Make your code shine with Static Analysis and SonarQube

Here we will cover different static lint checks for code analysis for the Kotlin Jetpack Compose. That will helps any developer team size to validate the code quality before having the code review. On another side, Sonarqube help to identify the code quality in depth. That will identify the Code smells, Duplication, vulnerabilities, Major issues, Blocker issues, security Issues, and more. Ultimately the goal of the developer should be to make a flag PASS on SonarQube. That indicates your code is aligned with best practices and easy to adopt by any other team members.

Approach:

What is code review and Why it is required?
Code Review Terminologies
Static Code Analysis in Jetpack Compose 👨‍💻
SonarQube Code Review automation for Android and Flutter 👨‍💻
Summary & Conclusion
Q&A

Transcript

1. Make your code shine with Static Code Analysis and SonarQube
2. Chintan Khetiya Software Specialist @Synoverge @khetiyachintan Pranay Patel SDE Android @MutualMobile @pranaypatel_
3. #DevFestAhm #DevFest2022
4. 1. What is manual code review? This talk
5. 1. What is Manual Code Review? 2. What is Static Code Analysis? This talk
6. 1. What is Manual Code Review? 2. What is Static Code Analysis? 3. Why Static Code Analysis? This talk
7. 1. What is manual code review? 2. What is static code analysis? 3. Why Static Code Analysis? 4. How to do Static Code Analysis? This talk
8. 1. What is Manual Code Review? 2. What is Static Code Analysis? 3. Why Static Code Analysis? 4. How to do Static Code Analysis? 5. Static Code Analysis In Jetpack Compose 󰞵 This talk
9. 1. What is Manual Code Review? 2. What is Static Code Analysis? 3. Why Static Code Analysis? 4. How to do Static Code Analysis? 5. Static Code Analysis in Jetpack Compose 󰞵 6. Automate your code analysis using Sonarqube This talk
10. Write Clean Code
11. Reliable
12. Secure
13. Maintainable
14. Modular
15. Manual code review!
16. What is manual code review?
17. Peer code review!
18. Self code review!
19. What are the cons of manual code review?
20. When you can avoid the code review?
21. Any tools to avoid manual process?
22. [Ahmedabad] Pranay Patel SDE Android @MutualMobile Static Code Analysis with Jetpack Compose
23. What is static code analysis?
24. What is static code analysis? • A method of debugging that is done by automatically examining the source code without having to execute the program.
25. What is static code analysis? • A method of debugging that is done by automatically examining the source code without having to execute the program. • Identify the patterns in the code and detect possible issues in the quality of the code.
26. Why Static Code Analysis?
27. • Write bug-free code. Why Static Code Analysis?
28. • Write bug-free code. 😅 Why Static Code Analysis?
29. • Write bug-free code. • Following common code practices Why Static Code Analysis?
30. • Write bug-free code. • Following common code practices • Better resource utilization Why Static Code Analysis?
31. How to do Static Code Analysis?
32. Static code analysis in Jetpack Compose with hands-on
33. Twitter's Jetpack Compose Rules A set of custom ktlint rules to ensure that your composables don't fall into common pitfalls, that might be easy to miss in code reviews. https://twitter.github.io/compose-rules/
34. • Set of Compose static checks to start with same patterns. • Detect as many potential issues as we can • Show errors prior to code review Why Twitter's Jetpack Compose Rules?
35. kotlinter-gradle Painless Gradle plugin for linting and formatting Kotlin source files using the awesome ktlint engine. https://github.com/jeremymailen/kotlinter-gradle
36. kotlinter-gradle • Twitter compose rules using Kotlinter
37. kotlinter-gradle • Twitter compose rules using Kotlinter • Easy to set up
38. kotlinter-gradle • Twitter compose rules using Kotlinter • Easy to set up • Fast with ktlint engine
39. // Root build.gradle.kts plugins { id("org.jmailen.kotlinter") version "3.12.0" apply true } buildscript {...} subprojects { apply(plugin = "org.jmailen.kotlinter") } Install kotlinter-gradle Step 1:
40. // Root build.gradle.kts plugins { id("org.jmailen.kotlinter") version "3.12.0" apply true } buildscript { dependencies { classpath "com.twitter.compose.rules:ktlint:<version>" } } Install Twitter Compose Rules Step 2:
