Code Quality Analysis Tool SonarQube

1. Who Needs SonarQube

Code review is an indispensable part of high-quality software development. It helps developers spot bugs in the code in time and improves code quality and maintainability.

The dimensions of code review include language conventions, code style, and soundness of design. Checking these things by hand consumes a great deal of effort and time.

Code quality analysis tools were born for this. They free developers from repetitive, tedious review so they can focus on feature design and implementation. Code formatting, syntax conventions, program bugs, and similar checks are all handed over to the code quality analysis tool.

For projects hosted publicly on GitHub and elsewhere, plenty of SaaS services are available, such as Code Climate and Codacy. Usually they integrate directly with GitHub and offer free code quality analysis.

But inside a corporate intranet there is no external network and the code is sensitive, so we need a code quality analysis tool that supports private deployment. SonarQube is an open-source code quality analysis tool that can be deployed privately.

2. What SonarQube Is

SonarQube is an open-source code quality management system. Its features:

Supports more than 25 programming languages, including Java, C/C++, C#, PHP, Flex, Groovy, JavaScript, Python, PL/SQL, COBOL, and more
Provides reports on duplicate code, coding standards, unit tests, code coverage, code complexity, potential bugs, comments, and software design
Provides a history of metrics
Supports integration with Maven, Ant, Gradle, Atlassian Bamboo, Jenkins, Hudson, and more
Supports IDE integration
Supports external tool sets such as JIRA, Mantis, LDAP, and Fortify
Supports extension plugins

3. Installing SonarQube

SonarQube consists of two parts:

SonarQube, the server-side platform
sonar-scanner, the client that analyzes code and reports results

3.1 Server-Side Installation

Here we run SonarQube with docker-compose.

Create the file docker-compose.yml :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
version: "2"

services:
  sonarqube:
    image: sonarqube:7.1
    ports:
      - "9000:9000"
    links:
      - postgres
    environment:
      - SONARQUBE_JDBC_URL:jdbc:postgresql://db:5432/sonar

  postgres:
    image: postgres:9.6.15
    volumes:
      - ./postgres:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_USER=sonar
      - POSTGRES_PASSWORD=sonar

In the directory containing the file, create an empty directory postgres , then run the command:

1
docker-compose up

3.2 Client-Side Installation

Taking OS X as an example,

1
2
3
4
brew install sonar-scanner
==> Downloading https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar
######################################################################## 100.0%
🍺  /usr/local/Cellar/sonar-scanner/4.0.0.1744: 7 files, 631KB, built in 25 seconds

4. Testing a Project

When using SonarQube you need to supply some required parameters, such as the address of the SonarQube Server and the location of the source code.

There are two ways to supply these parameters:

Via the command line

A Python project:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
sonar-scanner   -Dsonar.projectKey=bk-sops   -Dsonar.sources=.   -Dsonar.host.url=http://localhost:9000    -Dsonar.language="py"
...
INFO: More about the report processing at http://localhost:9000/api/ce/task?id=AWyzn_gfzoHby8A3MxUD
INFO: Task total time: 18.141 s
INFO: ------------------------------------------------------------------------
INFO: EXECUTION SUCCESS
INFO: ------------------------------------------------------------------------
INFO: Total time: 20.403s
INFO: Final Memory: 7M/37M
INFO: ------------------------------------------------------------------------

Via a configuration file

Create the configuration file sonar-project.properties :

1
2
3
4
5
6
7
8
sonar.projectKey=devops-python-sample
sonar.projectName=devops-python-sample
sonar.host.url=http://localhost:9000 #本地可以缺省，如果是远程服务，需要修改为合适地址
sonar.projectVersion=1.0
sonar.sources=./
sonar.language=py
sonar.sourceEncoding=UTF-8
# sonar.login=xxxxxx  登陆信息

Run the command:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
sonar-scanner
...
INFO: More about the report processing at http://127.0.0.1:9000/api/ce/task?id=AWyzoVZVzoHby8A3MxUE
INFO: Task total time: 5.260 s
INFO: ------------------------------------------------------------------------
INFO: EXECUTION SUCCESS
INFO: ------------------------------------------------------------------------
INFO: Total time: 7.583s
INFO: Final Memory: 7M/34M
INFO: ------------------------------------------------------------------------

Now let’s look at SonarQube’s analysis pages:

Home page

Project page

Defect display