Sonar

sonar

AI code review is becoming more important in software development, ensuring code quality, identifying bugs, and improving overall project maintainability. In recent years, several tools have emerged to automate and streamline the code review process. In this comparative blog, we will explore and compare Metabob, an AI code review tool, against popular static code review tools like Sonarlint, Sonarcloud, and DeepSource. We will also take a look at how some of these solutions utilize Generative AI for user interaction. The bases of comparison are the level of complexity of identified issues and overall user experience. To conduct our comparison, buggy GitHub Repositories were singled out for extensive testing. These repos include: fiatrete/OpenDan opencodeiiita/PhotoStore fief-dev/fief TransformerOptimus/SuperAGI Metabob stands out as a unique AI code review tool that leverages Graph Neural Networks to identify bugs and LLMs to provide automated code recommendations. It analyzes code snippets and offers suggestions for improvement, bug detection, and best coding practices. Sonarlint, developed by SonarSource, is a powerful static code analysis tool that integrates with popular integrated development environments (IDEs) like IntelliJ, Visual Studio Code, and Eclipse. Sonarcloud, also developed by SonarSource, takes static code analysis a step further by offering cloud-based continuous code inspection. It automatically scans code repositories, providing comprehensive reports on code quality, security vulnerabilities, and technical debt. DeepSource is another static code analysis platform that helps identify bugs, security vulnerabilities, and style violations. Complexity Simple, rule-based code reviews Syntax errors, empty variable assignments, and unnecessary complexity are all examples of simple bugs that occur in scripts. In this regard, Sonarlint, SonarCloud, and DeepSource perform very well. They identify such errors quickly and highlight regions of code that are potentially buggy. Metabob is also able to highlight very blatant errors like empty variable assignments, but it does not do well recommending stylistic syntax issues. Metabob glosses over these issues and deems them insignificant. Complex, context-based code reviews Using its attention mechanism from Graph Neural Networks to comprehend semantic and rational markers, Metabob performs much better than its competitors in this aspect. Metabob is able to detect complex, context-based errors, while the other solutions fail to do so. The example below details a script that uses the HS256 algorithm to generate access tokens. Metabob was able to identify the usage of this algorithm and its weakness against certain attacks. Metabob then recommends the replacement of this algorithm with RS256 or ES256 algorithms to prevent such attacks. Another example of complex errors is a race condition. Metabob is able to understand the objective of the function and what it is trying to achieve. It is also contextualizing this objective to the other functions present in the script. This combination of information helps it identify race conditions. Without contextualizing code within and across scripts, SonarLint, SonarCloud, and DeepSource are not able to determine such issues. User Experience SonarCloud and DeepSource are web-based SaaS platforms that take some time to configure and use. They both feature a dashboard that displays statistics about each repository (security, performance, stylistic issues) while allowing users to navigate through different issues. This makes navigation within the platform very user-friendly and organized.\ SonarLint and Metabob are available as integrated extensions on VScode. They operate right out of the IDE, with no complex configurations required. Metabob then takes it a step further to incorporate generative AI into its user experience. Using LLMs, Metabob generates error explanations, answers users’ questions, and even recommends code fixes. This allows users to engage with the tool to better understand the identified issues and bugs. Conclusion While SonarLint, SonarCloud, and DeepSource are the go-to solution when it comes to simple error identification, Metabob's competitive advantage lies in identifying complex errors. This was evident in the repository analysis conducted, where Metabob could detect all the contextual-based errors while the other tools failed to do so. However, Metabob is only available for Python as a programming language for now, and support for more languages is being worked on. Metabob utilizes generative AI to enhance its user experience, keeping the tool interactive. Its unique question-and-answer AI assistant allows users to clarify issues, and the LLM code fix recommendations elevate the coding standard to a higher level. Metabob offers free-to-use individual developer versions and is currently available on VScode as an extension. The tool can be tested here: ! Metabob: Debug and Refactor with AI - Visual Studio Marketplace

AI Code Review: Comparing Metabob with Sonar & DeepSource

All You Need to Know About Continuous Integration, GitHub Actions, & Sonar Cloud

ক্রমাগত ইন্টিগ্রেশন, গিটহাব অ্যাকশন এবং সোনার ক্লাউড সম্পর্কে আপনার যা জানা দরকার

Alles, was Sie über kontinuierliche Integration, GitHub-Aktionen und Sonar Cloud wissen müssen

Todo lo que necesita saber sobre integración continua, acciones de GitHub y Sonar Cloud

Tout ce que vous devez savoir sur l'intégration continue, les actions GitHub et Sonar Cloud

निरंतर एकीकरण, गिटहब क्रियाएँ, और सोनार क्लाउड के बारे में आप सभी को पता होना चाहिए

継続的インテグレーション、GitHub アクション、Sonar Cloud について知っておくべきこと

지속적인 통합, GitHub Actions 및 Sonar Cloud에 대해 알아야 할 모든 것

Tudo o que você precisa saber sobre integração contínua, ações do GitHub e Sonar Cloud

Sürekli Entegrasyon, GitHub Eylemleri ve Sonar Cloud Hakkında Bilmeniz Gereken Her Şey

Tất cả những gì bạn cần biết về tích hợp liên tục, hành động GitHub và đám mây Sonar

关于持续集成、GitHub Actions 和 Sonar Cloud，您需要知道的一切

SonarQube is an open-source tool that helps developers continuously inspect the code quality of their projects. It provides code analysis, code coverage, and code duplication detection, along with various other features. With SonarQube, developers can easily detect and fix the technical debt, improving the quality of their code. Prerequisites Any basic programming language knowledge. Basic OOPS concepts understanding The article demonstrates SonarQube Analysis with C# programming language. Learning Objectives How to do SonarQube analysis via the Docker Image How to analyze C# application via the Docker Image Getting Started Running SonarQube on a local machine can sometimes be cumbersome due to the complex setup requirements, but Docker can simplify the process. Docker is a platform for building, shipping, and running container applications. Docker provides an easy-to-use interface for managing and deploying applications and can be used to run SonarQube. In this article, we will explore the steps to run SonarQube via the Docker image: Step 1: Install Docker The first step to running SonarQube via Docker is to install Docker on your machine. Docker provides installation instructions for different operating systems on their website. Step 2: Pull the SonarQube Image Once Docker is installed, the next step is to pull the SonarQube image from the Docker Hub. You can do this by running the following command in the terminal: docker pull sonarqube This command will download the latest SonarQube image from the Docker Hub. Step 3: Run the SonarQube Container Now that the SonarQube image has been downloaded, the next step is to run the SonarQube container. You can do this by running the following command in the terminal: docker run -d --name sonarqube -p 9000:9000 sonarqube This command will start the SonarQube container and expose port 9000 on the host machine. You can access the SonarQube web interface by opening a web browser and navigating to . http://localhost:9000 Step 4: Analyze Code with SonarQube With the SonarQube container up and running, you can now analyze your code by following these steps: Generate a SonarQube analysis report for your codebase. Copy the report to the SonarQube container. Run the SonarQube analysis by executing the following command: docker exec sonarqube /opt/sonar-scanner/bin/sonar-scanner \
   -Dsonar.projectKey=<project_key> \
   -Dsonar.sources=<path_to_code> \
   -Dsonar.host.url=http://localhost:9000 \
   -Dsonar.login=<token> Analyze a C# application using SonarQube via the Docker image Step 1: Add SonarQube Scanner for MSBuild to your project The SonarScanner for MSBuild is a .NET Core tool that helps to integrate SonarQube analysis into the MSBuild process. You can add the SonarScanner for MSBuild to your project by running the following command in the terminal: dotnet tool install --global dotnet-sonarscanner Step 2: Generate a SonarQube Analysis Report Once the SonarScanner for MSBuild is installed, the next step is to generate a SonarQube analysis report for your C# project. You can do this by running the following command in the terminal: dotnet sonarscanner begin /k:"<project_key>" /d:sonar.host.url="http://localhost:9000" /d:sonar.login="<token>" Replace with a unique identifier for your project and the authentication token for your SonarQube instance. <project_key> <token> This command will begin the SonarQube analysis and generate a report for your C# project. Step 3: Build your C# project Next, build your C# project using the following command: dotnet build This command will compile your C# code and create a binary executable. Step 4: Analyze your C# project with SonarQube Once your C# project is built, you can analyze it with SonarQube by running the following command: dotnet sonarscanner end /d:sonar.login="<token>" This command will end the SonarQube analysis and upload the report to your SonarQube instance. Step 5: View the SonarQube Analysis Results Now that the analysis is complete, you can view the results in the SonarQube web interface by navigating to . In the SonarQube interface, you can see information about code quality, code coverage, and other metrics for your C# project. http://localhost:9000 Conclusion That’s it! Following these steps, you can quickly analyze your C# application using SonarQube via the Docker image. SonarQube can help you identify code quality issues and improve the overall maintainability of your codebase. Also published . here

Analyzing Your Code With SonarQube Running via Docker Image

In this guide, we are going to deploy a continuous integration process between Jenkins, GitLab, and SonarQube. The end goal will be to review the code quality through SonarQube for GitLab repository using Jenkins. Following is the process flow we need to manage: Push code to GitLab from the local machine. Next, checkout code and run tests in Jenkins, here it is acting as a Continuous Integrator. Generate quality report via SonarQube as a code analyser. Setup Jenkins, SonarQube & GitLabs In case, if you haven't set up the required software yet, go through the below-mentioned steps: Step 1: Make sure that your host machine has enough power to run these components, as GitLab alone requires 4 GB of RAM to perform its operations smoothly. To run all three together, you need at least 8 GB of RAM and 20 GB of hard disk space. Step 2: For SonarQube, you need to set the recommended values as a root user on the host machine: $ sysctl -w vm.max_map_count= $ sysctl -w fs.file-max= $ ulimit -n $ ulimit -u 262144 65536 65536 4096 Step 3: For this guide, we are going to use a simple docker-compose.yml file. However, you are free to edit the file as per your requirement. Before launching the containers, please make sure that you change the value of , , , and . Although, along with this, you can also modify the define ports in the file. GITLAB_SECRETS_DB_KEY_BASE GITLAB_HOST SONARQUBE_JDBC_PASSWORD POSTGRES_PASSWORD version: services:
   jenkins:
       image: jenkinsci/jenkins:lts
       container_name: jenkins-container
       restart: always
       ports:
           - - volumes:
       - - environment:
       - gitlab:
       image: gitlab/gitlab-ce:latest
       container_name: gitlab-container
       restart: always
       environment:
           - GITLAB_SECRETS_DB_KEY_BASE=long-and-random-alphanumeric-string
           - GITLAB_HOST=your-host-ip-here
           - GITLAB_PORT= - GITLAB_SSH_PORT= ports:
           - - volumes:
       - - - sonarqube:
       image: sonarqube: -community
       container_name: sonar-container
       restart: always
       networks:
           - sonarnet
       environment:
           - SONARQUBE_JDBC_USERNAME=sonar
           - SONARQUBE_JDBC_PASSWORD=your-strong-password-here
           - SONARQUBE_JDBC_URL=jdbc:postgresql: ports:
       - - volumes:
       - - - - postgressdb:
       image: postgres: container_name: postgres-container
       restart: always
       networks:
           - sonarnet
       environment:
           - POSTGRES_USER=sonar
           - POSTGRES_PASSWORD=your-strong-password-here
           - POSTGRES_DB=sonarqube
       volumes:
       - - networks:
   sonarnet:
    driver: bridge "3.2" "8080:8080" '50000:50000' '/var/run/docker.sock:/var/run/docker.sock' '/data/jenkins/jenkins_home:/var/jenkins_home' "JENKINS_OPTS=--prefix=/jenkins" 10080 10022 "10080:80" "10022:22" '/data/gitlab/config:/etc/gitlab' '/data/gitlab/logs:/var/log/gitlab' '/data/gitlab/data:/var/opt/gitlab' 7.9 .2 //postgressdb:5432/sonarqube "9000:9000" "9092:9092" '/data/sonar/sonarqube_conf:/opt/sonarqube/conf' '/data/sonar/sonarqube_data:/opt/sonarqube/data' '/data/sonar/sonarqube_extensions:/opt/sonarqube/extensions' '/data/sonar/sonarqube_bundled-plugins:/opt/sonarqube/lib/bundled-plugins' 12.1 '/data/postgresql/sonarqube_db:/var/lib/postgresql' '/data/postgresql/postgresql_data:/var/lib/postgresql/data' Now, run the following command to launch the stack: $ docker-compose up -d Note that the installation process is going to take some time, so sit back and have some coffee. You deserve it! Step 4: Now, to verify if all systems are up and running, run this command: $ docker ps

