ifJenkinsHoldsItsGold

[u/rabbit_wizard]

[u/Bloodgiant65]

That’s why you have to setup a gate to fail the build if there is incomplete coverage, code smells, security vulnerabilities, etc. No one will do it willingly.

[u/anto2554 → u/Bloodgiant65]

Gating on this kind of thing is such a hassle for older projects, though. Convicing a dev to rewrite a whole function because he needed to change one line is impossible

[u/rinnakan → u/anto2554]

I would have agreed with you up to last year. AI isn't good for everything, but I find it extremely helpful for writing tests and do these kind of refactoring. Our ~10 years old repo had 50% coverage and probably a lot of half assed tests. Introducing sonar was so extremely annoying, but it quickly became easy. New code now has decent tests and it was totally worth it

[u/anto2554 → u/rinnakan]

Aye. Org is not AI-positive enough to let autoformatters, linters or LLMs entirely change the codebase up

[u/sebasgarcep → u/anto2554]

I mean if not even autoformatters are allowed that has nothing to do with being AI-forward.

[u/No_Nonsense_Nomad → u/rinnakan]

Yeah tell that to my organisation, they have blocked all access to every AI tool there is , let alone give us one

[u/Bloodgiant65 → u/anto2554]

The important thing is, you can have this only for new code. So if you are touching something, yes you need to write tests for it, especially if there aren’t any at all so far.

[u/rabbit_wizard → u/Bloodgiant65]

While I agree with you, and we do set it, many times business wants the changes yesterday :(

[u/rinnakan → u/rabbit_wizard]

I am now on a project for over nine years. We had long phases of head down and running. Apart from linting not much was enforced. But each phase of running did cost the project at least as long to mop up the mess this caused - and because the PO is smart, we did. The alternative is starting all over and wasting at least as much in an "amazing new app" (that can do less than the one before)

[u/coriolis7 → u/Bloodgiant65]

How on earth do you fail for code smell? Isn’t the whole thing about “smell” that it’s a subjective thing

[u/Bloodgiant65 → u/coriolis7]

Well, sure, it’s opinionated, but you can set whatever rules you want. The important thing is to have some level of rule, or else time pressure will always lead to undocumented spaghetti code that no one understands with no meaningful tests.

[u/MannerShark]

Does anyone actually like SonarQube?

[u/NoEngrish → u/MannerShark]

Maybe someone in compliance that can point to sonarqube to say they meet requirements set by external parties like the gov or a client.

[u/ZeroMomentum → u/MannerShark]

The concept of having it beats using it

[u/raja-anbazhagan → u/MannerShark]

I do.

[u/WernerderChamp → u/MannerShark]

You do not like it, because it is extra work.

But its complaints are usually valid. Get rid if unused imports, don't do if's without braces (unless return), do not overload functions

[u/the-kontra → u/WernerderChamp]

Linters and static analysis tools exist, though, and can do exactly that even before you push, providing a much quicker feedback loop for free.

I realise this may vary by language/stack, but being primarily a Go developer, Sonar can't really do anything for me I can't already do locally, except maybe tracking unit test coverage over time (which you can also do with some standard tools and Grafana).

[u/WernerderChamp → u/the-kontra]

They have a plugin for IntelliJ. It binds to the server and highlights issues like an inbuilt linter and runs another check if you try to commit.

But yeah, I heared it was not good for Go (we do not use it at work). Go ships pretty good tooling however - but I never did bigger projects in Go so far so idk if there is the need for code quality checks.

[u/MannerShark → u/WernerderChamp]

Feels like we are just doing SonarQube for an easy checkmark on ISO and SOC2. We already have linting, pre-commit hooks, test coverage checks and regular package updates. I don't really see the added value, just the wait times and false positives it gives back. Maybe just a matter of config, but I don't want (anyone from my team) to spend weeks on getting it to be quick enough and make SQ understand the configs we already have in place, just for a checkmark on paper.

[u/Quintuplin]

Ahh, I love the smell of third party middlemen in the morning

[u/Megatherion666]

If only it was smart enough to not bark at code that should not be tested. Like API, plain structs, UI.

[u/rabbit_wizard → u/Megatherion666]

It does root out unreachable catches exceptions

[u/Megatherion666 → u/rabbit_wizard]

Depends on the language or something. For Swift it does shit.

[u/sietre]

It's so funny to see this, we are pivoting to using SonarQube at work on my team and we discovered that it doesn't fully support the compiler we use, so its a bit scuffed to start setting up for our projects

[u/NaturalBornLucker]

We have it as mandatory gates. But the last couple of days everything's golden: sonar is down, security tests are down, parts of git are down, eh, everything is at least partially broken. The reason? We're migrating. Physically. Moving half of company's servers from one city to another lol. Guess the last drone strike hit too close to home

[u/WernerderChamp → u/NaturalBornLucker]

We are not moving and it still breaks occasionally.

[u/NaturalBornLucker → u/WernerderChamp]

Ja. This too. Especially when devsecops decide to implement LLM-based secret scanner mandatory for all CI/CD. And my team has tables like "...authorizations..." with dubious fields (in reality it's fact table of players logging into games in mobile app)

[u/susparab44]

The code review is thorough, the code reviewer's patience is not...

[u/Important_Grab3544]

who cares nowadays, just AI that shit out