Static Code Analysis Plug-ins

New homepage The static code analysis plug-ins are being maintained by their owner from a new home. The plug-ins are still compatible with Hudson, however, the entry points for documentation and issue reporting have been combined in order to provide a single point of entry.

Plugin Information

This plug-in provides utilities for the static code analysis plug-ins.Hudson understands the result files of several static code analysis tools. For each result file a different plug-in is used for configuration and parsing.Since these results are visualized by the same back-end, the description of this back-end is combined in this section. The following plug-ins use the same visualization:

Checkstyle Plug-in DRY Plug-in FindBugs Plug-in PMD Plug-in Compiler Warnings Plug-in Task Scanner Plug-in

Installation Requirements All these plug-ins require this utility plug-in "analysis-core" (called "Static Code Analysis Plugins" in the update manager) as dependency. Please ensure that the latest version of this utility plug-in is also installed.

Additionally the add-on plug-in Static Analysis Collector is available that combines the individual results of these plug-ins into a single trend graph and view.

The following features are provided by these plug-ins:

• Build summary showing the new and fixed warnings of a build
• Several trend reports showing the number of warnings per build
• Several portlets for the Hudson dashboard view
• Overview of the found warnings per module, package, category, or type
• Detail reports of the found warnings optionally filtered by severity (or new and fixed)
• Colored HTML display of the corresponding source file and warning lines
• Several failure thresholds to mark a build as unstable or failed
• Configurable project health support
• Highscore computation for builds without warnings and successful builds
• Works with the freestyle and native m2 build option of Hudson
• Remote API to export the build quality and found warnings

You can see these plug-ins in action in the public Hudson instance of the analysis plug-ins.

Trend Graphs

There are several trend graphs available for the plug-ins. Currently, you can select one of the following trend graphs for a job:

• Total warnings per build including the distribution of the priorities low, normal, and high in different colors.
     
• Total warnings per build showing how many warnings are below (blue), in between (yellow), or above (red) the build health thresholds.
     
•  New and fixed warnings per build, fixed in blue, and new in red.
     
• Difference between new and fixed warnings per build (cumulative).
     

You can adjust the size of graph and the number of builds to include. These graphs can be configured globally for a job and can be changed by each user.

Portlets for the dashboard view

The following portlets for the dashboard view are available:

• The number of warnings per project (total, priority high, priority normal, priority low)
     
• Trend graph with number of warnings in the selected projects (with priority distribution)
     
• Trend graph with number of new and fixed warnings in the selected projects
     
  

Build Summary

The results for each build are summarized on the build view. Here you see how may warnings or open tasks have been found for the selected build. Moreover, the summary shows the number of new and fixed warnings as well as the number of scanned or parsed files. The details views for each plug-in are accessible via hyper links. You can also directly navigate to the plug-in results by clicking into the trend image (see image above).

Result Overview

Each plug-in presents the results of a build in several overview tabs: here you see the number of the warnings or tasks per item as well as the severity distribution. The severity graphs provide a tool tip to show the actual number of warnings or tasks for each severity. By following the link in the first overview table column you will be directed to the filtered details of the selection. The overview table is sortable, so you can easily find the modules or packages with the most warnings by clicking on the table header.

• The modules tab shows the number of warnings or open tasks per module. The module name is extracted from the pom.xml (Maven) or build.xml (Ant) build configuration files. If you are using another build tool then the path segment above the scanned analysis report file is used as module name.
• The packages tab shows the number of warnings or open tasks per package or namespace. There is currently only support for Java or C# files.
• The files tab shows the number of warnings or open tasks per file.
• The categories tab shows the number of warnings per category. The available set of categories is obtained from the underlying static code analysis tool.
• The type tab shows the number of warnings per type. The type depends on the static code analysis tool but typically is a 1:1 mapping to the actual rule that produced the warning.

The overview tabs for packages, files, categories and types are equivalent, click on the thumbnails below to view a screenshot of these tabs.

Package Overview	Files Overview
Category Overview	Types Overview

Result Details

The details of the individual warnings are shown in the remaining tabs. In the Details tab you will see all warnings of the current selection (e.g., a given package) printed one after another. For each warning you will see the warning message and a detailed description (with example) of the static analysis tool. If you are viewing the results of the current build then the file names are hyperlinks: clicking on the file name will open the actual source code with the selected warning highlighted.

The detail tabs in the other plug-ins are equivalent, click on the thumbnails below to view a screenshot of these tabs.

Checkstyle	PMD
Warnings	Dry

Besides this details tab there are additional tabs that show the details for a filtered sub-set of the warnings or tasks. I.e., the tabs high, normal, and low show the details of the selected severity, while the tabs new and fixed show warnings in the current build that are new or fixed, respectively.

Finally, the tab Warnings shows a sortable table of all warnings. Here you can sort the warnings by all available attributes to decide which warnings should be looked at in more detail. The warning message and description is shown when hoovering over the cell content.

Source Code Visualization

The actual warning is visualized in the source code view (with syntax highlighting).  Some warnings have several source code markers attached. In this case, the primary range of the warnings is colored with orange, the remaining ranges are colored with yellow. When hoovering over a colored warning annotation, then the warning message and detailed description is shown in a tool tip.

Remote API

All plug-ins also do have a remote API to obtain information on the quality of the current build. You can use the following commands, the variable [Plugin-URL] needs to be replaced with the URL of the plug-in, e.g., checkstyle, findbugs, tasks, etc. :

• ...job/[Job-Name]/[Build-Number]/[Plugin-URL]Result/api/xml?depth=0 will return only the build results:

<analysisResult>
  <newZeroWarningsHighScore>false</newZeroWarningsHighScore>
  <numberOfFixedWarnings>40</numberOfFixedWarnings>
  <numberOfNewWarnings>40</numberOfNewWarnings>
  <numberOfWarnings>95</numberOfWarnings>
  <warningsDelta>0</warningsDelta>
  <zeroWarningsHighScore>0</zeroWarningsHighScore>
  <zeroWarningsSinceBuild>0</zeroWarningsSinceBuild>
  <zeroWarningsSinceDate>0</zeroWarningsSinceDate>
</analysisResult>

• ...job/[Job-Name]/[Build-Number]/[Plugin-URL]Result/api/xml?depth=1 will additionally return the current (and new) warnings:

<analysisResult>
  <newZeroWarningsHighScore>false</newZeroWarningsHighScore>
  <numberOfFixedWarnings>40</numberOfFixedWarnings>
  <numberOfNewWarnings>40</numberOfNewWarnings>
  <numberOfWarnings>95</numberOfWarnings>
  <warning>
    <fileName>checkstyle/src/main/java/hudson/plugins/checkstyle/CheckStyleResult.java
    </fileName>
    <message>The String literal "</li>" appears 5 times in this
      file; the first occurrence is on line 62.</message>
    <primaryLineNumber>62</primaryLineNumber>
    <priority>NORMAL</priority>
  </warning>
  <warningsDelta>0</warningsDelta>
  <zeroWarningsHighScore>0</zeroWarningsHighScore>
  <zeroWarningsSinceBuild>0</zeroWarningsSinceBuild>
  <zeroWarningsSinceDate>0</zeroWarningsSinceDate>
</analysisResult>

Maven Notes

These plug-ins normally get built in the site phase, not in the 'normal' package phase. The hudson configuration help for the plugin specifies which goal you'll have to add to your maven build options a bit further up on the same page.