Both CppDepend and SonarQube are static analyzers that offer a rule-based system to detect problems in C/C++ code. However, the CppDepend default Rules-Set has very few overlaps with the SonarQube rules
Basically, the SonarQube rules are good at analyzing what is happening inside a method, the code flow while the CppDepend code model, on which the CppDepend rules are based, is optimized for a 360 view of particular higher-scale areas including OOP, dependencies, metrics, breaking changes, mutability, naming...
Concretely SonarQube rules can warn about problems like a reference could be null, while CppDepend can warn you about too complex classes or components, and offer advice about how to refactor to make the code cleaner and more maintainable. Another point that makes the CppDepend ruling system unique is 编写自定义规则有多么容易. With CppDepend a rule is a LINQ query, that queries a code model dedicated to code quality, edited live in Visual Studio, compiled and executed live at edition time. Concretely, this piece of code below is a fully functional rule, could it be simpler?
// <Name>Classes must start with an I</Name>
warnif count > 0
Application.Types.Where(t => t.IsClass && !t.SimpleName.StartsWith("C"))
When defining a custom rule with CppDepend, the user doesn't need to create a project, create a source file, step into the edit/compile/debug cycle, maintain a binary dll that requires effort to be shared, versioned and integrated. With CppDepend custom rules are raw texts, embedded as XML CDATA into the CppDepend project or rule files. Also, the documentation and how-to-fix guidelines can be embedded in the rule source code as comments.
Also, each CppDepend rule can present its issues with extra data that will help to understand the problem and fix it. Moreover, each rule can embed two formulas that attempt to estimate both the 修复问题的成本 和 让问题不修复的年度成本，也称为 技术债务 和 年利息 问题的。 Since these formulas rely on what really matters at fix time, this makes the debt estimations smart.
Finally, with CppDepend each rule is run in a few milliseconds even on a large code base. As a consequence, all rules can be passed in a few seconds (typically 2 or 3 seconds on a real-world code base), both in Visual Studio and in the Continuous-Integration system. As a benefit, after each compilation and also at check-in time, the developer instantly knows about the new and fixed issues since the baseline, and the impact in terms of technical debt fixed or created. Now let's explain how to integrate CppDepend rule results into the SonarQube system to cumulate the strength of both products. I - C/C++ Plugin Prerequisites
- 安装 SonarQube.
- 安装 SonarQube Scanner or the old Sonar Runner.
- 将 SonarQube Scanner 或 SonarRunner 的 bin 目录添加到 PATH 环境变量。
- Copy the sonar-cxx-plugin-cppdepend-1.0 from $CppDependInstallDir$/SonarPlugin to the $SonarQubeInstallDir$\extensions\plugins directory and restart SonarQube.
- 默认的 CppDepend 规则会加载到 SonarQube 规则库中。但是，如果您需要自定义这些规则，可以使用位于 SonarQube Administration 选项卡下的 .cdproj 文件路径来定义您自己的自定义规则。
- 您必须以管理员身份登录，并在所需的配置文件中激活 CppDepend 规则。
- Execute $CppDependInstallDir$/SonarRunnerForCppDepend.exe "the .cdproj file to analyze "For example: SonarRunnerForCppDepend.exe C:\MyWorkspace\test.cdproj. SonarRunnerForCppDepend will analyze the cdproj file using CppDepend and launch the SonarQube Scanner executable to load the results into SonarQube. Any other argument passed to the SonarRunnerForCppDepend after the cdproj file argument will be passed to the SonarScanner command. For example you can pass the version with this command SonarRunnerForCppDepend.exe C:\MyWorkspace\test.cdproj -Dsonar.projectVersion=3.0
- 多模块分析: a CppDepend project could contain many C/C++ projects.
After the analysis, CppDepend does not put all the code in the same SonarQube module. However, it creates a multi-module sonarqube project to isolate each project into a separate module which makes the code navigation very easy.
- 问题: CppDepend 默认提供 250 多条规则，您可以轻松地完全自定义。CppDepend 提供了一种强大的方法来 计算技术债务 的问题。CppDepend 的技术债务和问题严重程度会传递给 SonarQube。
- 标准度量: 插件会计算所有标准 SonarQube 指标。
- 代码重复: 重复代码由 SonarQube 内嵌的 CPD 工具检测。
- 覆盖率: 插件从 Cobertura 和 Microsoft Visual Studio XML 结果文件加载覆盖率结果。但是，您必须设置 XML 覆盖率文件所在的路径。
The C/C++ SonarQube plugin is easy to install and to use. The rules customization is very simple. You can try it and give us your feedback.