{"id":1223,"date":"2019-03-07T14:14:53","date_gmt":"2019-03-07T14:14:53","guid":{"rendered":"http:\/\/cppdepend.com\/blog\/?p=1223"},"modified":"2019-03-07T19:39:33","modified_gmt":"2019-03-07T19:39:33","slug":"brief-overview-of-the-cc-sonarqube-plugin-based-on-cppdepend","status":"publish","type":"post","link":"https:\/\/cppdepend.com\/blog\/brief-overview-of-the-cc-sonarqube-plugin-based-on-cppdepend\/","title":{"rendered":"Explore a flexible C\/C++ SonarQube plugin based on CppDepend."},"content":{"rendered":"

Both CppDepend and SonarQube are static analyzers that offer a rule-based system to detect problems in C\/C++ code. However, the CppDepend default Rules-Set\u00a0has very few overlaps<\/b>\u00a0with the SonarQube rules<\/p>\n

Basically, the SonarQube rules are good at analyzing what is happening inside a method, the code flow while the CppDepend code model, on which the CppDepend rules are based, is optimized for a 360 view of particular higher-scale areas including OOP, dependencies, metrics, breaking changes, mutability, naming…
\n<\/p>\n

Concretely SonarQube rules can warn about problems like a reference could be null, while CppDepend can warn you about too complex classes or components, and offer advice about how to refactor to make the code cleaner and more maintainable.
\nAnother point that makes the CppDepend ruling system unique is\u00a0how easy it makes to write custom rules<\/b>. With CppDepend a rule is a LINQ query, that queries a code model dedicated to code quality, edited live in Visual Studio, compiled and executed live at edition time.
\nConcretely, this piece of code below is a fully functional rule, could it be simpler?<\/p>\n

\/\/\u00a0<Name><\/span>Classes\u00a0must\u00a0start\u00a0with\u00a0an\u00a0I<\/b><\/Name>\r\n<\/span>warnif<\/span>\u00a0count<\/b>\u00a0><\/span>\u00a00<\/b>\u00a0\r\n<\/span>Application<\/b>.<\/span>Types<\/span>.<\/span>Where<\/span>(<\/span>t<\/span>\u00a0=><\/span>\u00a0t<\/span>.<\/span>IsClass<\/span>\u00a0&&<\/span>\u00a0!<\/span>t<\/span>.<\/span>SimpleName<\/span>.<\/span>StartsWith<\/span>(<\/span>\"C\"<\/span>)<\/span>)<\/span>\r\n<\/pre>\n
When defining a custom rule with CppDepend, the user doesn’t need to create a\u00a0 project, create a source file, step into the edit\/compile\/debug cycle, maintain a binary dll that requires effort to be shared, versioned and integrated.
\nWith CppDepend custom rules are raw texts, embedded as XML CDATA into the CppDepend project or rule files. Also, the documentation and how-to-fix guidelines can be embedded in the rule source code as comments.<\/p>\n
<\/p>\n
Also, each CppDepend rule can present its issues with extra data that will help to understand the problem and fix it.
\nMoreover, each rule can embed two formulas that attempt to estimate both the\u00a0cost to fix the issue<\/i>\u00a0and the\u00a0annual cost to let the issue unfixed<\/i>, also called the\u00a0technical-debt<\/i>\u00a0and the\u00a0annual interest<\/i>\u00a0of the issue.\u00a0Since these formulas rely on what really matters at fix time, this makes the debt estimations smart<\/b>.<\/p>\n
<\/p>\n
Finally, with CppDepend each rule is run in a few milliseconds even on a large code base. As a consequence, all rules can be passed in a few seconds (typically 2 or 3 seconds on a real-world code base), both in Visual Studio and in the Continuous-Integration system.
\nAs a benefit, after each compilation and also at check-in time, the developer instantly knows about the new and fixed issues since the baseline, and the impact in terms of technical debt fixed or created.
\nNow let’s explain how to integrate CppDepend rule results into the SonarQube system to cumulate the strength of both products.
\nI – C\/C++ Plugin Prerequisites<\/span><\/strong><\/p>\n