Both CppDepend and SonarQube are static analyzers that offer a rule-based system to detect problems in C/C++ code. However, the CppDepend default Rules-Set has very few overlaps with the SonarQube rules
Basically, the SonarQube rules are good at analyzing what is happening inside a method, the code flow while the CppDepend code model, on which the CppDepend rules are based, is optimized for a 360 view of particular higher-scale areas including OOP, dependencies, metrics, breaking changes, mutability, naming...
Concretely SonarQube rules can warn about problems like a reference could be null, while CppDepend can warn you about too complex classes or components, and offer advice about how to refactor to make the code cleaner and more maintainable. Another point that makes the CppDepend ruling system unique is カスタムルールの記述がいかに簡単か. With CppDepend a rule is a LINQ query, that queries a code model dedicated to code quality, edited live in Visual Studio, compiled and executed live at edition time. Concretely, this piece of code below is a fully functional rule, could it be simpler?
// <Name>Classes must start with an I</Name>
warnif count > 0
Application.Types.Where(t => t.IsClass && !t.SimpleName.StartsWith("C"))
When defining a custom rule with CppDepend, the user doesn't need to create a project, create a source file, step into the edit/compile/debug cycle, maintain a binary dll that requires effort to be shared, versioned and integrated. With CppDepend custom rules are raw texts, embedded as XML CDATA into the CppDepend project or rule files. Also, the documentation and how-to-fix guidelines can be embedded in the rule source code as comments.
Also, each CppDepend rule can present its issues with extra data that will help to understand the problem and fix it. Moreover, each rule can embed two formulas that attempt to estimate both the 問題の修正コスト と 問題を未修正のままにする年間コスト、とも呼ばれる 技術的負債 と 年利 問題の。 Since these formulas rely on what really matters at fix time, this makes the debt estimations smart.
Finally, with CppDepend each rule is run in a few milliseconds even on a large code base. As a consequence, all rules can be passed in a few seconds (typically 2 or 3 seconds on a real-world code base), both in Visual Studio and in the Continuous-Integration system. As a benefit, after each compilation and also at check-in time, the developer instantly knows about the new and fixed issues since the baseline, and the impact in terms of technical debt fixed or created. Now let's explain how to integrate CppDepend rule results into the SonarQube system to cumulate the strength of both products. I - C/C++ Plugin Prerequisites
- インストール SonarQube.
- インストール SonarQube Scanner or the old Sonar Runner.
- SonarQube Scanner または SonarRunner の bin ディレクトリを PATH 環境変数に追加します。
- Copy the sonar-cxx-plugin-cppdepend-1.0 from $CppDependInstallDir$/SonarPlugin to the $SonarQubeInstallDir$\extensions\plugins directory and restart SonarQube.
- 既定の CppDepend ルールは SonarQube ルールリポジトリに読み込まれます。ただし、これらのルールをカスタマイズする必要がある場合は、SonarQube の Administration タブにある .cdproj ファイルパスを使用して独自のカスタムルールを定義できます。
- 管理者としてログインし、必要なプロファイルで CppDepend ルールを有効化する必要があります。
- Execute $CppDependInstallDir$/SonarRunnerForCppDepend.exe "the .cdproj file to analyze "For example: SonarRunnerForCppDepend.exe C:\MyWorkspace\test.cdproj. SonarRunnerForCppDepend will analyze the cdproj file using CppDepend and launch the SonarQube Scanner executable to load the results into SonarQube. Any other argument passed to the SonarRunnerForCppDepend after the cdproj file argument will be passed to the SonarScanner command. For example you can pass the version with this command SonarRunnerForCppDepend.exe C:\MyWorkspace\test.cdproj -Dsonar.projectVersion=3.0
- マルチモジュール解析: a CppDepend project could contain many C/C++ projects.
After the analysis, CppDepend does not put all the code in the same SonarQube module. However, it creates a multi-module sonarqube project to isolate each project into a separate module which makes the code navigation very easy.
- 問題: CppDepend はデフォルトで 250 を超えるルールを提供し、完全にカスタマイズできます。CppDepend は次を行う強力な方法を提供します 技術的負債を計算 の問題。CppDepend の技術的負債と問題の重要度が SonarQube に渡されます。
- 標準メトリクス: プラグインはすべての標準 SonarQube メトリックを計算します。
- コード重複: 重複は SonarQube に組み込まれた CPD ツールによって検出されます。
- カバレッジ: プラグインは、Cobertura および Microsoft Visual Studio の XML 結果ファイルからカバレッジ結果を読み込みます。ただし、XML カバレッジファイルが存在するパスを設定する必要があります。
The C/C++ SonarQube plugin is easy to install and to use. The rules customization is very simple. You can try it and give us your feedback.