codacy / codacy-sonar-csharp

Docker engine for SonarC# code analyzer

Codacy SonarC#

This is the docker engine we use at Codacy to run SonarC# developed by SonarSource.

You can also create a docker to integrate the tool and language of your choice! Check the Docs section for more information.

Local Development

Requirements:

• unzip
• xmllint
  • on ubuntu: apt-get install libxml2-utils
  • on alpine: apk add libxml2-utils
• dotnet-sdk-6.0 - "The .NET Core SDK"
  • on archlinux: the above package also installs dotnet-runtime, dotnet-host and dotnet-targeting-pack) - the .NET Core SDK

IDE

This seems to be more or less working in vscode, install the "C# for Visual Studio Code (powered by OmniSharp)" extension and before opening the project in it do make configure.

Commands

• make configure - runs dotnet restore which downloads all the required libraries for the projects to work.
• make build - compiles the Analyzer project.
• make build-docs - compiles the DocsGenerator project.
• make build-all - compiles both the Analyzer and DocsGenerator projects.
• make documentation - downloads upstream rules for the sonar version we defined in Analyzer.csproj, extracts the rules for that version and runs the DocsGenerator application.

See other useful targets inside the Makefile.

Usage

Publish the docker image locally

docker build -t codacy-sonar-csharp:local .

Run the docker locally

docker run --user=docker --rm -v <PATH-TO-CODE>:/src:ro -v <PATH-TO>/.codacyrc:/.codacyrc:ro codacy-sonar-csharp:local

Enter inside the docker image

docker run --user=docker --rm -v <PATH-TO-CODE>:/src:ro -v <PATH-TO>/.codacyrc:/.codacyrc:ro -it --entrypoint /bin/sh codacy-sonar-csharp:local

Make sure all the volumes mounted have the right permissions for user docker

Tool configuration file

Currently, to use your own configuration file, you must add a SonarLint.xml xml file with an AnalysisInput structure inside.

Example:

    <?xml version="1.0" encoding="UTF-8"?>
    <AnalysisInput>
      <Rules>
        <Rule>
          <Key>S103</Key>
          <Parameters>
            <Parameter>
              <Key>maximumLineLength</Key>  
              <Value>24</Value>  
            </Parameter>
          </Parameters>
        </Rule>
      </Rules>
    </AnalysisInput>

Docs

Tool Developer Guide

Tool Developer Guide - Using Scala

Test

We use the codacy-plugins-test to test our external tools integration. You can follow the instructions there to make sure your tool is working as expected.

What is Codacy?

Codacy is an Automated Code Review Tool that monitors your technical debt, helps you improve your code quality, teaches best practices to your developers, and helps you save time in Code Reviews.

Among Codacy’s features:

• Identify new Static Analysis issues
• Commit and Pull Request Analysis with GitHub, BitBucket/Stash, GitLab (and also direct git repositories)
• Auto-comments on Commits and Pull Requests
• Integrations with Slack, HipChat, Jira, YouTrack
• Track issues in Code Style, Security, Error Proneness, Performance, Unused Code and other categories

Codacy also helps keep track of Code Coverage, Code Duplication, and Code Complexity.

Codacy supports PHP, Python, Ruby, Java, JavaScript, and Scala, among others.

Free for Open Source

Codacy is free for Open Source projects.

codacy-sonar-csharp's Issues

Wrong error reported - Remove this unnecessary 'using'.

Sonar C# is asking to remove the using statement but it's required for System.Uri

using System;

namespace Users
{
    public class UserRecord
    {
        public UserRecord(
            string authId,
            string email,
            string displayName,
            **Uri** photoUrl,
            CustomClaims customClaims,
            bool isDisabled)
        {
            AuthId = authId;
            Email = email;
            DisplayName = displayName;
            PhotoUrl = photoUrl;
            CustomClaims = customClaims;
            IsDisabled = isDisabled;
        }

        public string AuthId { get; }
        public string Email { get; }
        public string DisplayName { get; }
        public **_Uri_** PhotoUrl { get; }
        public CustomClaims CustomClaims { get; }
        public bool IsDisabled { get; }
    }
}

Update tool to 8.0

[TS-372] Builds with SonarAnalyzer.CSharp later than v8.40 is failing

CodacyCSharp.Analyzer.Utilities.RuleFinder is using some functionality in SonarAnalyzer.Common.AnalyzerLanguage that were removed in SonarSource/sonar-dotnet#5662.