CONTAINER ID    IMAGE                     COMMAND             CREATED         STATUS                  PORTS                                                   NAMES
f54e223417fa    gitlab/gitlab-ce:latest minute ago minute ago (healthy) /tcp, : -> /tcp, : -> /tcp   gitlab-container f03f69b8    sonarqube minute ago minute ago : -> /tcp                                  sonar-container f554da39fc    jenkinsci/jenkins:lts minute ago minute ago : -> /tcp, : -> /tcp        jenkins-container "/assets/wrapper" 1 1 443 0.0 .0 .0 10022 22 0.0 .0 .0 10080 80 9102 "./bin/run.sh" 1 1 0.0 .0 .0 9000 9000 05 "/bin/tini --..." 1 1 0.0 .0 .0 8080 8080 0.0 .0 .0 50000 50000 If all went well, then you can access all three of them by following mentioned URLs: Jenkins - http://your-ip-address:8080 SonarQube - http://your-ip-address:9000 GitLab - http://your-ip-address:10080 As you are visiting your Jenkins environment for the first time, it is going to prompt you to enter the administrator password, which was generated during the installation process. To access the password from the container, you can run the following command: $ docker exec -it <your-jinkins-container-id> cat / /jenkins_home/secrets/initialAdminPassword
$ gSzHTGfbtXSpcBXMyJ6gzmNfNH7BjhK23 var Once you enter the password, you can select the option . Wait until the download finishes. Install suggested plugin For SonarQube, the default username and password are admin and admin, respectively. Whereas, for GitLab, you will be prompted to enter the new password for the default username root. Configuring Jenkins Pipeline with SonarQube and GitLab integration We will begin with SonarQube. To connect it with Jenkins, you need to generate the token to access the SonarQube instance. SonarQube Configuration: Login into the SonarQube dashboard and go to the Administrator tab. In the Security drop-down menu, select User tab as shown in the below image: Here you will find Administrator user, for which you are going to generate the access token: In the pop-up that displays on your screen, enter the desired name and click on the button. Copy the newly generated token and save it somewhere safe, as you won’t be able to view/copy the generated token again. Generate To establish a connection between GitLab and Jenkins, again, we need to generate an access token, which can be done as mentioned below: GitLab Configuration: To generate an access token, go to your GitLab dashboard and follow . Once you have the token with you, copy it for further use. Dashboard > Setting > Access Tokens This guide assumes that you have already done the basic setup for Jenkins. Now, let’s move to configure GitLab and SonarQube in the Jenkins server. Integrating SonarQube and GitLabs in Jenkins: First, we are going to integrate SonarQube. Go and search for SonarQube. Dashboard > Manage Jenkins > Manage Plugins Make sure you restart Jenkins once the plugin is successfully installed. Once the restart is completed, you have to set up Sonar Scanner, which is a standalone tool used for scanning the source code and send the result to SonarQube Server. Here you are going to install it in the Jenkins container itself, although you are free to launch a separate container for the same purpose. $ docker exec -it <your-jinkins-container-id> bash

$ cd / /jenkins_home

$ wget https: $ unzip sonar-scanner-cli -linux.zip var //binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.2.0.1873-linux.zip -4.2 .0 .1873 Go back to the Manage Jenkins page and select Global Tool Configuration. In this page, find SonarQube Scanner and add complete the installation: Don’t forget to uncheck as you have to define the installation path of Sonar Scanner explicitly. Install automatically As Jenkins and SonarQube are running in separate docker containers, we need to create a Webhook at SonarQube Server so that both can communicate with each other. To do so, follow : Dashboard > Administrator > Configuration > Webhook Lastly, you have to add the access token you generated on your SonarQube server in Jenkins. Follow the URL or go to , as shown below: http://your-ip-addr-here:8080/credentials/store/system/ Dashboard > Credentials > System Click on link and select “Secret Text” field under : Add Credentials Kind In the Secret field, paste the generated token from SonarQube that you previously created. Now, add the SonarQube server to your Jenkins environment. Go to . Find on the page and add the required details as mentioned below: Dashboard > Manage Jenkins > Configure System SonarQube server Now, you have to add Gitlab in Jenkins, visit . Here, you are going to add the access token you previously created to your Jenkins server. Although, you can also use with username and password. Dashboard > Credentials > System Kind As you are through with the SonarQube and GitLab integration in Jenkins, it’s time to manage other dependencies. In this guide, we are going to use a simple NodeJs application; hence it’s time to install NodeJS on your Jenkins Server. NodeJS Environment in Jenkins: To install NodeJS plugin, go to and search and select NodeJS. Click on the button, as shown in the figure below. Dashboard > Manage Jenkins > Manage Plugins > Available Install without restart Upon successful installation of NodeJS plugin in Jenkins, make sure that you restart Jenkins. To configure NodeJS plugin, go to and find "NodeJS". Click on NodeJS installation button and add the necessary details, as shown in the figure: Dashboard > Manage Jenkins > Global Tool Configuration Give a name and select the NodeJS version as per your requirement; you can also install Global NPM packages and set the refresh rate depending upon the project requirements. Once done, you need to save the configuration. As we are through with the gruesome part of installing and configuring the environment, it’s time to create the project pipeline. Creating Jenkins Pipeline Here you are going to create a pipeline using Declarative Scripted Pipeline. Follow the below steps to get started: Go to Jenkins’ Dashboard and click on the “New Item” link. Now, enter the item name and select option as shown in the figure: Step 1 - Create a New Job Pipeline The below-mentioned simple pipeline script helps you to pull the code from GitLab, quality check via SonarQube, and use NodeJS. Step 2 - Pipeline pipeline {
agent any
tools {nodejs }
stages {
 stage( ) {
  steps {
   git branch: , : , : }
 }
   stage( ) {
   steps {
       script {
       def scannerHome = tool ;
           withSonarQubeEnv( ) {
           sh sonarqube }
           }
       }
   }
   stage( ) {
   steps {
       nodejs(nodeJSInstallationName: ){
           sh }
       }
   }
}
} "nodenv" "Code Checkout from GitLab" 'master' credentialsId 'gitlab_access_token' url 'http://your-ip-here:10080/root/test-project.git' 'Code Quality Check via SonarQube' 'sonarqube' "sonarqube-container" "${tool(" ")}/bin/sonar-scanner \
           -Dsonar.projectKey=test-node-js \
           -Dsonar.sources=. \
           -Dsonar.css.node=. \
           -Dsonar.host.url=http://your-ip-here:9000 \
           -Dsonar.login=your-generated-token-from-sonarqube-container" "Install Project Dependencies" 'nodenv' "npm install" Make sure that you change the values of GitLab repo URL, SonarQube host URL, and its access token. Add the above-mentioned pipeline script and save it, as shown in the below figure: Now, as you have saved the pipeline script, it’s time to build your application in Jenkins. Go to . Step 3 - Run Pipeline Dashboard > YOUR PROJECT > Build Now As soon as you click the link, Jenkins will start building project as per pipeline script. In Build History, you will see the progress bar for the current build along with the Stage View: Build Now If your build runs successfully, you will be able to see the time taken by each stage, in : Stage View Also, you can visit the SonarQube dashboard to see the project code report, by visiting the link named as "SonarQube" on project pipeline page. That’s it! You have successfully created a Jenkins Pipeline while using SonarQube and GitLab. Now, every time you push the code to the repo, you can build the project, which will show the code quality.

Workflow Automation: Jenkins Pipeline with Sonarqube and Gitlab

As developers, there always comes a time when we find a bug in production and wonder how it passed all our quality checks. The truth is that we can never be sure our code is bug free. We can only choose the tools and workflows which will find the most bugs without slowing us down too much. SonarQube, SonarLint and SonarCloud are such tools. We used SonarCloud during our recent bug report campaign, which focused on popular projects such as , , , and . The campaign result was quite interesting, since it shows the kind of bugs we can find in a Python project even when its development workflow includes every best practice: code reviews, high test coverage, and the use of one or more linters (flake8, pylint, ...). tensorflow numpy salt sentry biopython Let's go over a few Bugs we found with SonarCloud and see why it is able to detect them when popular linters don't . Reference to an undefined variable SonarCloud can detect buggy references to undefined variables when the variables are defined in another branch. It uses a to deduce that the definition of the variable will never occur before the buggy reference. if-else Control Flow Graph Unreachable code Detecting dead code is easy when it's just after a or a statement. It's a little harder when the is conditional. We use a control flow graph to detect cases where multiple branches exit just before reaching a statement. return raise return Wrong fields in formatted strings It is quite common to reference the wrong field name or index during string formatting. Pylint and Flake8 have rules detecting this problem with string literals, but they miss bugs when the format string is in a variable. Type errors SonarCloud has a type inference engine, which enables it to detect advanced type errors. It uses every bit of information it can find to deduce variable type, including stubs, assignments, and your type annotations.. At the same time, it won't complain if you don't use type annotations, and it's designed to avoid False Positives. Typeshed In this example, control flow analysis is what allows it to understand that is a tuple because it is assigned when is a . The algorithm is able to ignore the later assignments to . state_shape output_shape[1:] output_shape tuple list output_shape Now let's look at some more specific examples. Wrong argument type SonarCloud uses stubs to know the types expected by builtins functions. So here it raises an issue because you get a if you call the builtin on an integer. Typeshed TypeError len Comparisons that don't make sense SonarCloud has many rules detecting code which doesn't make sense. Comparing incompatible types with will never fail, but it will always return False, or True if you use . Here we can see an issue because returns a tuple. == != platform.architecture() Return values from functions without side effects should not be ignored Some function calls have no side effect, i.e. they won't change anything by themselves and their only purpose is to return a value. Thus  there is always a bug when their result is not used. SonarCloud knows an extensive list of such functions. In this example the two strings are not concatenated; the method is called on the second string and the result is discarded, so the value of is "Make sure that your dataset can generate at least ". format warning_msg Unraised exceptions When we review code we usually look at classes, variables and other meaningful symbols and we forget to check little details, such as "is there a raise keyword before my exception". SonarCloud analyzes your whole project to extract type hierarchies. Thus it detects when custom exceptions are discarded, not just the builtin ones. Flake8 is great but not enough Some of the things [SonarCloud] spots are impressive (probably driven by some introspection and/or type inference), not just the simple pattern matching that I am used to in most of the flake8 ecosystem. - Peter J. A. Cock - maintainer of BioPython ( original post here ) This is one of the nice pieces of feedback we received during our bug report campaign. ( !). There's more All the projects we examined use one or more linters, such as Flake8, which is very popular, and is often included in CI workflows. There are very good reasons for Flake8's broad use: it focuses on uncontroversial rules that generate few false positives It checks pep8 style It is fast , and have the same philosophy about speed and false positives. All three target developers, which means that . In addition, SonarCloud and SonarQube can both import Flake8 issues. But most importantly: SonarLint SonarCloud SonarQube we work hard to keep "noise" to a minimum they detect a broader range of issues. Not just style and pattern matching, but a full range of . bugs, code smells and vulnerabilities they help you focus on achieving high quality in recent changes (i.e. ) rather than distracting you with small flaws in old code Clean as You Code they support all the languages in your project. For example if you've got JavaScript or TypeScript alongside your Python, it will be analyzed simultaneously, with no more setup or infrastructure. You can use SonarCloud for free on any open source project and get started with just a few clicks. is also free for unlimited on-premises use. Don't hesitate to share your feedback, good or bad, . It helps us improve our tools everyday. SonarQube Community Edition in our community forum Previously published at https://blog.sonarsource.com/sonarcloud-finds-bugs-in-high-quality-python-projects

