Understanding project metrics in SonarQube Server

(music) Pulse (chime) Hello! In this video we’ll review the project metrics provided after running an analysis in SonarQube Server. Understanding these metrics will help you interpret your results and improve the quality and security of your code. After watching this video, you’ll be able to recall the types of key metrics in a SonarQube Server analysis, and explain at a high level what each metric represents. Let’s get started! First, let’s look at the three types of code quality issues that a SonarQube analysis identifies: Security, Reliability, and Maintainability. Security issues are related to security vulnerabilities, such as a sequel injection or a leaked secret. Reliability issues are run time issues and bugs, such as an infinite loop or uncaught exceptions. Maintainability issues are more traditional linting type issues, such as an unused variable, or unnecessarily complex code. For each issue type, you’ll see the total number of issues identified. Note that issues can overlap across the different issue types. This means that a Reliability issue, such as code that triggers a buffer overflow, could also be identified as a Security issue. Each issue type also has a rating. Security and Reliability ratings map to the single highest severity vulnerability or bug in the code period. For example, a rating of B means there’s at least one minor issue detected. The Maintainability rating is determined by the technical debt ratio of your code, or the cost to fix your software compared to the cost to develop your software. This means it’s possible to have a high rating even with a large number of Maintainability issues, because your technical debt ratio is low. When an issue is marked as Accepted, this means a developer has confirmed the issue is not a false positive, and intends to fix it later. Unlike Open issues, Accepted issues don’t impact your metrics. Coverage refers to code coverage. If you pass a code coverage report into Sonar using a third-party tool, this metric represents the percent of your code that has been executed by your tests. Duplications represent the percent of code that has been repeated across your project. You can also see the number of lines involved in these Duplications. Security Hotspots differ from Security Issues. Security Issues are highly actionable vulnerabilities, whereas Security Hotspots require a review with context to determine if they indicate a vulnerability. If your organization uses SonarQube Advanced Security, the product add-on, you’ll also see the number of Dependency risks detected in your code. This metric represents the number of security vulnerabilities, malicious packages, and prohibited licenses brought in by dependencies on third party libraries. Finally, the Quality Gate status is a pass/fail status based on whether your code passed or failed the quality gate conditions set for your project. The quality gate will fail even if one condition isn’t met. By default, all projects are set to the Sonar Way quality gate, but you can create your own quality gate with specific conditions and rules. Understanding your project metrics is key to continuously improving the quality and security of your code. See our additional videos to dive deeper into other Sonar topics!