conf/wrapper.conf and restarted Sonar.
- July 2013: No space left on device. A lot of big memory dumps files in bin/linux-x86-64 consumed half of disk space. Removed them
- October 2013: Migration to SonarQube 3.7.1 to provide compatibility with Maven
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=417978 basic migration
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=418502 Issue with HTTPS
- org.postgresql.util.PSQLException: ERROR: permission denied for relation permission_templates => Give permissions to hudson user with psql GRANT SELECT ON ALL TABLES IN SCHEMA public TO user; GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO user;
- Reboot: INFO | jvm 1 | 2014/01/24 06:06:27 | java.lang.OutOfMemoryError