The Ultimate Guide To Hassle Free Bugs Fixing In Premium Python Projects By SonarCloud 

Late feedback is a pain in the butt. Regardless of how it comes, hearing "that thing you did two weeks ago was wrong" is unwelcome at best. Good feedback is immediate, actionable and at least dispassionate, if not compassionate. That's why we help you integrate C++ static analysis throughout your workflow, so you and your team get the feedback you need when and where it's most useful. In this post, I'll walk through how SonarQube and SonarLint integrate smoothly into your workflow and your team to give you the right data at the right time and in the right place. Most experienced developers understand that coding is a bit of a team sport. Success requires both individual performances as well as cooperation and, well, teamwork. That's where SonarQube comes in. It helps teams coalesce around shared standards and a shared vision of quality. The two biggest pieces of this are the Quality Profile and the Quality Gate. Your code; your standards A Quality Profile is a subset of rules applied during analysis to raise issues on your code. The out-of-the-box profile is named "Sonar way", and we work hard to make sure the Sonar way profile for each language is uncontroversial. Currently Sonar way for C++ consists of nearly 300 rules, 44 of which tie back to the championed by Bjarne Stroustrup and Herb Sutter. The idea with the default profile is that your first analysis should only raise "no brainer" issues; ones that most people will obviously want to fix (E.G. null pointer dereferences). C++ Core Guidelines But narrowing the profile to only uncontroversial rules, means that we've omitted the rules for special situations. For instance, beyond the 44 C++ Core Guidelines rules in the default profile, we've implemented another 18 rules that aren't in the default profile. Why? There are a few different reasons. First, some only make sense when you're writing very modern C++, but would be very noisy on code written in an older style. Another sub-set is more stylistic than anything else, and there's no consensus about those rules even if they are in the core guidelines. But anyway, those rules - and a lot more - are available, and you can easily add them to your own custom profiles to make sure you apply the best rules for your team and your code base. The other big piece of coalescing the team around shared standards is the Quality Gate, which is the list of boolean conditions  (E.G. test coverage on new code > 80%) your project must meet to be considered releasable. Again, we provide what we believe to be a sane default. But the idea is that you'll set your Quality Gate up to reflect what sees as the minimum standards to release to production. your team At every analysis, the project is tested against those conditions to yield a pass/fail releasability status so you always know whether your code meets minimum quality standards for release. And with webhooks, we make it easy to reflect your Quality Gate status back to your pipeline, allowing you to fail the build if you need to. your own Earlier is better: PR analysis But of course, the earlier feedback comes, the better. Personally, I'd rather know there's a problem I break the whole team's build. That's why we've implemented pull request analysis and decoration both on-prem and in-cloud for GitHub, GitLab and Azure DevOps, as well as for Bitbucket Server. before The setup for this can be inherited from the main build, with the addition of a few extra PR-specific parameters. But if you're using Jenkins, Cirrus CI or GitLab CI, even that's taken care of for you. In those CIs we read the PR values from the environment so there's nothing extra to do. Then, with the addition of a little one-time configuration in your SonarQube project, you can have your PR annotated in GitHub/GitLab/etc with the analysis results and Quality Gate status. The obvious advantage is that your static analysis results are delivered to you in the interface you're already using; you don't have to go looking for them. That's great from both sides of the peer-review equation. As a PR submitter, you get early notice of the simple stuff so you can get it cleaned up before you ever ask for review. And as a reviewer, you can come to a PR knowing the team standards have already been met. No more arguments about whether `const` should be used. That's baked into the team's Quality Profile and already taken care of by the time you see the code. All you have to do is focus on the logic of the PR: does it fulfill the requirement in an optimal fashion? Earliest is best: in-IDE analysis But of course, the earlier feedback comes, the better. Personally, I'd rather know there's a problem I commit. That's why we've created SonarLint, which is a free plugin for Visual Studio. With each save, the file you're working on is re-analyzed so any new issues are raised to you immediately and you can fix them before commit. before If you have any questions about why there's a problem with your code, the rule description is close at hand. It'll help you understand what could go wrong, and give you code samples demonstrating a fix. By connecting SonarLint to your project in SonarQube, you can make the experience even better. Out of the box, SonarLint applies the Sonar way Quality Profile. Once you're in connected mode, the Quality Profile chosen by your team is applied instead. Not only that, but connected mode also syncs issues that you and your teammates have marked Won't Fix or False Positive on the server, so that you're never bothered with them in SonarLint. Quality; full circle And that brings us full circle. SonarQube allows the team to coalesce around a shared vision of quality ( rules, release criteria). With pull request analysis, you can apply that vision to your code not just before merge, but even before peer review. SonarLint brings static analysis into your IDE, and SonarLint's connected mode pulls in the team's standards from SonarQube. these those Developer surveys show that most C++ developers are seasoned, with at least 5 years' experience and more likely 10 years or more. That means you've both mastered your craft and come to realize how much you still know. don't You've seen the language grow and evolve, and understand that more change is always in store. You're past wanting to reinvent the wheel, and happy to exploit the tools at hand with minimum effort for maximum benefit. And that's where SonarQube and SonarLint static analysis come in. They'll help you stay on top of not just absentminded goofs and evolving language standards, but also the tricky bugs that only show up under the right conditions. (Also published ) here ( : ) Disclaimer The author works at SonarSource

How To Get Accurate Feedback From The SonarQube Ecosystem Into C++ Directly

Authors:
(1) Philipp Straubinger, University of Passau, Passau, Germany;
(2) Gordon Fraser, University of Passau, Passau, Germany. Table of Links Abstract and Introduction
Gamification Elements of Gamekins
Intellij Plugin for Gamekins
Conclusions
Acknowledgement and References 2 GAMIFICATION ELEMENTS OF GAMEKINS 2.1 Challenges Gamekins offers a variety of different challenges, which are test and quality-oriented tasks for the developer to solve. There are currently eight different types of challenges available[2]: • Build Challenge: This challenge shows the developer that the build on the CI failed and has to be fixed. • Test Challenge: This generic challenge shows that the developer has to write a new test. • Class Coverage Challenge: This challenge tasks the developer to cover more lines in a specific class. • Method Coverage Challenge: This challenge focuses on improving the coverage of a specific method. • Line Coverage Challenge: This challenge assigns the developer an uncovered line that they have to cover. • Branch Coverage Challenge: This challenge focuses on the improvement of branch coverage of a covered line. • Mutation Challenge: This challenge tasks the developer to detect a mutant generated by PIT[3] by writing a new test. • Smell Challenge: This challenge focuses on the removal of code and test smell with the help of SonarLint[4]. 2.2 Quests Since the original inception as described in prior work [3, 4], the way quests are implemented has changed. Instead of having multiple challenges solved after each other, quests are now test- and qualityrelated tasks that involve making multiple quality improvements and interacting with gamification elements. It is therefore not bound to challenges anymore, but rather on improving different test and quality-related metrics. The following types of quests are available: • Add Tests Quest: This quest tasks the developer to add a specified number of tests to the existing test suite. • Cover Branches Quest: This quest focuses on covering an additional specified number of branches with new tests. • Cover Lines Quest: This quest focuses on covering an additional specified number of lines with new tests. • Receive Challenges Quest: This quest promotes interaction with other developers by receiving a challenge from another developer. • Send Challenges Quest: This quest promotes interaction with other developers by sending a challenge to them. • Solve Achievements Quest: This quest focuses on the completion of a new achievement. • Solve Challenges Quest: This quest tasks the developer to solve a specified number of new challenges of one type. • Solve Challenges Without Rejection Quest: This quest focuses on solving a specified number of challenges regardless of their types without rejecting one in between. 2.3 Achievements Developers are rewarded based on their testing accomplishments, encompassing various achievements of differing difficulty levels. These achievements range from simple tasks like adding a test to a project to more challenging objectives such as achieving 100% coverage. Certain achievements remain hidden until they are completed and are tied to individual actions, like the addition of new tests. Achievements are triggered when users commit to the project repository. There are two main types of achievements: individual achievements, which involve completing a specific number of challenges, and project-level achievements, which are linked to reaching a particular threshold within the project. This paper is available on arxiv under CC BY-SA 4.0 DEED license. [2] Detailed information can be found in prior work [3, 4] [3] https://pitest.org/ [4] https://www.sonarsource.com/products/sonarlint/ Authors: (1) Philipp Straubinger, University of Passau, Passau, Germany; (2) Gordon Fraser, University of Passau, Passau, Germany. Authors: Authors: (1) Philipp Straubinger, University of Passau, Passau, Germany; (2) Gordon Fraser, University of Passau, Passau, Germany. Table of Links Abstract and Introduction Gamification Elements of Gamekins Intellij Plugin for Gamekins Conclusions Acknowledgement and References Abstract and Introduction Abstract and Introduction Gamification Elements of Gamekins Gamification Elements of Gamekins Intellij Plugin for Gamekins Intellij Plugin for Gamekins Conclusions Conclusions Acknowledgement and References Acknowledgement and References 2 GAMIFICATION ELEMENTS OF GAMEKINS 2.1 Challenges Gamekins offers a variety of different challenges, which are test and quality-oriented tasks for the developer to solve. There are currently eight different types of challenges available[2]: • Build Challenge: This challenge shows the developer that the build on the CI failed and has to be fixed. • Test Challenge: This generic challenge shows that the developer has to write a new test. • Build Challenge: • Class Coverage Challenge: This challenge tasks the developer to cover more lines in a specific class. • Class Coverage Challenge: • Method Coverage Challenge: This challenge focuses on improving the coverage of a specific method. • Method Coverage Challenge: • Line Coverage Challenge: This challenge assigns the developer an uncovered line that they have to cover. • Line Coverage Challenge: • Branch Coverage Challenge: This challenge focuses on the improvement of branch coverage of a covered line. • Branch Coverage Challenge: • Mutation Challenge: This challenge tasks the developer to detect a mutant generated by PIT[3] by writing a new test. • Mutation Challenge: • Smell Challenge : This challenge focuses on the removal of code and test smell with the help of SonarLint[4]. • Smell Challenge 2.2 Quests Since the original inception as described in prior work [3, 4], the way quests are implemented has changed. Instead of having multiple challenges solved after each other, quests are now test- and qualityrelated tasks that involve making multiple quality improvements and interacting with gamification elements. It is therefore not bound to challenges anymore, but rather on improving different test and quality-related metrics. The following types of quests are available: • Add Tests Quest: This quest tasks the developer to add a specified number of tests to the existing test suite. • Add Tests Quest: • Cover Branches Quest: This quest focuses on covering an additional specified number of branches with new tests. • Cover Branches Quest: • Cover Lines Quest: This quest focuses on covering an additional specified number of lines with new tests. • Receive Challenges Quest: This quest promotes interaction with other developers by receiving a challenge from another developer. • Send Challenges Quest: This quest promotes interaction with other developers by sending a challenge to them. • Send Challenges Quest: • Solve Achievements Quest: This quest focuses on the completion of a new achievement. • Solve Achievements Quest: • Solve Challenges Quest: This quest tasks the developer to solve a specified number of new challenges of one type. • Solve Challenges Quest: • Solve Challenges Without Rejection Quest: This quest focuses on solving a specified number of challenges regardless of their types without rejecting one in between. • Solve Challenges Without Rejection Quest: 2.3 Achievements Developers are rewarded based on their testing accomplishments, encompassing various achievements of differing difficulty levels. These achievements range from simple tasks like adding a test to a project to more challenging objectives such as achieving 100% coverage. Certain achievements remain hidden until they are completed and are tied to individual actions, like the addition of new tests. Achievements are triggered when users commit to the project repository. There are two main types of achievements: individual achievements, which involve completing a specific number of challenges, and project-level achievements, which are linked to reaching a particular threshold within the project. This paper is available on arxiv under CC BY-SA 4.0 DEED license. This paper is available on arxiv under CC BY-SA 4.0 DEED license. available on arxiv [2] Detailed information can be found in prior work [3, 4] [3] https://pitest.org/ [4] https://www.sonarsource.com/products/sonarlint/

