SonarQube for Eclipse (formerly SonarLint) alongside Eclipse CDT

[thahnen]

Hey everyone,

I'd like to start a small discussion about raising awareness for a third-party addon for CDT to make it more productive (quoting the README.md here).
The addon plug-in in question here is SonarQube for Eclipse (formerly known as SonarLint).

Why is SonarQube for Eclipse a very good plug-in alongside CDT?

I have to phrase here that I'm the main developer of the plug-in and I work at Sonar, but I don't want to put this out as a form of bland advertisement or promotion but more on the note of me pouring a lot of work into this while seeing the plug-in being a very good companion to C/C++ developers using Eclipse CDT, either for checking their code on quality and security metrics or just for improving their skills! And on the other hand it is totally free - you don't have to pay for anything and can just download it, maybe build your project and you're ready to go.

The last point is coming from the fact that with the latest version, quietly released before Christmas (was planned a bit as a "present", that's why it was timed this way), we decided to ship the C/C++ analyzers in it free of charge while before a commercial SonarQube Server installation was necessary or a free (or paid) account at SonarQube Cloud and the users would have to configure Connected Mode for each project.
We think that this will benefit more users working on C/C++ with the Eclipse IDE as it is not only a very good linter, but also a great tool in general - I have to say this as otherwise I won't be pouring my heart into it on a daily basis ❤️

Over the last half a year we already improved a lot of parts of our plug-in that are connected to Eclipse CDT (like speeding up the whole plug-in on C/C++ projects, indexing and the analysis) as well as overhauling the rule descriptions and now finally embedding the actual analyzer. Of course we like to see this being used by users and giving us the opportunity to improve or support more parts as we have only a couple of C/C++ developers in our organization to use and test it and I'm also a bit rusty - I wish I would have had any tool like this when I was developing C/C++ on Eclipse CDT years ago.

How well does SonarQube for Eclipse work alongside CDT?

When embedding the analyzer, we did a lot of tests (see the PDF attached to the SLE-1000 ticket) and in nearly all of the cases our plug-in worked out of the box or only required re-building the project - the latter might be due to me not having used Eclipse CDT professionally in years and I might have forgotten how to tweak a few bits like symbols that were not found or the include paths manually. These tests haven't been done in ages honestly. So we ran CDT Managed Build, Makefiles, CMake, Meson and Windows-based tests and a few more where we imported garbage or super-complex projects to see how both Eclipse CDT and our plug-in reacted.

The only project I didn't get it to work with was actually this very repository and the modules with the native sources laying alongside the Java code. This didn't work before as well and I guess it might be due to me not correctly importing or configuring the project. So maybe these use cases of having mixed projects might be an opportunity for the future 👍

What is actually my intention here?

A fair question. As stated above, I don't want to rush in, promote (or even use the ugly term advertise) and then leave again.
A part of me of course does want to promote it due to the fact that it will be of benefit to users but I mostly want to raise awareness about it for everyone to see it, try it and stick to it if they like it and see it fit. I see one way of doing so is to add it to the global README.md of the repository - a tiny symbolic baby step.

Maybe our plug-in can be featured somewhere else where there is a broader audience? Like towards the ones actively developing Eclipse CDT would be a great first step (is the mailing list appropriate for that, if not this is totally fine) as they are the ones that know all about Eclipse CDT and hopefully C/C++ as well. Also, because our plug-in already features analyzers for different languages like Java ^^
And afterwards towards the actual user base of Eclipse CDT? We will do so to our user base of course as well but honestly I don't know how big the intersection between the loyal Eclipse CDT and SonarQube for Eclipse users actually is.

Final Words

Feel free to leave any feedback about this idea or our plug-in in general, constructive feedback is most appreciated! Also input about how to raise awareness would be great!

Happy new year and keep up with the great work on Eclipse CDT!
Tobias

[jonahgraham]

Hi @thahnen - thank you for sharing this!

Would you like to come to our next CDT call this Wednesday #967 as that should be a good audience to start discussing with the active contributors to CDT. We are currently working towards a major release, CDT 12, so now is a good time for this conversation.

I think one of the big questions I have is what parts of CDT does this analysis depend on? This is especially important in the context of the CDT parser being under resourced and not working great with C++17 and more recent versions of the standard.

[thahnen]

Hi @jonahgraham,

Thanks for the invitation, I'd like to attend this meeting!

I will try to prepare something small regarding what we depend on from the CDT side and to give a small overview about SonarQube for Eclipse in general 😃

[jonahgraham]

Great! I look forward to meeting you on Wednesday.

My main question of what id depended on is whether SonarQube uses parser, discovery or neither. In the context of https://github.com/eclipse-cdt/cdt-lsp where we farm most of that work to clangd I wonder how this works with SonarQube.

[jonahgraham]

@thahnen at the call today #967 we discussed this and look forward to more discussions next month (#996).

One immediate action point you can take is adding the plug-in to Add-ons for CDT part of the readme: https://github.com/eclipse-cdt/cdt?tab=readme-ov-file#add-ons-for-cdt - please create a PR at your convenience

[thahnen]

Hi @jonahgraham,

thank you very much. I added the plug-in to the README.md and opened a PR over at #997

Best,
Tobias

[alef75]

I have been an Eclipse IDE user for many years, and for the past three years, I have been using SonarLint now (SonarCloud for Eclipse) , which I find to be a powerful and incredibly useful tool for improve the quality of our codebase and the our code skills.
We use it in connected mode.
It's a very good news to have the C/C++ analyzers for free and in standalone mode also for eclipse.

I would say that In the last monthts @thahnen has been very active to improve the plugin and had fixed some issue I've found.

We develop Linux IoT systems based on ARM architecture.
Our project is a mono-repo that contains:

Open-source C/C++ sources
Proprietary sources + unit tests in C/C++
Web app sources (backend + frontend) in PHP and TypeScript (Angular)
Acceptance test sources in Python
For the CDT part, we use a C/C++ Makefile project with existing sources. We have configured many build configurations, allowing us to build the various applications that make up the system individually and to execute the unit tests.

The corresponding Eclipse project is quite large and complex, and I believe it could serve as a good use case for Sonar, as well as CDT, PDT, PyDev, and WWW WildWeb.
I'm open helping in testing and give feedback on our configuration.
For instance, in our case, we identified some interaction issues between CDT, PDT, and SonarLint.
To address this, we created two subprojects for the WEB and Python parts.
With this solution, the issue caused by PDT seems resolved: when editing PHP or Python files within the respective subprojects, Sonar does not display its findings in the editors, even though the findings are correctly detected in the logs.

I’m not sure if this is the right place for this discussion, so for now, I’ll stop here.