Sonar...Qube, the story of a little code analyzer that grows up
summary
History and evolution of SonarQube from its 2009 start to renaming in 2013 and additions like SonarLint (2015), SonarCloud (2017) and a security analysis engine (2018) that shaped the 8.9 LTS. Describes the analysis pipeline: tokenization, AST and semantic resolution, then control-flow graph and dataflow taint-tracing to find vulnerability chains; the heavy security engine runs server-side while SonarLint applies the same rules locally. Notes current product scope: about 27 languages supported, official Docker images, and quick fixes available for roughly 40 Java rules.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 0:38Once upon a time...
- 1:00A little pitch?
- 1:35In the beginning was Sonar...
- 2:44Sonar, the platform
- 3:04The limits
- 3:28The future?
- 4:09Do it ourselves
- 4:50Cleaning on the fly
- 5:42Clean as you code
- 7:25Click, click, click...
- 8:16Evolution. And...
- 8:28But that was before
- 8:44.. And a newborn
- 9:45.. The family grows
- 10:51SonarQube... Family photo 2018
- 11:04SonarSource in Geneva, 2018
- 11:33SonarSource ATX, 2018
- 12:212018, it was also...
- 12:38Security!!!
- 13:19Lexical analysis
- 14:02Syntax analysis
- 14:46Semantic analysis
- 15:22Data flow analysis
- 16:09Taint analysis
- 17:27Does it tempt you?
- 17:43Baby steps
- 19:38Sonar... Cloud?
- 20:22Sonar... Lint?
- 22:32And after?
- 23:07SonarSource in 2021
- 23:34Smarter Together
related talks
46mIn search of Clean Code with Sonar, 20,000 leagues under an ocean of code!
20mHow to Manage Software Architecture with SonarQube
48mComprehensive Use of Analyzers to Improve Code Quality
14mWhich Code Issues Actually Matter? | Prioritizing SonarQube Findings
37mSonarSource: The Power of Clean Code
22mHow Freshworks Scales Shift-Left Security with SonarQube
14mAnalyze your code with SonarLint for IntelliJ
54mA Shock to the System Static Analysis for Real AppSec