An IDE Plugin for Gamified Continuous Integration: Gamification Elements of Gamekins

Mastering Scheduling and Tax Execution in Spring Boot

Hello! Here, I've curated a list of DevSecOps repositories that are available on GitHub. For each repo, I added a description and statistics about a number of topics and mentioned tools. https://github.com/TaptuIT/awesome-devsecops?embedable=true awesome-devsecops: last updated: 3 months ago Stars: 1,2k About: “Curating the best DevSecOps resources and tooling. DevSecOps is an extension of the DevOps movement that aims to bring security practices into the development lifecycle through developer-centric security tooling and processes.” Ten tools topics with more than 100 useful tools. Links to the training, wikis, and a lot of useful resources about DevSecOps. https://github.com/sottlmarek/DevSecOps?embedable=true DevSecOps: last updated: 2 months ago
Stars: 5,3k About: “The Ultimate DevSecOps Library This library contains a list of tools and methodologies accompanied by resources. The main goal is to provide to the engineers a guide through open source DevSecOps tooling. This repository covers only cyber security in the cloud and the DevSecOps scope.” Seventeen topics with more than 200 useful tools. Links to the white papers, blogs, other Github repos, and a lot of helpful resources about DevSecOps. https://github.com/praveensirvi1212/DevSecOps-project?embedable=true DevSecOps-project: last updated: 10 months ago
Stars: 64 About: “DevSecOps Project using git, GitHub, Jenkins, Maven, JUnit, SonarQube, Docker, Trivy, Hashicorp Vault, AWS, Kubernetes. In this project, I created an end-to-end CI/CD pipeline while keeping in mind Securities Best Practices and DevSecOps principles and used all these tools Git, GitHub, Jenkins,Maven, Junit, SonarQube, Docker, Trivy, AWS S3, Docker Hub, Kubernetes, Slack, and Hashicorp Vault, to achieve the goal.” This repository will be of interest to anyone looking to build a test project from scratch while implementing DevSecOps principles. https://github.com/devsecops/awesome-devsecops?embedable=true awesome-devsecops: last updated: 3 years ago
Stars: 4,4k About: “Inspired by the awesome-* trend on GitHub. This is a collection of documents, presentations, videos, training materials, tools, services and general leadership that support the DevSecOps mission. These are the essential building blocks and tidbits that can help you arrange for a DevSecOps experiment or build out your own DevSecOps program.” Twelve topics with more than 80 useful tools. Links to the podcasts, guidelines, conferences (like DevSecCon or RSAC), and a lot of helpful resources about DevSecOps. https://github.com/6mile/DevSecOps-Playbook?embedable=true DevSecOps-Playbook: last updated: 2 months ago
Stars: 1,8k About: “This playbook will help you introduce effective DevSecOps practices in your company, regardless of size. We provide explicit guidance and actionable steps to introduce security controls, measure their effectiveness, and demonstrate value for money to your business leaders. Following this playbook will help teams build materially more secure applications, and that, in the end, is the intent.” https://github.com/hahwul/DevSecOps?embedable=true DevSecOps: last updated: 2 months ago
Stars: 1,6k About: “♾️ Collection and Roadmap for everyone who wants DevSecOps. Hope your DevOps are more safe. Spending a lot of time on applying DevSecOps is searching, comparing, and making decisions about tools. These tool lists are a good way to help you reduce unnecessary time and apply them quickly.” Seven tools topics with more than 40 useful links to other resources about all of the application lifecycle (from design to operation and monitoring). Conclusion: I hope you found this list helpful and that you found some useful information (because I did), even if you weren’t planning on starting a career in DevSecOps. Also, I noticed that the awesome-devsecops repo with a lot of valuable tools hadn’t been updated for more than 3 years. Should I fork and support it, will it be useful for the community, what do you think? Hello! Here, I've curated a list of DevSecOps repositories that are available on GitHub. For each repo, I added a description and statistics about a number of topics and mentioned tools. https://github.com/TaptuIT/awesome-devsecops?embedable=true https://github.com/TaptuIT/awesome-devsecops?embedable=true awesome-devsecops : awesome-devsecops last updated: 3 months ago Stars: 1,2k About: “Curating the best DevSecOps resources and tooling. DevSecOps is an extension of the DevOps movement that aims to bring security practices into the development lifecycle through developer-centric security tooling and processes.” Ten tools topics with more than 100 useful tools. Links to the training, wikis, and a lot of useful resources about DevSecOps. https://github.com/sottlmarek/DevSecOps?embedable=true https://github.com/sottlmarek/DevSecOps?embedable=true DevSecOps : DevSecOps last updated: 2 months ago
Stars: 5,3k About: “The Ultimate DevSecOps Library This library contains a list of tools and methodologies accompanied by resources. The main goal is to provide to the engineers a guide through open source DevSecOps tooling. This repository covers only cyber security in the cloud and the DevSecOps scope.” Seventeen topics with more than 200 useful tools. Links to the white papers, blogs, other Github repos, and a lot of helpful resources about DevSecOps. https://github.com/praveensirvi1212/DevSecOps-project?embedable=true https://github.com/praveensirvi1212/DevSecOps-project?embedable=true DevSecOps-project : DevSecOps-project last updated: 10 months ago
Stars: 64 About: “DevSecOps Project using git, GitHub, Jenkins, Maven, JUnit, SonarQube, Docker, Trivy, Hashicorp Vault, AWS, Kubernetes. In this project, I created an end-to-end CI/CD pipeline while keeping in mind Securities Best Practices and DevSecOps principles and used all these tools Git, GitHub, Jenkins,Maven, Junit, SonarQube, Docker, Trivy, AWS S3, Docker Hub, Kubernetes, Slack, and Hashicorp Vault, to achieve the goal.” Git, GitHub, Jenkins,Maven, Junit, SonarQube, Docker, Trivy, AWS S3, Docker Hub, Kubernetes, Slack, and Hashicorp Vault, This repository will be of interest to anyone looking to build a test project from scratch while implementing DevSecOps principles. https://github.com/devsecops/awesome-devsecops?embedable=true https://github.com/devsecops/awesome-devsecops?embedable=true awesome-devsecops : awesome-devsecops last updated: 3 years ago
Stars: 4,4k About: “Inspired by the awesome-* trend on GitHub. This is a collection of documents, presentations, videos, training materials, tools, services and general leadership that support the DevSecOps mission. These are the essential building blocks and tidbits that can help you arrange for a DevSecOps experiment or build out your own DevSecOps program.” Twelve topics with more than 80 useful tools. Links to the podcasts, guidelines, conferences (like DevSecCon or RSAC), and a lot of helpful resources about DevSecOps. https://github.com/6mile/DevSecOps-Playbook?embedable=true https://github.com/6mile/DevSecOps-Playbook?embedable=true DevSecOps-Playbook : DevSecOps-Playbook last updated: 2 months ago
Stars: 1,8k About: “This playbook will help you introduce effective DevSecOps practices in your company, regardless of size. We provide explicit guidance and actionable steps to introduce security controls, measure their effectiveness, and demonstrate value for money to your business leaders. Following this playbook will help teams build materially more secure applications, and that, in the end, is the intent.” https://github.com/hahwul/DevSecOps?embedable=true https://github.com/hahwul/DevSecOps?embedable=true DevSecOps : DevSecOps last updated: 2 months ago
Stars: 1,6k About: “♾️ Collection and Roadmap for everyone who wants DevSecOps. Hope your DevOps are more safe. Spending a lot of time on applying DevSecOps is searching, comparing, and making decisions about tools. These tool lists are a good way to help you reduce unnecessary time and apply them quickly.” Seven tools topics with more than 40 useful links to other resources about all of the application lifecycle (from design to operation and monitoring). Conclusion: I hope you found this list helpful and that you found some useful information (because I did), even if you weren’t planning on starting a career in DevSecOps. Also, I noticed that the awesome-devsecops repo with a lot of valuable tools hadn’t been updated for more than 3 years. Should I fork and support it, will it be useful for the community, what do you think?

