Both CppDepend and SonarQube are static analyzers that offer a rule-based system to detect problems in C/C++ code. However, the CppDepend default rules set has very few overlaps with the SonarQube rules.
Basically, SonarQube rules are good at analyzing what happens inside a method — the code flow — while the CppDepend code model, on which the CppDepend rules are based, is optimized for a 360° view of higher-scale areas including OOP, dependencies, metrics, breaking changes, mutability, naming…
Concretely, SonarQube rules can warn about problems like a reference that could be null, while CppDepend can warn you about overly complex classes or components, and offer advice on how to refactor to make the code cleaner and more maintainable. Another point that makes the CppDepend rule system unique is how easy it makes writing custom rules. With CppDepend, a rule is a LINQ query that queries a code model dedicated to code quality, edited live in Visual Studio, and compiled and executed live at edition time. Concretely, this piece of code below is a fully functional rule — could it be simpler?
// <Name>Classes must start with an I</Name>
warnif count > 0
Application.Types.Where(t => t.IsClass && !t.SimpleName.StartsWith("C"))
When defining a custom rule with CppDepend, the user doesn’t need to create a project, create a source file, step into the edit/compile/debug cycle, or maintain a binary DLL that requires effort to be shared, versioned and integrated. With CppDepend, custom rules are raw text, embedded as XML CDATA into the CppDepend project or rule files. Also, the documentation and how-to-fix guidelines can be embedded in the rule source code as comments.
Also, each CppDepend rule can present its issues with extra data that helps understand the problem and fix it. Moreover, each rule can embed two formulas that attempt to estimate both the cost to fix the issue and the annual cost of leaving the issue unfixed, also called the technical debt and the annual interest of the issue. Since these formulas rely on what really matters at fix time, they make the debt estimations smart.
Finally, with CppDepend each rule runs in a few milliseconds, even on a large code base. As a consequence, all rules can be run in a few seconds (typically 2 or 3 seconds on a real-world code base), both in Visual Studio and in the continuous integration system. As a benefit, after each compilation and also at check-in time, the developer instantly knows about the new and fixed issues since the baseline, and the impact in terms of technical debt fixed or created. Now let’s explain how to integrate CppDepend rule results into the SonarQube system to combine the strengths of both products.
I - C/C++ plugin prerequisites
- Install SonarQube.
- Install SonarQube Scanner or the old Sonar Runner.
- Add the SonarQube Scanner or the SonarRunner bin directory to the PATH environment variable.
II - Plugin installation and configuration
- Copy the sonar-cxx-plugin-cppdepend-1.0 from $CppDependInstallDir$/SonarPlugin to the $SonarQubeInstallDir$\extensions\plugins directory and restart SonarQube.
- The default CppDepend rules are loaded into the SonarQube rules repository. However, if you need to customize these rules, you can define your own custom rules using the .cdproj file path located under the SonarQube Administration tab.
- You have to log in as an admin and activate the CppDepend rules in the profile you want.
- Execute $CppDependInstallDir$/SonarRunnerForCppDepend.exe "the .cdproj file to analyze". For example: SonarRunnerForCppDepend.exe C:\MyWorkspace\test.cdproj. SonarRunnerForCppDepend will analyze the cdproj file using CppDepend and launch the SonarQube Scanner executable to load the results into SonarQube. Any other argument passed to SonarRunnerForCppDepend after the cdproj file argument will be passed to the SonarScanner command. For example, you can pass the version with this command: SonarRunnerForCppDepend.exe C:\MyWorkspace\test.cdproj -Dsonar.projectVersion=3.0
III - Plugin features
- Multi-module analysis: a CppDepend project can contain many C/C++ projects.
After the analysis, CppDepend does not put all the code in the same SonarQube module; instead, it creates a multi-module SonarQube project to isolate each project into a separate module, which makes code navigation very easy.
- Issues: CppDepend provides more than 250 rules by default, which you can easily customize completely.
CppDepend provides a powerful way to compute the technical debt of issues. The CppDepend technical debt and issue severity are passed to SonarQube.
- Standard metrics: the plugin calculates all the standard SonarQube metrics.
- Code duplication: duplications are detected by the CPD tool embedded in SonarQube.
- Coverage: the plugin loads coverage results from Cobertura and Microsoft Visual Studio XML result files.
However, you have to set the path where the XML coverage files are located.
Conclusion
The C/C++ SonarQube plugin is easy to install and use, and rule customization is very simple. You can try it and give us your feedback.