Re: Call to action: fixing defects reported by code analysis tools

[Michael Brohl]

Hi everyone,

we started the first activities in Jira [1].





Are there any objections to do this?



There are even projects which publish the metrics on their website [2].

Best regards,

Michael Brohl
ecomify GmbH
www.ecomify.de

[1] https://issues.apache.org/jira/browse/OFBIZ-9450

We have set up an OFBiz build on our Jenkins server who automatically does a FindBugs code analysis after each commit I'm thinking about publishing the results on a web server. This should help to engage contributors to work on the bugs without the need to do the analysis themselves (quick jump in). Do we have a webspace for this which I can use or would it be appropriate to publish results on one of our servers? [2] http://db.apache.org/torque/torque-3.3/releases/torque-3.3/generator/maven-reports.html

Am 29.06.17 um 12:16 schrieb Michael Brohl:

Hi all,



Every support is well appreciated, thank you!

Regards,

Michael Brohl
ecomify GmbH
www.ecomify.de


Am 13.12.16 um 18:35 schrieb Jacopo Cappellato:

just wanted to bring this back in mind in case there are people interested in helping out with this.

Hi all,


on our codebase.

code that may need to be improved or fixed.

"rule violations": some of them are probably false positives but others

fixed.


as many defects as possible: it may lead to a cleaner codebase, may

some insight on our code quality, and may make it easier for new
contributors to help the project.

So here are the steps to quickly start the process:

1) get a clean checkout of the trunk

svn co http://svn.apache.org/repos/asf/ofbiz/trunk

2) edit the build.gradle file to enable the PMD or FindBugs plugins.

plugin" commands:

apply plugin: 'pmd'

For FindBugs add the following lines:

apply plugin: 'findbugs'
tasks.withType(FindBugs) {
     reports {
         xml.enabled false
         html.enabled true
     }
}

Apply only pmd or findbugs, not both: the two tools provide different

fixing the code.

3) run the analysis with the command:
./gradlew check

4) review the report;
for PMD the report is:
build/reports/pmd/main.html
for FindBugs the report is:
build/reports/findbugs/main.html

5) fix some bugs and test; then go back to #3


reported by PMD/FindBugs

Feel free to ask here any question!

Jacopo

thanks to Gradle we have now an easy way to run source code analysis tools Tools like PMD and FindBugs generate useful reports containing pointers to In fact I have executed them on trunk and I got reports with thousands of really represent code that can be improved, simplified or, in some cases, I think that it would be great if this community will work together to fix increase the confidence of potential adopters that use these tools to get For PMD you can add the following line to the file, after the other "apply analysis with plenty of defects but the two tools will spot the same ones in most cases, so please choose the tool of your preference and then start 6) create a patch and submit it to Jira, mentioning that it fixes defects

smime.p7s
Description: S/MIME Cryptographic Signature