41. ./gradlew formatKotlin: format Kotlin source code according to ktlint rules or warn when auto-format not possible. ./gradlew lintKotlin: report Kotlin lint errors and by default fail the build. kotlinter-gradle adds these gradle tasks
43. Lets run ./gradlew lintKotlin in project! See actions in project
44. Manual commands! 🤔
45. Automate process! if ! ./gradlew lintKotlin ; then printf 1>&2 "\nlintKotlin found problems, running formatKotlin; commit the result and re-push" $GRADLEW formatKotlin exit 1 fi Step 1: Create shell script using gradle tasks
46. Git Hooks tasks.register("installGitHook", Copy::class) { from("${rootProject.rootDir}/scripts/git-hooks") into("${rootProject.rootDir}/.git/hooks") fileMode = 7 * 64 + 7 * 8 + 7 } Step 2: Install pre-commit git hook https://git-scm.com/book/en/v2/Customizing-Git-Git-Hooks
47. Install Hooks Step 3: ./gradlew installGitHook ${rootProject.rootDir}/.git/hooks
48. Back to Demo
49. ✅ Set of Compose static checks to start with same patterns. ✅ Detect as many potential issues as we can ✅ Show errors prior to code review It’s helps. right?
50. Any other option for Code Review Automation
51. Chintan Khetiya Software Specialist @Synoverge Speaker Image Placeholder Code Review Automation with for Android and Flutter [Ahmedabad]
52. is a self-managed, automatic code review tool that systematically helps you deliver Clean Code.
53. Detects Bugs, Vulnerabilities, Code Smell, Duplication and many more Why?
54. Perform continuous code inspections Why?
55. Analyses 30+ languages Why?
56. Support CI pipeline and DevOps platform Why?
57. Ensure code meets high-quality standards. Why?
58. • Assign Bugs • Invite developers • Track bug by active/inactive status • Check list of rules • Track project all the time to maintain the quality • Get Code quality Report at single Dashboard Why?
59. What if I run without Sonar
60. Found New Bug
61. SonarLint provides immediate feedback in your IDE as you write code so you can find and fix issues before a commit. Solution Stages
62. SonarQube’s PR analysis fits into your CI/CD workflows Solutions Stages
64. ड े वलपम ें ट क े साथ भी, ड े वलपम ें ट क े बाद भी
65. Quality Gates keep code with issues from being released to production. Always know your code health Passed Failed
66. Types of Issues Code Smell 03 A maintainability issue that makes your code confusing and difficult to maintain. Vulnerability 02 A point in your code that's open to attack. Bug 01 A coding mistake that can lead to an error or unexpected behavior at runtime.
67. SonarQube helps you find AND fix
68. 1 BLOCKER 3 MAJOR 5 INFO 2 CRITICAL 4 MINOR Issue Severity
69. BLOCKER: Bug with a high probability to impact the behavior of the application in production. Example: a memory leak, or an unclosed JDBC connection
70. CRITICAL: Either a bug with a low probability to impact the behavior of the application in production or an issue that represents a security flaw. Example: An empty catch block or SQL injection
71. MAJOR: A quality flaw that can highly impact the developer's productivity. Example: An uncovered piece of code, duplicated blocks, or unused parameters are examples of MAJOR issues
72. MINOR: A quality flaw that can slightly impact the developer's productivity. Example: Lines should not be too long, and "switch" statements should have at least 3 cases
73. INFO: Neither a bug nor a quality flaw, just a finding.
74. Shall we jump to process?
75. Prerequisite & Environment Configuration
80. Configuration
85. Configuration Flutter
89. It’s time for Demo
91. Key Learnings • What is manual code review? • What is static code analysis? • How to implement with Compose? • Code analysis using Sonarqube • Understand the types and stages of issue • How to automate code review process? • Sonar for Android and Flutter • Hands-On
92. Sample Code 1. https://github.com/pranaypatel512/JetKite 2. https://github.com/khetiyachintan/Sonar-For- Android 3. https://github.com/khetiyachintan/Sonar-For- Flutter
93. • https://docs.sonarqube.org/latest/ • https://plugins.gradle.org/plugin/org.sonarqube • https://github.com/insideapp-oss/sonar-flutter/releases/ • https://docs.sonarqube.org/latest/setup/get-started-2-minutes/ • https://techmusings.optisolbusiness.com/sonarqube-with-flutter -e294e48018f2 • https://www.youtube.com/watch?v=846xAH40oUM Helpful Links
94. Hope you have!
95. Chintan Khetiya Software Specialist @Synoverge @khetiyachintan Pranay Patel SDE Android @MutualMobile @pranaypatel_