[CASSANDRA-18390] Run Sonar analyzer over the Cassandra project

• Type: Task
• Status: Patch Available
• Priority: Normal
• Resolution: Unresolved
• Component/s: Build
• Epic Link: Code Style & Static Analysis
• Change Category: Code Clarity
• Complexity: Normal
• Platform: All

Test and Documentation Plan

To test - run SonarQube using the docker image, generate a token in the UI, and update sonar-project.properties to appropriate variables. Run:
ant sonar -Dsonar.login=your_token
https://docs.sonarqube.org/9.6/try-out-sonarqube/
Alternatively, the act can be used to check the GA.

• Assignee: Maxim Muzafarov
• Reporter: Maxim Muzafarov

Authors

Maxim Muzafarov

• Created: 29/Mar/23 17:19
• Updated: 11/Apr/23 16:40

Description

As we already have Cassandra's project configured for the sonarcloud.io INFRA-24196, I wonder if we will be able to release branches, trunk, and pull requests to get analyzed by the SonarAnalyzer tool.

Sonar is a code quality and security tool that is free to open-source projects and recommended by the INFRA team:
https://cwiki.apache.org/confluence/display/INFRA/SonarCloud+for+ASF+projects

It can have the following benefits without introducing any drawbacks (except for a few lines of source code)

• visualise the LFH problems to work on;
• see the trends in the source code;
• add an extra layer of static code analysis;

Changes below I have tested it locally with my SonarQube deployed on http://localhost:9000 and run the `act` for the GA part of the PR. It seems to work and parse classes correctly, but there are a few steps that need to be done by Cassandra's Committer or PMC (I do not have sufficient privileges):

• make sure that the SONARCLOUD_TOKEN is available for GA and enabled for the project;
• quality profile is configured for the project (the "Sonar way" seems to be heavy to run);

Issue Links

• relates to: CASSANDRA-18239 Replace eclipse warnings based static code analysis with something better (CheckerFramework)
• links to: GitHub PullRequest: 2252