Search code examples
javasonarqubestatic-code-analysis

in SonarQube, why 'Sonar way' quality profile doesn't contain all the rules from SonarJava repository

My company is using SonarQube for quite some time, and now that we installed latest SonarQube verzion 6.4, we would like to upgrade quality profiles that we are using.

As far as I can understand there is no need to use FindBugs, PMD and Checkstyle plugins any more because rules from SonarJava plugin contain all rules from other plugins.

I wanted to use 'Sonar way' built-in profile but I noticed that it only contains subset of all the rules in SonarJava repository. There are 292 rules in Sonar way and 427 in SonarJava rule repository. I noticed a bunch of important rules missing from 'Sonar way'.

Questions are:

  1. Why doesn't 'Sonar way' contain all SonarJava rules.
  2. Is there some drawback in creating a profile that contains all rules from SonarJava repository, and using this profile?
Solution

  • Why doesn't 'Sonar way' contain all SonarJava rules.

    Because some of the rules are:

    • too restrictive - not suited for many types of applications and should be enabled after some discussions in teams
    • mutually exclusive (example: RSPEC-1105 says that opening { character should be at the same line and RSPEC-1106 that should be at a new line)
    • they only apply if certain technologies are used (JAVA 8, Spring framework, jUnit framework etc.)

    Those a few reasons why Sonar way contains part of the rules, not all. It causes that more people can use the default set of rules without being frustrated.

    Is there some drawback in creating a profile that contains all rules from SonarJava repository, and using this profile?

    You can create a new Quality Profile and enable all rules using bulk operation. Read more: https://docs.sonarqube.org/latest/instance-administration/quality-profiles/