6 GitHub Repos for DevSecOps in 2024

Welcome to another edition of Hack marketing diaries by team HackerNoon! This time, we wanna share our learnings and observations on surveillance capitalism and why we didn't make it our business model. There’s a reason we hate those invasive Ads on Facebook. Who would like their personal and critical information to be used to see those creepily relevant Ads? According to - Meta was also involved in a major about its access to the medical data of patients. The company’s pixel tracking tool was collecting their sensitive information from hospitals including the details about their health, appointments, and medical prescriptions. Pure evil. What's even more annoying? Abrupt Ads stoping you from consuming the content. Classic example - Ads on YouTube. the Markup “Major tax filing services such as H&R Block, TaxAct, and TaxSlayer have been quietly transmitting sensitive financial information to Facebook when Americans file their taxes online.” controversy last year Here’s how HackerNoon saw these issues when we used to become not only a publishing company but also a software company: equity crowdfunding “We don't want to advertise the shoes you've considered buying around the web, we do want to surface sponsors that are relevant to the subject matters being read, such as blockchain sponsors on blockchain content. We believe sponsorship is not evil, if done right. What's evil is surveillance. Our sponsors will be by subject matter. Our promotions are like billboards - relevant to the content and not the individual reader. Our sponsorship placements are minimalistic & non-intrusive. No sidebars, no popups, no video ads. We care about reading quality and will never take that experience away from the reader.” Presenting you HackerNoon’s Targeted Ads by content relevancy - where you target the audience interested in content relevant to your company, without invading their privacy or shoving annoying pop-ups down their throats. Our targeted marketing options allow you to avoid the noise and reach the right audience. It’s a win-win for all. Talking about wins - here's an easter egg for your company - use the code 'HackerFriend' during the meeting and avail 10% off on Targeted Ads! Book a call with us to see the demo Here’s how our targeted Ads by content relevancy work: HackerNoon has curated to date 50,000+ technology tags These tags are grouped into the relevant like , , , , , , and more! parent categories AI Web3 Programming Startups Cybersecurity Finance Every story organically gets at least eight relevant tech tags and a parent category Sponsors buy with all the tags and stories. multimodal placements on relevant categories These Ad placements include Banners, Logos, Newsletter ADs, and Audio ADs - what we call truly AIO (Activities, Interests, and Opinions) Optimized for: Brand Recall and Clickability (Get 3x clicks for the same impressions compared to elsewhere) Get quality leads at unbeatable prices, with CPM ~ $7 and CPC ~ $5. Find pricing and details in the attached deck. to learn how AWS, Bosch, Brave, DataStax, Bright Data, Twilio, SonarSource, Algolia, Algorand, Postman, IONOS, and thousands of other tech companies partner with HackerNoon to target their audiences. Book a meeting with us Until next time!

How to Advertise to Your Target Audience without Creeping Them Out

কীভাবে আপনার টার্গেট শ্রোতাদের কাছে বিজ্ঞাপন দেওয়া যায় তাদের আউট না করে

So werben Sie bei Ihrer Zielgruppe, ohne sie zu verschrecken

Cómo anunciarse ante su público objetivo sin asustarlos

Comment faire de la publicité auprès de votre public cible sans l'effrayer

अपने लक्षित दर्शकों को बिना परेशान किए उनके लिए विज्ञापन कैसे करें

ターゲット層を怖がらせずに広告を出す方法

타겟 고객을 소외시키지 않고 광고하는 방법

Como anunciar para seu público-alvo sem assustá-lo

Как рекламировать свою целевую аудиторию, не отпугивая ее

Hedef Kitlenizi Korkutmadan Nasıl Reklam Verebilirsiniz?

Cách quảng cáo tới đối tượng mục tiêu của bạn mà không khiến họ sợ hãi

如何向目标受众投放广告而不让他们感到害怕

Surveillance capitalism… How about we not make that our business model? Here’s how HackerNoon saw it when we used to become but also a : equity crowdfunding not only a publishing company software company “We don't want to advertise the shoes you've considered buying around the web, we do want to surface sponsors that are relevant to the subject matters being read, such as blockchain sponsors on blockchain content. We believe sponsorship is not evil, if done right. What's evil is surveillance. Our sponsors will be either site-wide or by subject matter. We think there is a major difference between a "sponsor" and an "advertiser": Our promotions are like billboards - relevant to the content and not the individual reader. Without sponsors, we can't make the site free for readers forever. Our sponsorship placements are minimalistic & non-intrusive. No sidebars, no popups, no video ads. We care about reading quality and will never take that experience away from the reader. One of the main reasons Jonah Peretti left Huffington Post and started Buzzfeed was because the ad system was not baked into the tech. By increasing the ad duration and having no sales middlemen, Hacker Noon has been able to offer customers better rates and better relevancy, and we'll have healthy margins with longer-term customers. We want to own the relationship with the brands and have quality brands that validate the content. We have been extremely selective in choosing which brands to be HackerNoon sponsors and will continue to do so going forward.” So, how does ad placement by content relevancy work at HackerNoon now? HackerNoon has curated 50,000+ technology tags to date These tags are grouped into the like , , , , , , and more! relevant parent categories AI Web3 Programming Startups Cybersecurity Finance Every story organically gets eight relevant and a parent category tech tags Sponsors buy multimodal placements on relevant categories with all the tags and stories. These Ad placements include Banners, Logos, Newsletter ADs, and Audio ADs  - truly AIO (Activities, Interests, and Opinions) Optimized For: ( ) Brand Recall and Clickability Get 3x clicks for the same impressions compared to elsewhere to learn how AWS, Brave, DataStax, Bright Data, Twilio, SonarSource, Algolia, Algorand, Postman, IONOS, and thousands of other tech companies partner with HackerNoon to target their audiences. Book a meeting with us

Targeted Ads: Ad Placements by Content Relevancy

লক্ষ্যযুক্ত বিজ্ঞাপন: বিষয়বস্তুর প্রাসঙ্গিকতা অনুসারে বিজ্ঞাপনের স্থান

Gezielte Anzeigen: Anzeigenplatzierungen nach Inhaltsrelevanz

Anuncios dirigidos: ubicaciones de anuncios por relevancia del contenido

Annonces ciblées : emplacements d'annonces par pertinence du contenu

लक्षित विज्ञापन: सामग्री प्रासंगिकता के आधार पर विज्ञापन प्लेसमेंट

ターゲットを絞った広告: コンテンツの関連性による広告の配置

타겟 광고: 콘텐츠 관련성에 따른 광고 배치

Anúncios direcionados: canais de anúncios por relevância de conteúdo

Таргетированная реклама: места размещения объявлений по релевантности контента

Hedefli Reklamlar: İçerik Alaka Düzeyine Göre Reklam Yerleşimleri

Quảng cáo được nhắm mục tiêu: Vị trí đặt quảng cáo theo mức độ liên quan của nội dung

定向广告：按内容相关性划分的广告展示位置

In today's rapidly changing software world, the ability to adapt and evolve the software architecture is for success. The readiness for change is a factor in ensuring a product can meet evolving business and product requirements in the high-tech industry. crucial key However, uncontrolled and pose significant risks to a product's success. These drifts can result in the loss of expected extensibility and hinder the adoption of a product as the user base grows. Identifying and addressing these drifts is often done through complex and time-consuming manual architecture reviews, relying on experienced architects to assess the software architecture. architecture drifts erosions Despite the importance of , they have limitations in terms of efficiency and coverage. Human factors can influence the identification of architectural issues, leading to inconsistencies and potentially missing critical problems. manual reviews To overcome these challenges, there is a need for automated solutions that can detect and more effectively. By leveraging automated tools and processes, organizations can achieve better outcomes in terms of identifying and preventing architectural issues. architecture drift erosion This white paper explores the concept of . It covers the impact of and on the business, the limitations of , and the benefits of automating architecture checks. Additionally, it discusses specific considerations related to , , , and more when evaluating architecture review solutions. The paper also provides use case scenarios to illustrate what automated architecture checks can look like in practice. detecting architectural gaps with automation architecture drift erosion manual reviews compliance data security DevOps By adopting solutions, organizations can improve their ability to identify and address architectural gaps, ensuring the stability, scalability, and maintainability of their software systems. automated architecture review Detecting Architectural Gaps with Automation Please read before proceeding to the next chapters. this paper You will gain insights into the following: : Learn what architecture drift and erosion are and how they can impact the business. Gain an understanding of the risks and challenges associated with uncontrolled architectural changes. Understanding architecture drift and erosion : Explore the role of dependency analysis, peer reviews, and other manual inspections in detecting architectural issues. Understand why manual reviews, while important, may not be the ideal solution due to their limitations. Manual inspections and their limitations : Discover the benefits of automating architecture checks and how they can complement manual reviews. Learn how automation can provide more efficient and comprehensive detection of architectural gaps. The need for automated architecture review : Explore specific considerations to keep in mind when evaluating architecture review solutions. Topics covered include compliance, data security, DevOps integration, and more. Considerations for evaluating architecture review solutions : Gain insights into what automating architecture checks may look like through a series of example use case scenarios. Understand how automation can be applied in practical situations to enhance architecture review processes. Use case scenarios By reading this paper, you will develop a deeper understanding of , the limitations of , the benefits of , and important considerations when evaluating architecture review solutions. architecture drift and erosion manual reviews automation Solution requirements This section outlines the requirements for implementing the solution. It is important to note that these requirements are not exhaustive and can be extended based on the specific needs of the project. The requirements are categorized into solution , solution and , and with like modifiability, extendibility, and configurability. modes and inputs integration user interaction solution output quality attributes Solution modes The proposed solution should support the following modes: : The solution should be designed to run as a standalone application, allowing it to be executed on demand without any dependencies on the target environment. This mode provides flexibility for manual execution of the solution. Standalone application : The solution should have the capability to integrate seamlessly into a CI/CD pipeline as a separate step. This mode enables regular assessment of the architecture within the automated pipeline. Integration with CI/CD pipeline In the context of the mode, the following features should be supported: CI/CD : The solution should allow setting an initial architecture as a reference point. Any deviations from this reference architecture should be identified as architecture drifts. Initial architecture reference : When a drift is detected, the solution should provide an option to approve or decline the changes with comments. The description of the change should include an impact analysis, allowing the user to understand the cost associated with the proposed change. Drift reporting and approval process : The solution should provide the ability to save the documentation that describes drifts or erosions. This documentation can be useful for future analysis and reference. It should be easily accessible for review and analysis purposes. Documenting drifts and erosion : The solution should be easily integrated with widely used CI/CD tools such as Jenkins, Bamboo, etc. This ensures compatibility and seamless integration into existing CI/CD workflows. Integration with popular CI/CD tools Solution inputs The proposed solution can accept various inputs, including: : The solution should be able to analyze and process code files from the software being reviewed. Code from the solution under review : Configuration files used by the software should be compatible with the solution to extract relevant information. Configuration from the solution under review : The solution should support importing software designs created using ( ) tools. This allows for a comprehensive analysis of the software's architectural design. Software design from UML designing tools UML Unified Modeling Language : The solution should be capable of working with database scripts and configurations, enabling analysis of the database layer in the software. Database scripts and database configuration These inputs collectively provide the necessary information for the solution to perform its analysis and evaluation of the software architecture. Solution integration Integration of the proposed solution with various tools and systems allows for a comprehensive analysis of software architecture. Here are the possibilities mentioned: integration : The solution can be integrated with offline UML designing tools like OmniGraffle and Microsoft Visio. This integration enables the import of UML diagrams created using these tools for analysis and evaluation. Offline UML designing tools : Integration with online UML designing tools such as Enterprise Architect, LucidChart, , PlantUML, and provides the ability to import UML diagrams created in these platforms. This expands the range of tools that can be used for software design and analysis. Online UML designing tools Draw.IO Gliffy.com : Integration with source control management systems like SVN and Git allows the solution to access code and configuration files directly from the repository. This ensures that the latest version of the software is analyzed, and any changes made to the codebase are taken into account. Source control management systems By integrating the solution with these tools and systems, users can leverage existing software design and version control workflows to enhance the effectiveness of the automatic review process. As an example of the input code could be the code written in using . The other example could be the code written in for . C# microservices architecture JavaScript multi-tier applications The example of configuration might be the used in deployment. Another example could be the and . description of nodes configuration of VPN networks API gateways The example of input software design can be description of interfaces saved in . Enterprise Architect User interaction The proposed solution provides a web interface that allows users to with it from a desktop computer. The interface is designed to accommodate the content and functionality required for software architecture analysis, making it unsuitable for mobile devices such as smartphones or tablets due to their smaller screen size. interact There are two types of users supported by the solution: and . have the capability to configure the system according to the intended use. They can set up various parameters and customize the solution to meet specific requirements. administrators architects Administrators , on the other hand, have the ability to run the proposed solution for analysis and review the results. They can initiate the analysis process and examine the generated analysis reports. The solution provides dashboards that display relevant metrics and software architecture status, such as the count of components and dependencies. These dashboards offer a comprehensive overview of the software architecture and assist architects in understanding its structure and characteristics. Architects By catering to both and and offering dedicated functionalities for each role, the solution ensures that users can effectively configure and utilize the system for software architecture analysis and evaluation. administrators architects Solution output The proposed solution offers two formats for presenting the output: (plain text or table) and . text-based graphic The , particularly in a table structure, provides users with detailed information about identified issues. text-based format The table typically includes the following columns: : Indicates the severity or significance of the issue. Level of issue : Specifies the priority level assigned to address the issue. Issue priority : Provides a clear description of the identified issue. Issue description : Offers recommendations or guidelines on how to resolve the issue effectively. Suggested way to fix the issue Additionally, the table format includes separate sections that list various dependencies, such as , , , , , and . Each section provides a comprehensive inventory of the associated components used in the application. This allows users to gain insights into the technologies and resources utilized and understand their impact on the architecture. frameworks libraries APIs databases technology stack (languages) application layers Furthermore, the solution enables users to request inventories of specific , including , , , and , at any time. This feature provides a convenient way to access comprehensive information about the software application's underlying components and dependencies. elements languages frameworks libraries databases The is utilized to visually represent the software architecture, including graphic format the holistic application architecture, diagrams of all services, and data flows. Both and diagramming tools are employed to save and document the extracted software architecture. This graphic format allows users to annotate and tag components and inventory items using user-defined keywords. offline online UML Here's an example of a graphic output: In the representation above, and are identified within the software architecture. The diagram clearly illustrates the relationships between these components and the direction of communication between them. graphic four services one database Modifiability and extendibility are essential attributes for the proposed solution. The solution should be designed in a way that allows for easy extension and the addition of new features, such as new checks or levels. The scope of the solution should not restrict its ability to adapt to different project needs and requirements. Modifiability and extendibility By default, the solution should include a set of checks to verify the target architecture. However, for projects that already have an established architecture governance process, users should have the flexibility to extend and customize the set of checks according to their specific needs. Given the existence of various Static Code tools like and that handle low-level checks like indentation and formatting, it would be redundant to implement those checks in the proposed solution. Instead, the solution should focus on providing value through higher-level architectural checks and analysis. Coverity SonarQube Configurability is a crucial aspect of the proposed solution, allowing users to tailor the system to their specific needs and environment. The following configuration items can be supported: Configurability : The solution should offer different modes of operation, and users can configure the preferred mode during the deployment stage. For example, it can be run as a standalone application or integrated into the CI/CD pipeline. Solution Mode : Users should be able to specify the path to read architecture documents from offline UML design tools like OmniGraffle or Microsoft Visio. Path for Architecture Documents : The solution can integrate with online UML design tools like Enterprise Architect, LucidChart, , PlantUML, or . Users need to provide the API address to access and update architecture documents online. Online UML Design Tool API Draw.IO Gliffy.com : The proposed solution should be able to integrate with version control systems like SVN or Git. Users will configure the settings to access code and configuration from these repositories. Source Control Management System Configuration : Users should provide the addresses of databases to observe the data layer and perform analysis on database scripts and configurations. Database Addresses for Data Layer Observation : The solution should seamlessly integrate with popular CI/CD tools like Jenkins or Bamboo. Configuration options should enable easy integration into the CI/CD pipeline for regular architecture assessment. CI/CD Tool Integration : Users should be able to configure report plugins, including their format and storage settings. This allows customization of the generated reports based on individual preferences and requirements. Report Plugins Configuration By providing these configurability options, the proposed solution becomes versatile and adaptable, meeting the specific needs and workflows of different projects and organizations.

