Make your CI/CD pipeline smarter with static analysis

Tibor Blenici has been with the company since 2016 as a languages developer, primarily working on the Java Analyzer and JavaScript, with JavaScript being his main area of expertise.

Tibor Blenici's presentation focuses on smarter CI (continuous integration) / CD (continuous delivery) pipeline with static analysis, discussing the types of bugs that can be caught with static analysis and demonstrating integration with CI/CD pipelines.

Sonar Cloud is a software as a service platform that allows for static analysis of projects. Users can log in through GitHub, BitBucket, GitLab, or Azure DevOps, and analyze projects by setting them up and linking them to a GitHub repository.

Tibor discusses various levels of static analysis including syntax level analysis using Abstract Syntax Trees, semantic analysis understanding code meaning, control flow analysis to ensure all code is reachable, and cross-procedural analysis to check function calls.

Static analysis tools can be integrated into Visual Studio Code using extensions like SonarLint, which provides on-the-fly feedback on code quality and potential bugs directly in the editor.

The rules.sonarsource.com website acts as a database for all the different static analysis rules across various languages, offering descriptions and details on each rule to help developers understand and apply them effectively.