3
votes
2answers
129 views

Checking program robustness using static code analysis

(Building on this question) If you have a static code analyser such as Checkstyle, is it possible to to relate any of the stuff that it checks for to actual robustness? Some of the things that ...
4
votes
3answers
173 views

Codebase Analysis of Trends over Time

I've looked around for a solution (preferably not hosted, something I can run locally) to do static analysis of a codebase over time for things like SLOC, Complexity, authors, commits, etc. It has to ...
2
votes
1answer
879 views

Static code analysis for bash scripts

I program CLI utilities in bash to automate much of my work as a DBA. I would like improve my code and make it more robus,t maybe with the help of some static code analysis tool like the one I used ...
3
votes
2answers
169 views

Strategies for using a code metric evaluation tool

Should code quality metric evaluation tools like Sonar be integrated with IDE for running local analysis or should they be a part of the build process (like integrated with maven) for continuous ...
2
votes
5answers
1k views

Is automatically checking code quality via metrics possible?

For several years now I am a big fan of using static code analysis tools for checking the source code quality. We are mostly doing C# development so NDepend was the best way to go for me. Most of the ...
5
votes
3answers
633 views

Handling false positives and legacy code warnings in static-analysis of C++ code? [closed]

We have a large "legacy" C++ code base on which no static analysis is run at the moment. Every now and then, we are thinking about at least using cppcheck, maybe via Visual Lint. (I've also briefly ...
17
votes
6answers
983 views

Any success stories continuously using commercial static analysis tools for C++? [closed]

I can't decide whether an offer of a commercial static analysis tool is worth spending the resources. We tried the tool on several million lines of our C++ code and it found something like 50 real ...
14
votes
7answers
5k views

What are the real benefits of static code analysis?

Tools like pc-lint or QAC can be used to perform static code analysis on a code base. In my experience the static analysis often yields a huge amount of noise, i.e. warnings on things that are not ...