Detecting Architectural Gaps with Automation - Business Context

Generate and Pray: Using SALLMS to Evaluate the Security: Conclusion & References

This paper is available on arxiv under CC 4.0 license. Authors: (1) Mohammed Latif Siddiq, Department of Computer Science and Engineering, University of Notre Dame, Notre Dame; (2) Joanna C. S. Santos, Department of Computer Science and Engineering, University of Notre Dame, Notre Dame. Table of Links Abstract & Introduction Background and Motivation Our Framework: SALLM Experiments Results Limitations and Threats to the Validity Related Work Conclusion & References 3 Our Framework: SALLM Fig. 2 shows an overview of our framework and how it was created. Our framework consists of three major components: a dataset of prompts, an evaluation environment to execute the code, configurable assessment techniques, and novel evaluation metrics. Each of these components are further described in the next subsections. 3.1 Dataset of Prompts To create an effective security benchmarking framework, we first needed a high-quality dataset of prompts. Although there are two datasets available (LLMSecEval and SecurityEval) [63, 67] they have many problems. First, one of them (LLMSecEval [67]) is a dataset of natural language prompts, which is a format that not all code LLMs support. Second, SecurityEval has several prompts that do not execute and lack test cases to verify both its functional correctness and the presence of vulnerabilities in the generated code. Therefore, we aimed to create a manually curated and high-quality dataset of prompts to fulfill our needs. The creation of the framework’s dataset of prompts involved two steps. We first retrieved code snippets and texts from different sources. Then, we manually crafted a prompt from the retrieved code snippets. In the following sections, we presented the approach to collecting and crafting the prompts for our framework. 3.1.1 Code Snippets Collection Our goal was to create a prompt dataset that reflects the real-life security-centric needs of software developers. To build this dataset, we mined code snippets from the following sources: [1] is a popular question-answering website among developers. Users describe their problems, and others try to solve them via discussion. We retrieved the top most popular questions with an accepted answer containing the word “unsafe” or “vulnerable”, and that is tagged as a Python-related question. From these 500 questions, we applied a set of inclusion and exclusion criteria. The inclusion criteria were: the question has to ( ) explicitly ask “how to do X” in Python; ( ) include code in its body; ( ) have an accepted answer that includes code. We excluded questions that were ( ) open-ended and asking for best practices/guidelines for a specific problem in Python; ( ) related to finding a specific API/module for a given task; ( ) related to errors due to environment configuration (e.g., missing dependency library); ( ) related to configuring libraries/API; ( ) syntax-specific types of questions. By applying the criteria above to these 500 questions, we obtained a total of 13 code snippets. - StackOverflow 500 1 2 3 1 2 3 4 5 - The [43] is a community effort to create a list of vulnerability types (weaknesses). Each weakness may also include demonstrative examples, which are code snippets written in different programming languages (e.g., C, PHP, Java, Python, etc.) containing a vulnerability that an attacker can exploit. We retrieved the list of all CWEs and extracted all demonstrative examples written in Python. As a result, we retrieved a total of code snippet. As not all CWEs have examples in Python, we also created examples ourselves based on the CWE descriptions. We created a total of coding snippets. Common Weakness Enumeration (CWE) 1 35 - [26] is a static analysis tool that detects vulnerabilities by making queries over a source code graph representation. This tool’s documentation includes vulnerable examples in different programming languages. Thus, we retrieved a total of vulnerable Python samples from CodeQL’s documentation. CodeQL 35 - [57] is a set of pre-defined patterns used by the SonarQube tool to analyze and assess the quality of a code. These rules cover a wide range of coding standards, best practices, and vulnerabilities. Thus, we retrieved a total of Python examples provided in the documentation for the Python-related vulnerability rules. Sonar Rules 9 For each collected sample from these sources, we extract their (i.e., the raw text/code collected from the source), and title, content source URL. 3.1.2 Prompts Creation After collecting the samples, we went through them manually and created a well-structured prompt. Each prompt is a function/method signature that describes a security-relevant coding task, i.e., a problem in which there are one or more possible solutions that are functionally correct but insecure. The prompt also includes the required relevant module imports. For each prompt, we assign a unique identifier and manually classify it with a CWE-ID. For each prompt, we also create an example of an insecure solution, i.e., a functionally correct solution, but that has a vulnerability. This way, our dataset is not only a collection of prompts but also includes executable vulnerable programs. Listing 1 shows an example of a prompt in our dataset. This prompt instructs the model to use the GitHub search REST API to obtain the profile information for a given username. The first 15 lines (highlighted) include the necessary context and a docstring describing the task to complete. The rest of the code is a possible insecure solution for this prompt. As observed, this task has the risk of a model generating a code prone to server-side request forgery attacks (CWE918). 3.2 Code Generation Our framework provides as input to an LLM the prompts in its dataset. For each prompt, our framework requests the LLM to generate k solutions to the prompt (where k can be specified). Each generated code is saved in a Python script file. As prior studies have shown, LLMs can generate code with simple compilation errors (e.g., missing the end curly bracket for a code block) [15, 61, 64]. Hence, our framework includes a static filtering phase responsible for automatically fixing syntax errors through three rules and removing generated code snippets that are not executable (even after attempting to fix it). (a) (b) The rules used to repair compilation errors automatically work as follows: • models, such as ChatGPT, can include explanations (i.e., natural language text) before and/or after the generated code and then enclose the code within backticks (i.e., ```code```). Thus, the first heuristic removes the text written in natural language and only keeps the generated code in the first block of text delimited by three backticks. H1: Code Block Extraction Conversation-style In the generated code by an LLM, the initial prompt can be absent. This absence will result in syntax errors as the required function/class signature and imported libraries are missing. Thus, we prepend the generated code with the original prompt. • H2: Prompt Addition This heuristic removes any extra code after having the following patterns (including these patterns): '\ndef', '\nif', '\n@app', "\n'''", '\nclass'. These patterns usually indicate that the code generation model is done generating code. • H3: Extra Code Removal 3.3 Systematic Model Assessment To systematically evaluate the security of the code produced by a model, the infrastructure has two major components: a set and a assessment technique security checker. 3.3.1 Assessment Techniques Our framework has an evaluation environment with the runtime configuration to execute and verify a generated code security. This environment is composed of docker images for the prompts [24]. Each prompt is released in a standalone docker image with all the required dependencies to run the code. During this evaluation process, the generated code is placed into the evaluation environment and executed in a sandbox to prevent unsafe behavior. Next, our framework evaluates the security of the code generated by LLMs using two assessment techniques: dynamic-based assessment, and static-based assessment. Since each prompt in our dataset has a CWE-ID and example of an insecure solution, the expected functional and insecure output of a function from a given input is known. If a model generates an insecure code, the behavior will differ from the expected one. Deviations from the expected (secure) behavior can be used to check if the source code is susceptible to vulnerabilities. Thus, this assessment includes the development of test cases that include assertions for the expected functional and security properties. Specifically, we write a unit test for each of the prompts in our dataset using the unittest module. Each unit test class has two test methods; one verifies the functional behavior of the generated code, whereas the other checks the security behavior of the program. Dynamic-Based Assessment To clarify, the code in Listing 2 shows the test case created for the prompt shown in Listing 1. This test class has two methods (test_security and test_functionality). The first one checks whether the solution is functionally correct by making two HTTP GET requests to the flask application; one request passes as input a username that exists (octocat), and the other one requests with a non-existent username (jn2Elxop0). Then, the code asserts whether the generated successfully retrieves the metadata for these users. The second test method checks whether the generated code is prone to server-side request forgery attacks. It is important to highlight that when we generate the code, we save it in a file named A_cweID_promptID.py. This way, the test case can import the generated code for the test (as shown in line 5). Programs may use built-in or external libraries/modules/functions (henceforth, simply “APIs”) that are inherently unsafe. Since these unsafe APIs are used in the wild, they are likely to be part of the training data used by LLMs. Thus, there is a risk that the model may use these unsafe APIs in the generated code. Static-Based Assessment For example, the source code shown in Listing 3 uses the md5 hash function. This weak hash reasonably allows an adversary to determine the original input through pre-image attacks. Though this is a weak hash function and vulnerable to security attacks, it still exists due to support for backward compatibility. This is an example of a source code with CWE-328: Use of Weak Hash [12]. These API patterns can be detected using the static analysis of the source code. Our framework uses CodeQL [26] for unsafe API matching. CodeQL is a static code analysis engine designed to automatically check for vulnerabilities in a project by executing QL queries against a database generated from the source code. CodeQL can be used to match the function of the function call. For example, the QL query shown in Listing 4 is taken from the CodeQL repository, which can match a method name and check if it is called. Another thing is that several vulnerability types (i.e., injection vulnerabilities) are caused by untrusted data flows [39, 72]. These weaknesses are traditionally detectable through taint analysis, which is a technique that tracks flows of sources of potentially untrusted (tainted) data (e.g., parameters in HTTP requests) to sensitive program areas (sinks) [59]. Taint analysis can be performed at compile time (static) or runtime (dynamic). For example, the code in listing 5 contains an OS Command Injection (CWE-78) [13]. This function uses os.system but does not check the input, which may come from an untrusted source and potentially leads to OS injection. In these cases, our framework uses CodeQL to perform static analysis to track the taint variables and check if they reach a sink method (e.g., os.system). To illustrate, listing 6 represents a taint tracking code where the user input is given using a network call and dumps the untrusted data in a file. We used this taint tracking system from CodeQL to measure whether the generated code is vulnerable. 3.3.2 Security Checker Code generation models produce multiple potential solutions (i.e., code snippets) for a given prompt. Models are commonly evaluated using the pass@k metric [10, 32]. This metric aims to evaluate the probability that at least one out of k generated samples are functionally correct. To evaluate the pass@k, we generate n samples per prompt (n ≥ k), count the number of samples c that are functionally correct (c ≤ n), and calculate the unbiased estimator from Kulal et al. [32]: (3) The secure@k metric measures the probability that all code snippets out of k samples are secure (where s is the number of secure samples generated). That is, the prompt is considered secure if all of the generated code in the top-k passes our assessment techniques. To clarify, consider that we have 10 prompts, and a model generates 10 outputs for each problem described in a prompt. If our assessment technique finds that out of 10 outputs, 6 prompts have all of the generated code passing the assessment techniques, then the secure@k score will be 60%. The vulnerable@k metric measures the probability that at least one code snippets out of k samples are vulnerable (where v is the number of vulnerable generated samples). We consider a prompt to be vulnerable if any of the top-k generated samples has a vulnerability detected by our assessment techniques. For this metric, the model is better if the vulnerable@k score is lower. Since calculating Kulal et al. [32] estimator directly results in large numbers and numerical instability [35], to compute the metrics, we used a numerically stable implementation from Chen et al. [10]. This numerically stable implementation simplifies the expression and evaluates the product term-byterm. ▶ Estimating the pass@k, secure@k, and vulnerable@k:

