Components of SonarQube

 What is SonarQube ?

SonarQube is a Code Quality Assurance tool that collects and analyzes source code and it provides reports of the quality of the code of your project. It is also a self-managed, automatic code review tool that systematically helps you deliver clean code efficiently.
SonarQube integrates into your existing workflow and detects issues in your code to help you perform continuous code inspections of your projects. It combines static and dynamic analysis tools and enables quality to be measured continually over time. This provides users with a searchable history of the code to analyze where the code is messing up and determine whether or not it is styling issues, code defects, code duplication, lack of test coverage, or excessively complex code. The software will analyze source code from all the different aspects and separates down the code layer by layer, moving module level down to the class level, with each level producing metric values and statistics that should reveal problematic areas in the source code that needs improvement and along with it, it provides the complaint solution to all the issues found during code review.
SonarQube also ensures code reliability, application security, and reduces technical debt by making your code base clean and maintainable. SonarQube also provides support for 27 different languages, including C, C++, Java, JavaScript, PHP, GO, Python, and much more. SonarQube supports integration with CI/CD tool and gives feedback during code review with branch analysis and pull request.

Fig: Working structure of SonarQube

Why should we use SonarQube?

SonarQube reduces the risk of software development within a very short period of time. It detects bugs in the code automatically during the code analysis process, in the early stage and alerts developers to fix them before rolling it out for production. SonarQube also highlights the complex areas of code that are less covered by unit tests which is a added advantage. It doesn’t just show you what’s wrong, but also offers quality and management tools to actively helps you correct issues with solution.
It focuses on more than just bugs and complexity and offers more features to help the programmers write code, such as coding rules, test coverage, de-duplications and code complexity all within a dashboard.
It also gives a moment-in-time snapshot of your code quality today, as well as trends of past and potentially future quality indicators. It provides metrics to help you make the right decisions.

 

Components of SonarQube:

The SonarQube server running the following processes:

A web server that serves the SonarQube user interface and which allows managers to browse quality snapshots and configure the SonarQube instances
A search server based on Elasticsearch to back searches from the UI.
The compute engine in charge of processing code analysis reports and saving them in the SonarQube database.

The database to store the following:

Metrics and issues for code quality and security generated during code scans.
The SonarQube instance configuration.

One or more scanners running on your build or continuous integration servers to analyze projects.

                                                                                                                       Fig: Components of SonarQube

 

 

SonarQube Analysis Report:

After the code analysis of the source code is completed, the results are generated on SonarQube dashboard. Thus, SonarQube executes rules on source code to generate issues. There are four types of rules:

Code Smell (maintainability domain)
Bug (Reliability domain)
Vulnerability (Security domain)
Security Hotspot (Security domain)

For code smells and bugs, zero false positives are expected. At least this is the target so that developers or QA’s  don’t have to wonder if a fix is required. For vulnerabilities, the goal is to have more than 80% of issues be true positives. Security hotspot rules draw attention to code that is security-sensitive. It is expected that more than 80% of the issues will be quickly resolved as “reviewed” after being reviewed by a developer or QA.

 

 

Conclusion:

Now that you’ve heard about how SonarQube can help you write clean code it also allows us to have a constant quality inspection of code quality across various quality factors such as Architecture and Design, semantics, bugs, security, duplications, unit tests, complexity, security vulnerabilities detection, integration capabilities etc. It empowers developers and QA teams to proactively identify code quality issues and address them, leading to better software reliability and security. Because it has support for over 20+ programming languages, it is versatile for any development team that utilizes various common technology stacks to build their software. This doesn’t only ensure that you meet your corporate compliance rules and policies, but also saves you valuable time and money.

Source: Read More