Continuous inspection
Static analysis run on every push: linter, SonarQube's finding families, coverage and duplication measures, technical debt, ratings, a quality gate on new code and false positives.
- 25 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
Continuous inspection: what is it?
Show the answer
A practice that automatically analyses the code on every change and reports bugs, flaws and bad practices before the merge.
A defect reported on the change that introduces it is fixed by its author while the context is fresh. Found months later, it costs far more.
The analyser flags the read below (Java rule S2095, resource not closed). Which fix closes the file for sure?
```java
String lire(String chemin) throws IOException {
BufferedReader lecteur = new BufferedReader(new FileReader(chemin));
String ligne = lecteur.readLine();
lecteur.close();
return ligne;
}`- A try-with-resources
- Call
close()beforereadLine()to release the file early - Add a
catchthat ignores the exception and returnsnull - Call
close()in acatchblock that rethrows the exception
Show the answer
A try-with-resources
If
readLine()throws,close()is never reached and the file stays open. The try-with-resources closes the reader in every case, with or without an exception; acatchcloses it only on the error path.A security hotspot is not necessarily a flaw: a human must … it to decide whether it is safe or must be fixed.
Show the answer
A security hotspot is not necessarily a flaw: a human must review it to decide whether it is safe or must be fixed.
The default quality gate requires all hotspots of the new code to be reviewed, without treating them all as flaws.
Static analysis: what is it?
Show the answer
Examination of source code without running it, to spot faulty or dangerous constructions.
It sees every path, including those the tests never take, but it can be wrong: it produces false positives.
On a ten-year-old application, the quality gate blocks every merge and the team wants to turn it off. Which fix keeps the inspection useful?
- Lower every threshold until the old code passes
- Apply the gate to new code only
- Mark all current findings as false positives
- Run the analysis only before major releases
Show the answer
Apply the gate to new code only
The thresholds here apply to all the code and old debt blocks every change. Limiting them to new code requires each change to be clean, without freezing the team. Lowering thresholds or hiding findings destroys the value of the inspection.