We are currently seeing multiple issues being reported in our code, caused by bugs in SonarAnalyzer.CSharp that has already been fixed in newer versions.

Upgrade Sonar C# to 7

Currently the engine is on 5.x which lacks support for C# 7.0. Support was introduced starting Sonar 7.5.

Update Sonar C# to version 7

Use `using` keyword to delete resources

As referred here: codacy/codacy-tsqllint#1 (comment)

Add security sub-category to patterns.json

We want to start identifying security issue categories, therefore we should include this in the patterns.json file.

[CY-6598] Feature/Question Support for roslyn analyser

Not sure if this is the correct place, but as it's csharp related I opted to create it here.

Later releases of the .NET SDK ships with a integrated codeanalyser, roslyn.

From https://learn.microsoft.com/en-us/visualstudio/code-quality/install-net-analyzers?view=vs-2022

NET compiler platform (Roslyn) analyzers inspect your C# or Visual Basic code for code quality and code style issues. The first-party .NET analyzers are target-platform agnostic.

Is there any feature requests/work currently in adding support for the roslyn analyser in codacy?

Adjustments to make tool upgradable by dependabot

Currently the tool has versions coded in a nonstandard way.
It has in:

• In a .SONAR_VERSION
• Hardcoded in a path

The version should be instead in one single place (the csproj file)

Can't change the parameters on the UI and bad behavior about config file

Temporary config file should be with the same name, otherwise parameters don't work.

Also, the logic about the config file is not working properly. When patterns exists on .codacyrc, should ignore tool config file, except if the user request it.

[CY-2520] File by file testing creates incorrect warnings.

An interface is defined in a separte file. A unittest has a mocked implementation of that interface, with parts of the mock throwing a NotImplementedException.

Using codacy, sonar warns S1144 (remove unused member) and S2325 (make implementation static) for the not implemented members. Both are false positives as the member must be there and it cannot be static.

The warning doesn't occur with the sonar plugin for visual studio.

I've tracked that down to the fact, that codacy-sonar-csharp creates a new solution for each file, so effectively it's a file by file and not a solution wide analysis. As the interface definition is not present, the sonar analyzer treats the interface as empty and then the reported error makes sense.

The false positive in my solution

See also my original issue on sonar-dotnet, which is already closed.

False positives on make Method static rule

I just added codacy to one of my .NET projects and it's really awesome. It provides a lot of useful information, however after running the analysis I get a lot of false positive issues on the make Method a static method rule. There are two scenarios I see issues for this rule that don't make sense. The first one is classes that implement an interface. Interface implementations must be instance methods, so this rule should not apply to those methods. Secondly, I have hundreds of these issues in my test projects. Test methods must be instance methods for the test framework to run them, so this rule should not apply to test methods.

I can deal with the false positives on interface implementations, but getting having to deal with the test issues becomes unwieldy and floods my codacy dashboard with noise, making it not very useful. Is there a way to disable a specific rule for a project for a filename pattern?

Update SonarC# to 8.3

Add security subcategories

Bad behavior with configuration file

The configuration file is running with all available patterns instead of the specified due to reading it in the wrong path.

Update patterns/docs

It looks like this project is missing a massive number of sonar patterns. I believe this could be fixed by simply running https://github.com/codacy/codacy-sonar-csharp/blob/f4aca01560f918c194c60e02fa70276264cd1b5a/scripts/update-docs.sh and updating the repository.

Update Sonar to 8.4

Update Sonar C# to 7.17

Support excluding single LOC from codacy analysis

Not sure whether it's the right place to report it, I tried below keywords without luck.
// NOSONAR
// eslint-disable-line no-eval

Add documentation about config file format

Make sure it's clear the configuration files we support for this tool (AnalysisInput and not RuleSet structures)