5)Configureastaticcodeanalyzerwhichwillperformstaticanalysisofthewebapplication
[Link]
ashboardofthestaticcodeanalysistool.
staticcodeanalysis:Ithelpsustoensuretheoverallcodequality,fixbugsintheearlystageofdeve
lopment,andensurethateachdeveloperisusingthesamecodingstandardswhenwritingthe
code.
Therearethreebasictoolsthatwearegoingtouseforourstaticcodeanalysis:Chec
kStyle,Findbugs,PMD.
CheckStyle
CheckStyleisatoolthathelpsprogrammerswritecodethatalignswithalreadyagreeduponc
[Link]
project.
FindBugs
[Link]
sforusis,ofcourse,[Link],
[Link]
esofthebugsthatcouldbedetectedareinfiniteloops,unusedvariables,security,threading
issues,andmanymore.
PMD
[Link]
ssues([Link]),PMDcancheckifourcodewascommentedproperlyifour
variablesarenamedproperlyandourmethodcontainsmorethanthespecifiednumberoflin
[Link]
[Link],weneededtodefinecustomexcludedrulesinorderforPMDtoplaynicewithLo
mbok.
Copy/
PasteDetector(CPD)isanintegratedpartofPMDandisusedtodetectduplicatedcodeinasour
cecode.
41
SettingUpStaticCodeAnalysis
[Link]
touseforourstaticcodeanalysis.
Staticanalysissetupfileswillresidein./gradle/static-code-
[Link]
[Link],we’llusestaticCodeAnalysis.
[Link]
ingsneededtorunstaticcodeanalysisforourproject.
buildscript{
repositories{
mavenCentral()
dependencies{
classpath'[Link]:gradle-cpd-plugin:1.1'
}
applyplugin:'checkstyle'
applyplugin:'findbugs'
applyplugin:'pmd'
applyplugin:[Link]
42
Ok,let’sjumpintosettingthestaticcodeanalysis.
Oncethepluginsareincludedinthebuildscript,[Link]
rst,wearegoingtoconfiguretheCheckStyleplugin.
SettingCheckStyle
ForCheckStyle,wearegoingtosettheignoreFailuresflag,toolVersion,andconfigFile,which
[Link],wearegoingt
[Link]—
[Link],t
hat’[Link]’ssetuptheFindBugsnext:
checkstyle{
toolVersion='8.12'
ignoreFailures=false
configFile=file("${rootGradleDir}/static-code-analysis/checkstyle/[Link]")
[Link].
Whatthatbasicallymeansisthatourprojectbuildwillfailifwerunintoanyissueduringour
[Link],thishasalotofsense.
OurCI/
[Link],u
nittestfailure,codeanalysis,aslongaswehaveanissue,weshouldn’tbeabletocontinuewitho
urpipeline.
SettingFindBugs
Inmostcases,[Link]
wecouldsethere,suchasspecifyingwhichbugdetectorsaregoingtoberunortoinclude/
[Link],wewillleave
thedefaultvalueshere:alldefaultbugdetectorswillberun,andwearenotgoingtoexcludeany
filefromFindBugsdetection.
43
findbugs{
toolVersion='3.0.1'
ignoreFailures=false
SettingPMD
ForPMD,besidestoolVersionandignoreFailures,wearegoingtosettherulesetsforourcode
[Link]
pluginconfigurationusingruleSetsarray,orwecouldextracttherulesetstoseparatetheXML
fileandreferencethefileusing
[Link]
[Link]
ylecategory,[Link]
[Link].
pmd{
toolVersion='6.7.0'
ignoreFailures=false
ruleSetFiles=files("${rootGradleDir}/static-code-analysis/pmd/[Link]")
ruleSets=[]
rulePriority=3
44
}
SettingCPD
ForCopy/
Pastebugdetection,[Link],let’ssettheminimumToken
Countto100.Thismeansthatthepluginwilldetectaduplicatecodebugifitfindsaround5–
[Link]
linesofcodearematched,[Link]—
especiallyifweareusingframeworks—
[Link]“falsepositives”andignorecase
swhereclassesormethodshavethesame5–
[Link],we’llenableandgenerateXMLby
[Link].
cpd{
language='java'
toolVersion='6.0.0'
minimumTokenCount=100//approximately5-10lines
cpdCheck{
reports{
[Link]=false
[Link]=true
45
}
ignoreAnnotations=true
source=[Link]
viewraw
Forremainingstaticanalysisreportplugins,wewillenablegenerationoftheHTMLreportins
teadofXMLone.
[Link](Checkstyle){
reports{
[Link]
[Link]
[Link](FindBugs){
reports{
[Link]
46
[Link]
[Link](Pmd){
reports{
[Link]
[Link]
Great!
[Link],wejustneedtoincludestaticCo
[Link]:
applyfrom:"${rootGradleDir}/[Link]"
RunningStaticCodeAnalysis
StaticcodeanalysispluginswillrunwiththesameJavaversionusedtorunGradle.
EachpluginwilladditsowndependenciestotheJavapluginchecktask([Link],cpdMai
n).Wheneverwerun./
gradlewcleanbuild,theinternallychecktaskwillbetriggeredandstaticanalysisstepswillber
[Link]
47
stepsfail,[Link]
generatedunder./build/reports.
Ifinsomesituationsweneedto“loose”thespecifiedstaticcoderules,weca
nalwayssuppressstaticanalysiserrorsbyusing@SuppressWarningsan
[Link]
aclass,wecould
put@SuppressWargning("[Link]")onthegivenclass.
Weadvisekeepingstaticanalysis“on”[Link]
[Link]
eshouldconformtothesamestyles/
rulesweusethroughoutourproject.
