End to End Quality with the Sonar Ecosystem and the Water Leak - - PowerPoint PPT Presentation

▶
end to end quality
SMART_READER_LITE
LIVE PREVIEW

End to End Quality with the Sonar Ecosystem and the Water Leak - - PowerPoint PPT Presentation

Aug 11, 2023 157 likes •558 views

End to End Quality with the Sonar Ecosystem and the Water Leak Metaphor G. Ann Campbell @GAnnCampbell | ann.campbell@SonarSource.com @SonarLint | @SonarQube | @SonarSource SonarLint Leak Period Quality Gate 20+ Languages The <3 of the

slide-1
SLIDE 1

End to End Quality

with the

Sonar Ecosystem

and the

Water Leak Metaphor

@GAnnCampbell | ann.campbell@SonarSource.com @SonarLint | @SonarQube | @SonarSource

  • G. Ann Campbell
slide-2
SLIDE 2

SonarLint Leak Period Quality Gate

slide-3
SLIDE 3

20+ Languages

slide-4
SLIDE 4

The <3 of the ecosystem

Static Analysis

slide-5
SLIDE 5

What is Static Analysis?

Analyzing code, without executing it!

slide-6
SLIDE 6

Detecting Bugs, Vulnerabilities, and Code Smells

A Means to an End

slide-7
SLIDE 7

Why use Static Analysis

Catch new problems ASAP

  • the longer it takes to catch a bug, the more it costs
  • no one writes perfect code every time
  • rule description and precise issue location cut

research time

slide-8
SLIDE 8

Why use Static Analysis

Changing A might have added bugs in B

  • peer review misses new issues in untouched code
  • static analysis is machine-assisted code review; it

looks at every file every time

slide-9
SLIDE 9

Why use Static Analysis

Provide coaching

  • language best practices
  • team coding style
slide-10
SLIDE 10

SonarSource’s Toolbox

slide-11
SLIDE 11

Lexical Analysis

Only two things are infinite, the universe and human stupidity, and I am not sure about the former.

slide-12
SLIDE 12

Only two things are infinite, the universe and human stupidity, and I am not sure about the former.

Syntactic Analysis

Albert E.

Subjects Verbs

slide-13
SLIDE 13

Semantic Analysis

Albert E. Only two things are infinite, the universe and human stupidity, and I am not sure about the former.

slide-14
SLIDE 14

Semantic Analysis

Albert E. Only two things are infinite, the universe and human stupidity, and I am not sure about the former.

slide-15
SLIDE 15

Beyond Semantic: Symbolic Execution

Object myObject = new Object(); if(a) { myObject = null; } ... if( !a ) { ... } else { myObject.toString(); }

slide-16
SLIDE 16

Beyond Semantic: Symbolic Execution

Object myObject = new Object(); if(a) { myObject = null; } ... if( !a ) { ... } else { myObject.toString(); } //NPE

slide-17
SLIDE 17

Beyond Semantic: Symbolic Execution

Object myObject = new Object(); if(a) { myObject = null; } ... if( !a ) { ... } else { myObject.toString(); } //NPE

Program State#0 myObject != null

slide-18
SLIDE 18

Beyond Semantic: Symbolic Execution

Object myObject = new Object(); if(a) { myObject = null; } ... if( !a ) { ... } else { myObject.toString(); } //NPE

Program State#0 myObject != null Program State#1 myObject != null a = false Program State#2 myObject = null a = true

slide-19
SLIDE 19

Beyond Semantic: Symbolic Execution

... if( !a ) { ... } else { myObject.toString(); // NPE }

Program State#1 myObject != null a = false Program State#2 myObject = null a = true

slide-20
SLIDE 20

Beyond Semantic: Symbolic Execution

... if( !a ) { ... } else { myObject.toString(); // NPE }

Program State#1 myObject != null a = false Program State#2 myObject = null a = true

slide-21
SLIDE 21

Beyond Semantic: Symbolic Execution

... if( !a ) { ... } else { myObject.toString(); // NPE }

Program State#1 myObject != null a = false Program State#2 myObject = null a = true Program State#4 myObject = null a = true

slide-22
SLIDE 22

SonarAnalyzer for Java and JavaScript

Cross-Procedural Analysis

slide-23
SLIDE 23

What is Static Analysis ?

Analyzing code, without executing it. by (symbolically) executing all possible paths!

slide-24
SLIDE 24

Symbolic Execution Almost Everywhere

▪ SonarAnalyzers for C#, C/C++, Java, and JS ○ Dereferences of Null Pointers ○ Unconditionally True/False (sub)conditions ○ Division by zero ○ Resource leaks

■ Unclosed resources (Java) ■ Unreleased memory (C/C++)

○ Double free (C/C++)

slide-25
SLIDE 25

Fewer slides, more code!

slide-26
SLIDE 26

Full Cycle

SonarQube IDE Full Analysis

slide-27
SLIDE 27

Full Cycle

SonarQube IDE

slide-28
SLIDE 28

SonarLint Leak Period Quality Gate

Fix the Leak

slide-29
SLIDE 29

Reimbursing the Debt

slide-30
SLIDE 30

▪ Total amount of Technical Debt can be depressing ▪ How to get a budget to fix old Technical Debt? ▪ Risk of injecting functional regression ▪ This is not fun!

This is Hard

slide-31
SLIDE 31
slide-32
SLIDE 32

Project Homepage

slide-33
SLIDE 33

Project Homepage: Leak Period

slide-34
SLIDE 34

SonarLint Leak Period Quality Gate

Fix the Leak

slide-35
SLIDE 35

Quality Gate

slide-36
SLIDE 36

Project Homepage: Quality Gate

slide-37
SLIDE 37

Quality Gate

slide-38
SLIDE 38

SonarLint Leak Period Quality Gate

Fix the Leak

slide-39
SLIDE 39

Thanks!

@GAnnCampbell | ann.campbell@SonarSource.com @SonarLint | @SonarQube | @SonarSource

  • G. Ann Campbell