Reduce bugs, vulnerabilities, and code smells, among other issues in .NET core apps, with this tool.
In line with the previously addressed topics, the quality of software is a concern to be taken into account by companies and professionals in the field.
Previously, we discussed testing, which is an excellent ally in the pursuit of quality. However, there are other aspects that we intend to emphasize in this article, such as secure codes and their complexities. Complexity for readability, as well as for incorporating new changes easily.
You might be thinking, but code review can mitigate these impacts. The proposal is not to rely solely on developers, but to use a tool that analyzes the code and identifies issues related to the points mentioned above within minutes. As a bonus, it provides suggestions for correction.
SonarQube
It is a code analysis tool that assists developers in delivering quality, secure, consistent, reliable, and low-complexity code. It supports more than 30 programming languages and can be integrated into the continuous integration pipeline.
Developed in the Java language in 2006.
In terms of licensing, it has a free version and other paid versions.
SonarQube allows you to identify:
Security vulnerabilities;
Bugs;
Code duplication;
Test coverage level;
Code complexity that could hinder the maintenance process;
It also allows creating new rules to ensure that certain standards are followed.
Functioning
The solution consists of two applications: a client that gathers data from the source code and its respective tests, and another server that processes the collected data and presents reports and correction suggestions. On the server, configurations can be made, and new rules can be created.
Demonstration
For demonstration purposes, the proposal is to install the Community Edition version. The server will be installed in a Docker container, along with a PostgreSQL database. To facilitate this, a Docker Compose file (docker-compose.yml) is provided, which allows configuring and launching multiple containers simultaneously.
The file must be created with the name docker-compose.yml. The suggestion would be to create a folder, within the folder create the file, and execute the following commands.