Is SonarQube Replacement for Checkstyle, PMD, FindBugs?

112
votes

We are working on a web project from scratch and are looking at the following static code analysis tools.

  • Conventions (Checkstyle)
  • Bad practices (PMD)
  • Potential bugs (FindBugs)

The project is built on Maven. Instead of using multiple tools for the purpose, I was looking at a single flexible solution and came across SonarQube.

Is it true that we can achieve the results from Checkstyle, PMD and Findbugs with SonarQube?

8
sonarqubestatic-analysischeckstylefindbugspmd

8 Answers

105
votes

Sonar will run CheckStyle, FindBugs and PMD, as well as a few other "plugins" such as Cobertura (code coverage) by default for Java projects. The main added value, however, is that it stores the history in a database. You can then see the trend. Are you improving the code base or are you doing the opposite? Only a tool with memory can tell you that.

You should run Sonar in your CI system so that even things that take some time to execute (such as CPD – copy paste detector) can run. And you'll have your history. Whereas with an Eclipse plugin, for example, you'll detect violations sooner – which is great – but you will be tempted to run it less often if it starts taking too long, or run less "quality plugins" (such as skipping CPD or skipping code coverage analysis). And you won't have history.

Also, Sonar generates visual reports, "Dashboard" style. Which makes it very easy to grasp. With Sonar in Jenkins, you'll be able to show developers and your management the effects of the work that was performed on the quality of the code base over the last few weeks and months.

49
votes

Sonar uses these 3 tools as plugins and aggregates the data from all three giving addition value by showing graphs and such from these tools. So they are complementary to sonar.

35
votes

Yes and no. In addition to the other answers.

SonarQube is currently on the way to deprecate PMD, Checkstyle and Findbugs and use their own technology to analyze Java code (called SonarJava). They do it, because they don't want to spend their time fixing, upgrading (or waiting on it) those libraries (e.g. for Java 8), which for example uses outdated libraries.

They also got a new set of plugins for your personal IDE called SonarLint.

8
votes

Sonar is great, but if you want to use the mentioned tools separately and still have nice graphs, you can use the Analysis Collector Plugin as part of your Jenkins CI build. A slight advantage of this is that you can check in your PMD/Findbugs/Checkstyle configuration into your SCM and have it integrated into your Maven build, rather than relying on a separate Sonar server.

5
votes

Sonar is much more than these tools alone. The greatest benefits is the gui, which lets you configure anything easily. The statistics it offers are very detailed (lines of code etc). And it even offers great support for test coverage etc :)

Here you can take a good look: http://nemo.sonarsource.org/

4
votes

... a few years later: no, it is not! SonarQube supposes to be able to cover all the rules with its own analyzer, but there are still rules from PMD or CheckStyle not covered by SonarQube. See for example: PMD ReturnFromFinallyBlock.

3
votes

I would still use these tools in addition to sonar because they can fail the maven build when someone violates a rule. Where as sonar is more retrospective.

2
votes

Well at least since SonarQube 6.3+ it seems to be that Findbugs is (at the moment) no longer supported as a plugin. Sonarsource is working on replacements of Findbugs-rules with its own Java-plugin.

They even have a list for the replacement status of each rule here: http://dist.sonarsource.com/reports/coverage/findbugs.html