SonarQube is an open source tool that analyzes source code and stores the results in a database. It makes this analysis data available through a dynamic website. SonarQube performs static code analysis to automatically find potential errors or poor coding practices by analyzing source code. The analysis focuses on detecting errors, recommending code formatting improvements, and computing code metrics.

1. @2020 copyright KalKey training

2. SONARQUBE – WHAT IS IT?
• SonarQube is an open source Web Application
• Takes in input a set of source code files and a set of analyses results (produced by external tools).
• Stores both sources and results in a database.
• Makes available the gathered information via a dynamic website where the results are shown in the
context of the code itself.
@2020 copyright KalKey training

3. WHAT IS STATIC CODE ANALYSIS ?
• Static code analysis is a collection of algorithms and techniques used to analyze source code in order
to automatically find potential errors or poor coding practices.
• Static code analysis, also commonly called "white-box" testing,
• The tasks solved by static code analysis software can be divided into 3 categories:
1. Detecting errors in programs
2. Recommendations on code formatting
3. Metrics computation
@2020 copyright KalKey training

4. SONAR STRUCTURE
@2020 copyright KalKey training

5. SONARQUBE AND
CONTINUOUS
INTEGRATION
@2020 copyright KalKey training

6. HOW DOES IT WORK?
• SonarQube takes project code as the input, analyzes it using pre-defined coding rules and publishes web
based results giving overview of technical quality of code.
• SonarQube can analyze source code in 20+ different languages. Input can be the project source code or
compiled code depending on the language.
@2020 copyright KalKey training

7. TYPE OF ANALYSIS
• Static analysis of source code  Language supported All (Java files, COBOL programs, etc.)
• Static analysis of compiled code  Language supported Certain languages (.class files in Java, .dll files
in C#, etc.)
• Dynamic analysis of code  Language supported Certain languages (execution of unit tests in Java,
C#, etc.)
Note: Analysis is carried out using pre-defined rules based on industry coding standards /best practices.
Rules for a particular language are available as plug-in for most of the languages.
@2020 copyright KalKey training

8. QUALITY PROFILE
• Each language plugin comes with a predefined, built-in profile (called “Sonar way”) having set of pre-
defined rules and it will be used as default profile during analysis for projects.
• New quality profiles can be created to configure rules as per project requirements, but it’s optional.
• SonarQube allows inheritance in quality profiles thereby allowing to inherit rules provided by plugin in
the default profile.
@2020 copyright KalKey training