Blog
Sonar's latest blog posts
What is Clean Code?
If you’ve followed us for a while, you most likely noticed that we changed the way we describe what we do: from “code quality” to “continuous code inspection,” then “code quality and code security”… to Clean Code.
But what is Clean Code, and what does it encompass?
Effective Code Review with Sonar
At SonarSource, we like eating our own dog food as much as possible. This is not always the case in software development, but in our case since we develop software for software companies, we can do it. We therefore have an instance of Sonar that analyses all our products daily.
Read Blog post >
Running local analysis with Sonar Eclipse 2.0
Have you tried Sonar Eclipse? If you're a fan of Sonar and you monitor the quality of your code daily, you probably already have installed this set of plugins that brings the power of Sonar right into your IDE. As a developer, I personally find it really useful to fix the violations directly in the code editor - while you can not do much about it when you're browsing the web resource viewer of Sonar.
Read Blog post >
SQALE, the ultimate Quality Model to assess Technical Debt
Six months ago, we would never have believed that one day we would be happy and excited to write about the implementation of a Quality Model in Sonar. Indeed the Quality Models that we knew at the time (most of them are based on ISO 9126 standard) are complex, expensive to implement, can be understood only by an elite of quality experts and are not fun at all.
Read Blog post >
Detect Dead Code and Calls to Deprecated Methods with Sonar Squid
Up to version 2.1, Sonar was relying only on external coding rules engines such as Checkstyle, PMD and Findbugs to report violations on Java applications. But since version 2.1, Sonar also provides its own rules engine to work on Java dependencies. This rules engine is based on Squid and three rules are currently available :
Read Blog post >
Securing access to projects in Sonar
When used out-of-the-box, Sonar is a code quality radiator accessible by everyone at anytime. Like for JIRA, Hudson, a post-it dashboard or any other piece of the development toolset transparency is a key success factor for adoption. So, by default in Sonar, anyone can access any project under continuous inspection and navigate through it.
Read Blog post >
Sonar to identify security vulnerabilities
During the last few months, Sonar has definitely become the leading Open Source Platform to manage Java code quality. The objective to democratize access to code quality is becoming concrete. However when analyzing source code, quality is only one aspect of things...
Read Blog post >
We had a dream : mvn sonar:sonar
About a year ago we started to dream about the possibility to launch a full quality analysis on any Maven projects, with no configuration by simply running a simple and easy to remember command. Last week, when the Sonar maven plugin joined the Codehaus Mojo project, this dream became reality from Sonar 1.8 onwards. Joining this project presents several advantages to Sonar but the main one is definitely the step toward simplicity. Indeed, the old way to launch a quality analysis was to execute the maven command "mvn org.codehaus.sonar:sonar-maven-goal:X.Y:sonar", it now becomes "mvn sonar:sonar". No need to carry anymore the Sonar web server version, the Sonar Maven plugin groupId, artifactId, ... simply launch "mvn sonar:sonar" !
Read Blog post >
Reuse in Sonar unit test reports generated by other systems
Reuse in Sonar unit test reports generated by other systems
Read Blog post >
Using quality profiles in Sonar
Last month, Sonar 1.6 was released. The main feature of the new version is the ability to manage quality profiles. The purpose of this post is to explain what gap the functionality fills, to define what is a quality profile and to explain how to use it. Prior to Sonar 1.6, it was only possible to run analysis with one set of defined coding rules per instance of Sonar. It means that within an instance of Sonar, it was not possible to process differently various types of projects (legacy application, technical libraries, new projects, ...). They were all analyzed with the same set of rules. Therefore there was sometimes unnecessary noise around the quality data that made it difficult to see quickly what real action was required. Sonar 1.6 turns off this noise by allowing to define and simultaneously use several quality profiles.
Read Blog post >
What makes Checkstyle, PMD, Findbugs and Macker complementary ?
There is often some misunderstanding when people talk about coding rules engines. Everyone tries to take position in favor of his preferred tool and does his best to explain what are the weaknesses of the other ones.
Read Blog post >
Discussing Cyclomatic Complexity
Googling on Cyclomatic Complexity (CC), gives some interesting results... Among those results, you'll find the two following definitions :
Read Blog post >