Integrate SonarQube as part of the OpenCover build pipeline

[sawilde]

#242 (comment)

By using SonarQube alongside Coverity we can only make the code better.

Questions
As there a SaaS for this?
Is it free?

[ddur]

There is a free service announcement
Link in above announcement is obsolete
Free SonarQube service for Open Source - Nemo
Software is free, released under GPL license.

[ddur]

http://www.sonarqube.org/easy-analysis-of-visual-studio-solutions-with-the-sonarqube-scanner-for-msbuild/

[ddur]

http://blogs.msdn.com/b/visualstudioalm/archive/2015/09/29/quickstart-analyzing-net-projects-with-sonarqube-msbuild-or-visual-studio-online-and-third-party-analyzers-stylecop-resharper.aspx

[ddur]

Cannot find sign-up. Service is free but not freely available? :)

[sawilde]

Raised issue on forum - https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!topic/sonarqube/DPeFf1RoVis

[sawilde]

It appears that SonarQube cannot build windows projects but are in the process of allowing "self-service" but dates not finalized. Will need to review at a later date.

Task: Review SonarQube and Nemo for self-service functionality and act accordingly.

[sawilde]

Installation Steps:

• download and unpack sonarqube-5.3.zip
• download and unpack sonar-csharp-plugin-4.4.jar and place in extensions
• download and unpack MSBuild.SonarQube.Runner-1.1.zip

*** you may need to 'unblock' the zip files before extraction

to run

• run sonarqube-5.3\bin\windows-x86-32\startsonar.bat
• open Visual Studio Developer Prompt 2013
• \Projects\sonarqube-runner\MSBuild.SonarQube.Runner.exe begin /k:"opencover" /n:"opencover" /v:"0.0.0.1"
• msbuild main\OpenCover.sln /t:rebuild
• \Projects\sonarqube-runner\MSBuild.SonarQube.Runner.exe end

view results

• access site http://localhost:9000 using admin/admin

not only have c# analysis so far - can't find c++ plugin (licence?)

[sawilde]

Some interesting thoughts to improve on code - I just need a place to push results to for shared access and review.

[sawilde]

All of the criticals are OWASP related and the Console.WriteLine statements - will try to remove/ignore these

[sawilde]

@SteveGilham does this data look like your results? Did you manage to get the c++ plug-in working?

[ddur]

https://github.com/SonarOpenCommunity/sonar-cxx

(https://www.openhub.net/p/sonar-cxx)

[ddur]

info http://baptiste-wicht.com/posts/2014/10/sonarqube-inspections-for-cpp-projects.html

[SteveGilham]

The results look to be in the same ballpark

but not identical.

This was just using the built-in C# rules plugin in default mode; I just saw the standard C/C++ ruleset was commercially licensed and went no further. This was all done in the rather dead time in the office on Christmas Eve, and I've not had chance to do any more with the framework and what it can do apart from inspect C# code since.