9

I have a GitHub project integrated with Travis.

Every time a commit is pushed, Travis tries to compile, and warn if it does not compile.

To take it further, I would like to integrate with a tool for static code analysis:

  • Find duplicate code
  • Find common probable bugs (recognizes the technology automatically, at least: Android, Java, C#)
  • Find package dependency cycles
  • Bonus: Run applicable off-the-shelf validation tools, for instance Lint for Android

Requirements:

  • Run analysis at every commit or at least on a regular basis
  • Free
  • Preferably a free (or free for open source projects) online service, installable (on-premise) if nothing else available.
  • Ideally, it would only require entering a Git URL.
Improve this question
0

4 Answers 4

Reset to default
6

I think SonarQube suits your needs, We use it exactly the same way you want but with jenkins and for java-based code(supports multiple languages though, no need to worry).
E.g. pushed a commit -> Jenkins builds and deploys -> updates SonarQube which gives online statistics. I imagine setting SonarQube with Travis wouldn't be too much trouble since it provides a lot of plugins for that reason.

UPDATE: Some plugins and general information for getting started with Jenkins and Sonarqube:

  • Here is the plugin for Jenkins+Github
  • Here is the plugin for Jenkins+SonarQube
  • Here is a link with further information about configuration of Jenkins+SonarQube
Improve this answer
5
  • So setting up this requires to install Jenkins and SonarQube, the <a href="wiki.jenkins-ci.org/display/JENKINS/… Github and Jenkins</a>, then <a href="docs.codehaus.org/display/SONAR/… Jenkins and SonarQube</a>, right?
    – Nicolas Raoul ♦
    Apr 3, 2014 at 7:50
  • Yes Jenkins has this plugin for that reason. I haven't setted up myself but found many resources in a google search to get started. For github Jenkins offers(what a surprise) another plugin.
    – dimzak
    Apr 3, 2014 at 7:58
  • 1
    @NicolasRaoul If you managed to get it working on Travis CI, then I would be interested to hear so. My main problem is how to publish the information somewhere.
    – skiwi
    May 21, 2014 at 19:48
  • @skiwi I, too, would like to integrate SonarQube with Travis CI, and still didn't find any solution. I would be ok to move to another CI tool, but I don't want to host or pay for anything, so Travis was nice. Did you find anything in the end?
    – Joffrey
    Feb 21, 2016 at 9:10
  • @Joffrey No, I haven't looked further into this matter as far as I remember.
    – skiwi
    Feb 21, 2016 at 10:44
1

Coverity looks like what you want. I am starting to try it now for one of my projects but it seems promising.

Improve this answer
2
  • Welcome to Software Recommendations! This post does not contain enough information to be considered a high quality answer. Please read our discussion on what makes an answer high quality to see if you can incorporate some of these improvements into your answer, otherwise it will be removed. Like does it match all or just some of Nicolas's requirements?
    – Nick Dickinson-Wilde
    Jun 20, 2014 at 6:40
  • I looked into Coverity, but my main problem is that it cannot be triggered on pull-requests, which is a no-go for me. Also, I didn't find any way of customizing the rules for the scan, but maybe I just didn't dig enough.
    – Joffrey
    Feb 21, 2016 at 10:47
1

I made Gradle and Maven plugins for that. It currently supports Findbugs, PMD, Checkstyle, CSSLint and JSHint, but support for more are planned. The result may look something like this:

Pull request in GitHub with static code analysis

Improve this answer
3
1

For languages compiled by GCC (i.e. C++, C, Ada, Fortran, Go, D, ....) you could consider using a specialized MELT extension. (you'll probably need to code some MELT, depending on the analysis you want to do).

For C, you might also consider Frama C or Clang

Improve this answer
1
  • The main requirement is "integrated with Github". Ideally, it would only require entering a hook address and maybe accepting an OAuth authentication.
    – Nicolas Raoul ♦
    Apr 4, 2014 at 5:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.