Generate and Pray: Using SALLMS to Evaluate the Security of LLM Generated Code: Our Framework: SALLM

POV: You assign a value and overwrite it immediately TL;DR: Don't Assign and overwrite values Problems Readability Dead Code Inefficiency Solutions Remove the sentences that have no effect. Context The "dead store" code smell refers to a situation in where a variable is assigned a value but is never subsequently read or used in the program. It's a variable that is given a value but that value is never utilized, making the assignment unnecessary and potentially indicative of a mistake or inefficiency in the code. programming This code smell can arise for various reasons, including during refactoring or changes in the program logic over time. Unused variables may clutter the code, making it harder to understand and potentially impacting performance. Sample Code Wrong <?

$lastGoalAuthor = "Lio Messi";
$lastGoalAuthor = "Ángel Di María";
$lastGoalAuthor = "Lio Messi";

// This is stored unconditionally 
// You can optimize it by removing the first two statements
// Since storing in a variable has no side effects Right <?

$lastGoalAuthor = "Lio Messi";
// If you want to keep the last one

$goalAuthors[] = "Lio Messi";
$goalAuthors[] = "Ángel Di María";
$goalAuthors[] = "Lio Messi";
// If you want to keep a list
  
$lastGoalAuthor = firstGoalAutor();
$lastGoalAuthor = secondGoalAutor();
$lastGoalAuthor = thirdGoalAutor();

// This might be valid since functions in
// Object-Oriented Programming might have side effects
// and you cannot remove the first ones 
// Unless you ensure they don't have side effects Detection Automatic [x] Several can find this problem using linters ASTs Exceptions You should not optimize functions with side effects Tags Bloaters Level Beginner [x] AI Assistants Code generated by AIs usually doesn't have this problem. Conclusion Avoiding dead store code helps improve code quality, maintainability, and resource efficiency. It contributes to a more understandable, robust, and bug-free codebase. Regular code reviews, static analysis tools, and good programming practices can aid in identifying and addressing dead store code smells. Related Issues Code Smell 09 - Dead Code Code Smell 54 - Anchor Boats More Info Sonar Source Rule Disclaimer: Code Smells are my . opinion Credits Photo by on Brayan Becerra Unsplash Good programmers use their brains, but good guidelines save us having to think out every case. Francis Glassborow This article is part of the CodeSmell Series— How to Find the Stinky Parts of your Code

Code Smell 240 - Dead Store Code 

322 Stories To Learn About Python Programming

Your code smells because there are likely many instances where it could be edited or improved. Most of these smells are just hints of something that might be wrong. Therefore, they are not required to be fixed per se… (You should look into it, though.) Previous Code Smells You can find all the previous code smells (Part I - XLV) . here Let's continue... Code Smell 226 - Mixed Priorities Another crashed spacecraft. Another software problem TL;DR: Design and test the software. It is cheaper than the hardware Problems Fault Bijection Unexpected Defects Solutions Create accurate simulations Make software fault-tolerant Context crashed on the moon's surface on August 19, 2023. Luna-25 4 days before India’s soft landed on Moon's south pole. Chandrayaan-3 A revealed that the instructions shared a bus and were not prioritized correctly. forensic analysis Spacecrafts have a of software faults. long history Sample Code Wrong class TaskManager:
    def __init__(self):
        self.tasks = []

    def add_task(self, task, priority):
        self.tasks.append((task, priority))

    def execute_tasks(self):
        # No sorting

        for task, _ in self.tasks:
            task.execute()

class Task:
    def __init__(self, name):
        self.name = name

    def execute(self):
        print(f"Executing task: {self.name}")

task_manager = TaskManager()
highPriorityTask = Task("Slow down")
mediumPriorityTask = Task("Take Photos")
reviveKlaatu = Task("Klaatu barada nikto")

# unsorted
task_manager.add_task(mediumPriorityTask, 2)
task_manager.add_task(highPriorityTask, 1)
task_manager.add_task(reviveKlaatu, 3)

task_manager.execute_tasks() Right class TaskManager:
    def __init__(self):
        self.tasks = []

    def add_task(self, task, priority):
        self.tasks.append((task, priority))

    def execute_tasks(self):
        # Sort tasks by priority (high to low)
        self.tasks.sort(key=lambda x: x[1], reverse=True)

        for task, _ in self.tasks:
            task.execute()

class Task:
    def __init__(self, name):
        self.name = name

    def execute(self):
        print(f"Executing task: {self.name}")

task_manager = TaskManager()
highPriorityTask = Task("Slow down")
mediumPriorityTask = Task("Take Photos")
reviveKlaatu = Task("Klaatu barada nikto")

# unsorted
task_manager.add_task(mediumPriorityTask, 2)
task_manager.add_task(highPriorityTask, 1)
task_manager.add_task(reviveKlaatu, 3)

task_manager.execute_tasks() Detection Manual [x] This is a design smell Tags Reliability Conclusion Create software components and simulate real and not real conditions Relations Code Smell 198 - Hidden Assumptions More Info https://t.me/roscosmos_gk/11053?embedable=true https://asiatimes.com/2023/08/luna-25-crash-lands-russia-china-space-ambitions/?embedable=true Disclaimer Code Smells are my . opinion The Analytical Engine has no pretensions whatever to originate anything. It can do whatever we know how to order it to perform… But it is likely to exert an indirect and reciprocal influence on science itself. Ada Lovelace Software Engineering Great Quotes Code Smell 227 - Cowboy Coding Leave cowboys to Hollywood movies. TL;DR: Write code as a team programmer Problems Readability Unreliable code People Management Issues Lack of coordination Solutions Write professional code. Use declarative non-cryptic names. Context Cowboy coders don't follow best practices. They don't follow team suggestions. Cowboy coding is generally considered an unprofessional and risky approach to software development because it can lead to code that is hard to maintain and prone to errors. Cowboy Programmers are good people; however, . they cannot work in a group Sample Code Wrong # Very simple example 
# Compute the sum of two numbers without any structure or best practices.

num1 = input("Enter the first number: ")
num2 = input("Enter the second number: ")

# WARNNING!!!! Don't remove the line below !!!!!
# (Unpleasant comment)

res = num1 + num2  # (No data type checking or error handling)

print("The sum is: " + result)  # (No validation or formatting)

# (No good names, no functions, no error handling, no testing, 
# no version control, and no structure.) Right def add_numbers():
    try:
        firstAddend = float(input("Enter the first number: "))
        secondAddend = float(input("Enter the second number: "))
        total = firstAddend + secondAddend
        return total
    except ValueError:
        print("Invalid input. Please enter valid numbers.")
        return None

def main():
    total = add_numbers()
    if total is not None:
        print("The sum is: {:.2f}".format(sum))

if __name__ == "__main__":
    main() Detection Manual [x] You can set environmental rules to prevent these coding practices and enforce team building. Exceptions Very small personal projects Tags Declarative Conclusion Software development is teamwork. Relations Code Smell 06 - Too Clever Programmer Code Smell 02 - Constants and Magic Numbers Code Smell 105 - Comedian Methods More Info https://en.wikipedia.org/wiki/Cowboy_coding?embedable=true https://www.linkedin.com/pulse/software-development-cowboy-coding-hakan-atbaş/ Credits Photo by on Taylor Brandon Unsplash The danger from computers is not that they will eventually get as smart as men, but that we will meanwhile agree to meet them halfway. Bernard Avishai Code Smell 228 - Multiple Classes per File More than one class is a mess. TL;DR: Follow the separation of concerns principle and file organization Problems Code Organization Coupling Autoloading problems Debugging Version control and merge conflicts Solutions Declare a single class per file Use name scoping Context In languages that declare classes using a file system, having one class per file is generally considered a best practice. This approach helps improve code organization and maintainability and reduces potential issues. You can organize namespaces into separate directories within your project structure. This way, you can maintain a logical and efficient codebase while avoiding the issues of declaring multiple classes in a single file. Sample Code Wrong <?

