There is no doubt that software has taken over every aspect of business, from internal applications that enable businesses to run more efficiently to customer-facing applications that bring in revenue. Software is business, and business is software.
However, simply delivering software isn’t enough anymore; businesses want, or need rather, to deliver software fast. Time is money. Delays are costly. Lost market share to a competitor and product churn from customers not getting the features they want may result in a loss of revenue.
Not surprisingly, this puts increasing pressure on developers to produce more code faster. Oh, and this code needs to not add to technical debt, not create vulnerabilities that could lead to a major “HACKED” headline, and not induce any issues that lead to a poor customer experience.
No problem, right?
Actually, this is a big problem with the current software development process.
What’s wrong with the current issue?
Software development currently relies on unit testing to determine if the code can be pushed to production. What’s wrong with that? Unit testing only tests functionality.
Unit tests do not test for code quality. Code can function properly but be of low quality. Low-quality code adds to technical debt, creates a code base that is hard to maintain and modify, and leads to vulnerabilities that induce security risks.
Peter McKee, Head of Developer Relations at Sonar, made a great quality versus functionality analogy during his recent webinar, “Driving DevOps Transformation: Leveling Up CI/CD with Static Code Analysis.” …
Imagine you just installed a door and made sure it opened and closed. You tested the functionality, it works as expected and so you are happy and consider it done. However, weeks later, that door fell off when someone opened it. The door was never inspected to see if the proper fasteners were used, if the hinges were correct for the weight of the door, and if the framing around the door was all correct. The quality of the installation was never checked, and now the entire entrance needs to be reworked.
Quality is equally important as functionality.
What is software quality?
Clean Code is the foundation that creates quality software quality.
Clean Code is code that is secure, reliable, and maintainable. These are qualities that make up great quality software.
I won’t go into detail about the four main attributes of Clean Code—consistent, intentional, adaptable, and responsible—but I highly recommend taking a deeper dive into It to understand its importance. What I want to discuss now is how you achieve Clean Code.
How do you achieve Clean Code?
The answer is rather simple: static code analysis.
Static code analysis is a method used in software development to evaluate the quality and correctness of source code without executing the program. This process involves analyzing the code to identify potential errors, code smells, security bugs and vulnerabilities, and compliance issues.
Let’s break those issues down and explain each one:
- Bug: A coding error that will break your code and needs to be fixed immediately.
- Vulnerability: A point in your code that's open to attack.
- Code Smell: A maintainability issue that makes your code confusing and difficult to modify or expand in the future.
Other important aspects of static code analysis are taint analysis and security testing (SAST).
- Taint analysis is a technique for tracking the flow of untrusted data through a software program to identify potential security vulnerabilities.
- SAST is a type of security testing that analyzes source code for security vulnerabilities without requiring the execution of the applications.
Static analysis ensures you deliver high-quality software to prevent issues later in the DevOps workflow or the application's lifecycle.
How important is static analysis? So important that the White House highlighted its importance in a National Cybersecurity Report.
It is no longer a question of whether static analysis should be used but how soon you can implement it.
Do you need both unit testing and static analysis?
YES! While unit testing isn’t enough to ensure the delivery of high-quality software, it does ensure its functionality. Remember, unit testing focuses on functionality, while static analysis focuses on quality. Both are necessary to deliver the best possible applications in today’s highly competitive business environment.
Sonar and static analysis
Sonar static analysis tools SonarQube, self-managed, and SonarCloud, a cloud service, provide comprehensive static code analysis and an approachable means to obtain Clean Code, Clean as You Code.
Clean as You Code allows developers to focus solely on new code, - code that is added or modified. This means all code going forward will be of the highest quality. This approach helps the developer focus on the code they are currently writing or modifying while the work is fresh and non-disruptive.
The best part? Implementing Clean as You Code is as simple as two steps.
- Set up a quality gate that checks only new code based on a quality profile that defines your quality standards
- Don’t release code unless your quality gate is green
That’s it. With those simple steps, SonarQube or SonarCloud can easily get you started incorporating static code analysis into your development process.
Start SonarQube for free with the Community Edition!
Prefer the cloud? No problem. Try out SonarCloud for free as well.