A talk about SonarQube; a bit outdated now, written in 2010, uploaded for posterity sake.

1. Josh Cummings
Developer – Java Stack
ICS
Paying Off Your
Technical Debt
If you can read this, you don’t need glasses.

2. Halloween Costume – October 2009
Mein Kode

3. Halloween Costumes – 2007-2010
The Phantom Reference
Photo courtesy of
tinyfroglet at
http://www.flickr.com/ph
otos/tinyfroglet/271425079
8/sizes/m/in/photostream/

4. • Why pay down Technical Debt?
• Good debt vs. Bad Debt
• Managing Debt with Sonar
• Batch
• Server
• Priorities
• SDLC
• Technical Debt and the Stack
Goal

5. • “Shipping first time code is like going
into debt. A little debt speeds development so
long as it is paid back promptly with a rewrite... The
danger occurs when the debt is not repaid. Every
minute spent on not-quite-right code counts as
interest on that debt. Entire engineering
organizations can be brought to a stand-still under
the debt load of an unconsolidated implementation,
object-oriented or otherwise.”
- Ward Cunningham, 1992
Why pay it down?

6. Good debt vs. Bad Debt
Unintentional Intentional
Good
• Long-term, for
strategic reasons
• Focused short-
term, for iterative
reasons
Bad
• How would it be
to take out a loan
without realizing it?
• Unfocused short-
term (credit card
debt)
You are fail
http://blogs.construx.com/blogs/stevemcc/archive/2007/11/01/technical-debt-2.aspx,
Technical Debt
Rationale
• First to market
• Dependencies
• The president
says now
• Laziness
• End of the day
• Ignorance

7. • Begun in 2008 by Freddy Mallet
• Active development and user community
• 4000 downloads/month
• More than 30000 total downloads
• Dozens of plug-ins
• Started with the goal to assist development teams in
paying off technical debt. Evolved into a
development platform for many static analysis tools.
Enter Sonar
Portfolio
View
Project
Insight
Source
Code
Action Plans

8. Sonar and the 5 Cs
Copy-paste
Complexity
CommentsQuality
Coverage

9. • Start up local sonar, or point to a remote one.
• Hint: There are deployments at code.lds.org and also at
sonar.ldschurch.org that you can point to.
• Issue the command ‘mvn sonar:sonar’ either from
the command-line or from Eclipse. Don’t forget to use
Maven 2.
• Wait patiently.
• Once complete, go to http://localhost:9000 to view
your results.
Batch – Analyzing your project If you do this, the Stack’s plug-ins
will run automatically against your
project.

10. • Invoking third-party tools
• In order to make version compatibility easier, Sonar issues
the appropriate maven goal for each third-party tool instead
of invoking it directly in their respective plug-ins.
• The basic plug-in’s purpose is narrowed down to translating
third-party tool’s output into Sonar input.
• Some plug-ins do invoke their respective tool inline.
• Other tools raise Sonar’s awareness to other languages
• Aggregating information
• Some plug-ins, like PMD and FindBugs, are natural
candidates for aggregation and filtering. Sonar provides
Quality Profiles to allow the coder to fine-tune what actually
gets reported on the dashboard.
Batch – Analyzing your project

11. • Coverage: Clover, Cobertura,
Emma
• Quality: Checkstyle, FindBugs,
PMD
• Comments
• Copy-paste
• Complexity: LCOM4, RFC,
Cyclometric, Dependencies
Server – Analyzing your project

12. • Time Machine: Trends
• Clouds: Big word = Big problem
• Hotspots: Quick Wins
• Alerts: Thresholds
Server – Analyzing your project

13. • Sonar Eclipse Plugin
When does bad debt get noticed?
Static Analysis
typically
happens here
It would be
nice if it
were over
here.

14. • Plug-ins
• XML rules – Maven, Spring, Tomcat
• CSS rules
• Integration test coverage
• HTML
• JavaScript
• Maven dependency analysis
Sonar and the Stack
Not yet
Here today

15. • Add your project today ICS’s Sonar dashboard
• Community Deployment: http://code.lds.org/sonar
• Internal Deployment: http://sonar.ldschurch.org
• Download Sonar 2.2 at http://sonar.codehaus.org
• Read about my Sonar exploits at
http://tech.joshuacummings.com
Thank you!
Do it!