Beneficial static analysis starter tool
Use Cases and Deployment Scope
I embedded it in my Azure Devops pipelines to scan the code for any existing bugs before generating the build. I used the Yaml code editor and classic build editor to use it as a task in the azure pipeline jobs for asp .net web application that was on the azure web app for windows and iis for on premises
Pros
- Scan the code for existing bugs present
- It can detect an vulnerabilities and also show possible bad warnings
- Can help identify errors in advance to avoid code crash post deployment
Cons
- It’s documentation is not always up to date
- Difficulty in finding a prper solution when an issue arises during its configuration
- has limited features
Most Important Features
- Its ability to detect code vulnerabilities
- For testing team to spot any bugs when doing regression testing
- Devops plugin to use it before generating the build artifacts
Return on Investment
- Its being used overall by most of the teams
- Some of the teams migrating to another testing tool as it has limited features
- Still recommend as its open source and beginners friendly
Alternatives Considered
SonarCloud
Other Software Used
SonarCloud, SonarQube, Visual Studio Test Professional