Details
-
Task
-
Status: Patch Available
-
Normal
-
Resolution: Unresolved
-
None
-
None
-
Code Clarity
-
Normal
-
All
-
None
-
Description
As we already have Cassandra's project configured for the sonarcloud.io INFRA-24196, I wonder if we will be able to release branches, trunk, and pull requests to get analyzed by the SonarAnalyzer tool.
Sonar is a code quality and security tool that is free to open-source projects and recommended by the INFRA team:
https://cwiki.apache.org/confluence/display/INFRA/SonarCloud+for+ASF+projects
It can have the following benefits without introducing any drawbacks (except for a few lines of source code)
- visualise the LFH problems to work on;
- see the trends in the source code;
- add an extra layer of static code analysis;
Changes below I have tested it locally with my SonarQube deployed on http://localhost:9000 and run the `act` for the GA part of the PR. It seems to work and parse classes correctly, but there are a few steps that need to be done by Cassandra's Committer or PMC (I do not have sufficient privileges):
- make sure that the SONARCLOUD_TOKEN is available for GA and enabled for the project;
- quality profile is configured for the project (the "Sonar way" seems to be heavy to run);
Attachments
Issue Links
- relates to
-
CASSANDRA-18239 Replace eclipse warnings based static code analysis with something better (CheckerFramework)
- Review In Progress
- links to