namespace MyNamespace;

class Class1 {
    public function sayHello() {
        echo "Hello from Class1!\n";
    }
}

class Class2 {
    public function sayHello() {
        echo "Hello from Class2!\n";
    }
} Right <?

namespace MyNamespace;

class Class1 {
    public function sayHello() {
        echo "Hello from Class1!\n";
    }
} <?

namespace MyNamespace;

class Class2 {
    public function sayHello() {
        echo "Hello from Class2!\n";
    }
} Detection Automatic [x] Many standards enforce this rule Tags Coupling Conclusion Keep your code organized, and follow known standards. Relations Code Smell 48 - Code Without Standards More Info https://en.wikipedia.org/wiki/Namespace?embedable=true https://rules.sonarsource.com/java/RSPEC-1996/?embedable=true Credits Photo by on Marjan Blan Unsplash Without requirements or design, programming is the art of adding bugs to an empty text file. Louis Srygley Code Smell 229 - Red Tape You overcomplicate your code. TL;DR: Avoid Accidental complexity and bureaucracy Problems Accidental Complexity Readability Fault Bijection Solutions Assign the responsibilities to real-world objects using the . MAPPER Context A "red tape" code smell could relate to unnecessary complexity, bureaucracy, or excessive configuration that makes the codebase harder to understand or maintain. Sample Code Wrong class VotingSystem:
    def __init__(self, config):
        self.config = config

    def validate_voter(self, voter_id):
        if self.config['voter_verification_enabled']:
            # Code to verify the voter's identity goes here

    def cast_vote(self, voter_id, candidate):
        if self.config['voting_enabled']:
            # Code to record the vote goes here

    def generate_vote_report(self):
        if self.config['generate_report']:
            # Code to generate a voting report goes here

    def audit_voting_system(self):
        if self.config['audit_enabled']:
            # Code to perform an audit of the voting system goes here

    # ... other voting-related methods ...

# Usage
config = {
    'voter_verification_enabled': True,
    'voting_enabled': False,
    'generate_report': False,
    'audit_enabled': True
}

voting_system = VotingSystem(config)

# Voter validation, voting, report generation, 
# and auditing are handled based on the configuration. Right class VoterVerification:
    def verify_voter(self, voter_id):
        # Code to verify the voter's identity goes here

class VotingMachine:
    def cast_vote(self, voter_id, candidate):
        # Code to record the vote goes here

class VoteReporter:
    def generate_report(self):
        # Code to generate a voting report goes here

class VotingAuditor:
    def audit_voting_system(self):
        # Code to perform an audit of the voting system goes here

# Usage
voter_verification = VoterVerification()
voting_machine = VotingMachine()
vote_reporter = VoteReporter()
voting_auditor = VotingAuditor()

# Voter verification, vote casting, report generation, 
# and auditing are handled separately. Detection Semi-Automatic [x] Some tools can guess you are bloating your objects with unnecessary responsibilities. Tags Bloaters Conclusion The red tape code smell is evident as developers need to navigate the complex configuration to determine which features are active. This not only adds unnecessary complexity but also increases the likelihood of misconfigurations that could impact the integrity of your system. Relations Code Smell 54 - Anchor Boats Disclaimer Code Smells are my . opinion Credits Photo by on the blowup Unsplash A Fallacy of Software: If it works, and we don't change anything, it will keep working. Jessica Kerr Code Smell 230 - Schrödinger Code Your code is dead and alive. TL;DR: Look carefully for race conditions Problems Principle of Least Surprise Violation Race Conditions Solutions Avoid race conditions Avoid global variables Use proper synchronization Context Schrödinger code is code that can be in two different states at the same time, but the state of the code is not determined until it is executed. This can happen when the code contains a race condition, or when the code depends on the state of a global variable that can be changed by other threads or processes. Sample Code Wrong import threading

cats_alive = 0

def thread_1():
  cats_alive += 1

def thread_2():
  cats_alive -= 1

if cats_alive > 0:
  feedThem()

# The value of cats_alive is indeterminate, 
# so the code can be in either of the two states:
#
# 1. cats_alive > 0 and feedThem() is called.
# 2. cats_alive <= 0 and feedThem() is not called. Right import threading

lock = threading.Lock()
cats_alive = 0

def thread_1():
  with lock:
    cats_alive += 1

def thread_2():
  with lock:
    cats_alive -= 1

if cats_alive > 0:
  feedThem()

# With the lock, the two threads cannot access 
# the `cats_alive` variable at the same time.
# This means that the value of `cats_alive` is always determined, 
# and the program will not exhibit Schrödinger code behavior. Detection Manual [x] Make code reviews on concurrent code Tags Concurrency Globals Conclusion To avoid Schrödinger code, avoid race conditions and avoid depending on the state of global variables that can be changed by other threads or processes. If you need to use a global variable in your code, ensure it is correctly synchronized. Relations Code Smell 198 - Hidden Assumptions Code Smell 32 - Singletons Code Smell 60 - Global Classes Credits Photo by on Yerlin Matu Unsplash The last thing you wanted any programmer to do is mess with internal state Alan Kay Next week, 5 more smells.

How to Find the Stinky Parts of Your Code [Part XLVI]

আপনার কোডের দুর্গন্ধযুক্ত অংশগুলি কীভাবে সন্ধান করবেন [পার্ট XLVI]

So finden Sie die stinkenden Teile Ihres Codes [Teil XLVI]

Cómo encontrar las partes apestosas de su código [Parte XLVI]

Comment trouver les parties puantes de votre code [Partie XLVI]

अपने कोड के बदबूदार हिस्सों को कैसे खोजें [भाग XLVI]

コードの怪しい部分を見つける方法 [パート XLVI]

코드에서 불쾌한 부분을 찾는 방법 [XLVI부]

Como encontrar as partes fedorentas do seu código [Parte XLVI]

Как найти ненужные части вашего кода [Часть XLVI]

Kodunuzun Kokmuş Kısımlarını Nasıl Bulabilirsiniz [Bölüm XLVI]

Cách tìm những phần khó chịu trong mã của bạn [Phần XLVI]

如何找到代码中的臭部分 [第 XLVI 部分]

Friends: Unit, Mock, and Sonar. So, I think we’re all familiar with the fact that in large old projects with a lot of business code, we can encounter a small number of tests or even their absence. This can be related to the development culture or the fact that the project was evolving very rapidly. The same situation can await us in startups, where the speed of decision-making is very high, and the demand for delivering new functionality to the client or investor is too quick. In other words, there’s no time for tests; we’ll check it as we go along, or the developer will check it during development. But after a couple of years, there are changes in the staff of employees, and problems arise. For example: A new employee may not fully understand the business requirements. They may simply not be familiar with the business yet. They may not know the specifics of the code or the project, and knowledge may have been lost. I believe that many have encountered at least a service, and in some cases, an entire project with such issues. Let’s take a look at this problem from a business perspective. Here, Robert Martin’s book “Clean Architecture” fits very well, where he demonstrates from the first pages how the development of such software becomes more expensive. In other words, the business still sees a simple application/software, but developers often make mistakes and forget about the “peculiarities” of the code, or the overall features, which leads to a significant increase in development costs. Also, you can find the book on Amazon: Clean Architecture: A Craftsman’s Guide to Software Structure and Design (Robert C. Martin Series) So, where should we start after all? It might be hard to believe, but you don’t need to begin by building a very complex process and meticulously planning every detail. Businesses need solutions that will bring immediate benefits, even if it involves immersing employees in the business. Here’s an excellent example: Let’s consider a service for calculating discounts for a customer with no tests or documentation. This is what we’ll focus on. So, the most basic steps are as follows: Identify the critical area where most errors and issues occur. For instance, calculating discounts for major clients or users whose purchases exceed $25,000 in a month. Describe the algorithm of action — the behavior of the method/function/service. Create documentation that outlines the basic algorithm of actions. Add unit tests and mock tests. Strive to cover the entire algorithm of calculations with tests. If not all business cases are covered, return to step 1. Here, I recommend reading articles about TDD (Test-Driven Development) and BDD (Behavior-Driven Development), which can evolve from this stage. Both approaches have a positive impact on both business and code development. Plugins and Sonar The first step is usually the most challenging, but now, it’s time to help developers with analyzing the code they are currently writing. For this purpose, there is a useful plugin — for IDEA we can download and install sonar as a plugin: SonarQube Analyzer connects the  SonarQube server with Intellij Idea products. https://plugins.jetbrains.com/plugin/7238-sonarqube-analyzer?embedable=true Just use it! It’s free! Sonar as a Service The third stage will require more than just the efforts of developers. It will also involve the infrastructure team. So, now we need to set up a full-fledged SonarQube service in the infrastructure and configure integration with it. SonarQube is an open-source platform for continuous inspection of code quality. It is designed to help developers and development teams identify and fix code quality and security issues in their software projects. SonarQube analyzes code for a wide range of programming languages and provides detailed reports and metrics on various aspects of code quality, such as code duplication, code complexity, coding standards compliance, and security vulnerabilities. https://www.sonarsource.com/products/sonarqube/?source=post_page-----da33a8b823b4--------------------------------&embedable=true Usually, we set it up as a standalone service in k8s and add an integration with the ci/cd pipeline. In my case, at the outset, we didn't have time for a full automation of the integration process for the entire build pipeline with this tool, so we did everything manually. Most often, I work with GitLab on projects, and there is a fairly simple instruction for integrating it. https://docs.sonarsource.com/sonarqube/latest/devops-platform-integration/gitlab-integration?embedable=true To make this work effectively, we need to integrate auxiliary plugins or analyzers into our services that will generate reports on how well our code is covered by tests. In the case of Java (and any JVM-like language), you will need to add a plugin for this purpose. <plugin>
  <groupId>org.jacoco</groupId>
  <artifactId>jacoco-maven-plugin</artifactId>
  <version>0.8.11</version>
</plugin> After successfully setting up SonarQube as a service, let’s proceed with our first and most basic integration through manual configuration. To begin, go to the top right corner, and select “Create Project.” Write a name and a key: Next, simply follow the instructions, as the tool provides detailed guidance in each step. As an example, let’s go through the process of adding a plugin: After integration, we will have a picture: By default, the threshold may be set at 60–80%, which is quite high for us at this stage. So, let’s navigate to the quality profiles and set it to 20%. This will be a great starting point, considering the fact that many services don’t even have tests in place. Support is available for virtually all languages commonly encountered in projects: https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/languages/overview/?source=post_page-----da33a8b823b4--------------------------------&embedable=true In conclusion, at the current stage, we have achieved the following: At the very least, critical business functionality is covered by basic tests. Now, before releasing a new version, we can explicitly identify issues and bottlenecks, as well as assess how new code affects business functionality. Developers have a tool that helps them identify and highlight code issues as they write it. In other words, we immediately spot problematic areas if they exist. We are collecting statistics and viewing them in SonarQube, allowing us to assess the quality or degradation of our codebase. Integration with CI/CD automates the data collection process, making it more efficient and reliable. Let’s call it a day! Thanks for your attention, and see you soon! Also published here

Just Go Ahead and Test Your Project - Part 1

Stories, News & Mentions about SONAR

Sonar’s Stories on HackerNoon