BMC AMI DevX vs. SonarQube Server

I love these tools! However, my company has not yet transitioned from SCLM to a modern repository, and this is causing most of our developers to remain within TSO for all their development. It's been a slow adoption up to this point, but we are moving toward more modernization this year and next, so with any luck, we'll see usage pick up. Success depends on the speed at which your management is willing to move.

Incentivized

Scenarios where SonarQube is well suited:

1. Large codebase: The tool's static analysis capabilities can help teams quickly identify and fix bugs, vulnerabilities, and code smells in large codebases.
2. Compliance and security: The tool can check the code against industry standards or regulations, such as OWASP and CWE, and identify any issues that need to be addressed.
3. Agile development: SonarQube can be integrated with CI/CD pipelines allowing teams to continuously monitor and improve code quality throughout the development process.
4. Teams using multiple languages: Teams that use multiple programming languages can benefit from using SonarQube, as the tool supports a wide range of languages and can be integrated with a variety of development tools.

Scenarios where SonarQube may be less appropriate:

1. Small codebase: Organizations with a small codebase may not see the full benefits of using SonarQube, as the tool's static analysis capabilities may be overkill for a smaller codebase.
2. Limited resources: Organizations with limited resources may find it difficult to set up and configure SonarQube, as the tool can be complex and may require specialized expertise.
3. Limited integration: Organizations that use development tools or IDEs that are not supported by SonarQube may find it difficult to integrate the tool into their existing development workflow.
4. Limited scalability: Large organizations with millions of lines of code may find SonarQube's performance and scalability to be an issue. It may take longer for the analysis to finish and the results may not be as accurate.

Incentivized

• Code Pipeline: integration of MF and non-MF type of object (COBOL, Java, zosconnect...). Deployment of objects coming from inside and outside the mainframe in the same way.
• Workbench for Eclipse: a must-have for working with Code Pipeline and the mainframe in the development context.
• Workbench for VS Code: They started developing VSCode, and the plugin works very well. There are a lot of things to add, but it's still very good. Young developers like it!

Incentivized

• Generating code quality report
• Calculates junit coverage of the codebase very efficiently and precisely
• Highlights the bugs and vulnerabilities in our codebase
• Informs the user of the improvements which can be done to the code to make it cleaner
• SonarQube also suggests remediation and resolution of the problems it highlights

Incentivized

• Download source code plug-in on Azure DevOps to allow downloading prod version even if it's not in the assignment.
• Publishing Test Results on Azure DevOps from Total Test plugin
• Integration with DevEnterprise in Workbench and GenAI capabilities for enhance code analysis (Accross multiple programs/applications)

Incentivized

• It doesn't provide automatic pull request with fixes
• It doesn't provide insights about the libraries of the projects
• The administration management user interface could be simplified
• It doesn't provide an order to fix issues, like archives with more and frequent commits have top priority

Incentivized

It can improve in some user experience and usability parts, like the code view and the way we assign issues it's a bit hidden and not highlighted

Incentivized

Support has been amazing compared to Optim. Further, new features are very regular with File-AID - I can't remember the last time Optim had a significant update. File-AID support is very receptive to feature requests and reported bugs, including sending out hotfixes quickly.

Incentivized

We we easily able to integrate the SonarQube steps into our TFS process via the Microsoft Marektplace, we didn't have the need to call SonarQube support. We've used their online documentation and community forum if we ran into any issues.

Incentivized

The names may have changed over the years, but anyone who has been around for a while will recognize them. For Software Configuration Management, I have used TSO/ISPF/SCLM, Panvalet, ChangeMan, Librarian, Endevor, and now Code Pipeline. All of them met the basic requirements. All of them had their advantages and disadvantages. Code Pipeline, however, stands head and shoulders above the rest in simplicity, completeness, effectiveness, efficiency, and elegance.

Incentivized

SonarQube identifies significant more thing compared to the built-in suggestions in IntelliJ IDEA. The suggestions how to correct issues are also a lot better with SonarQube. IntelliJ IDEA provides great refactoring support to make it easy to refactor the code to solve issues. We use these tools together and they really complement each other.

Incentivized

• I can debug (expeditor) much faster and more efficiently. In fact, I was asked yesterday to run their job through Workbench Expeditor. I can also view data movement much better.
• Code analysis lets me give a quicker explanation of what a program may do, as it provides a graphical interface showing processing and data movement.

Incentivized

• Positive ROI from the standpoint of flagging several issues that would have otherwise likely been unaddressed and caused more time to be spent closer to launch
• Slightly positive ROI from time-saving perspective (it's an automated check which is nice, but depending on the issues it finds, can take developers time to investigate and resolve)