sonar android上的实践

1.2 下载好sonarqube后，解压打开bin目录，启动相应OS目录下的StartSonar，本方案系统是windows 所以启动位置在E:\sonarqube-7.5\bin\windows-x86-64\StartSonar 启动完成之后可以直接访问http://localhost:9000 或者http://127.0.0.1:9000 ，以管理员身份登录可以安装中文插件，以及其他代码扫描插件

1.3 配置

1.3.1 MySql 配置

由于sonarqube依赖MySql,所以需要安装MySql，安装教程

1.3.2 sonar配置MySql,找到E:\sonarqube-7.5\conf\sonar.properties 添加MySql配置

# User credentials.
# Permissions to create tables, indices and triggers must be granted to JDBC user.
# The schema must be created first.
#sonar.jdbc.username=
#sonar.jdbc.password=
sonar.jdbc.url=jdbc:mysql://127.0.0.1:3306/qjfsonar?useUnicode=true&characterEncoding=utf8&rewriteBatchedStatements=true&useConfigs=maxPerformance
sonar.jdbc.username=root
sonar.jdbc.password=root
sonar.sorceEncoding=UTF-8
//安装mysql是设置账户和密码
sonar.login=admin
sonar.password=admin

复制代码

重启sonarqube服务，再次访问http://localhost:9000，会稍微有点慢，因为要初始化数据库信息，至此便可以在sonar上面安装插件了

接下来可以安装中文插件，直接在配置->应用市场->搜索Chinese Pack然后安装重启就可以了

2.利用sonar分析android项目

方式一：利用sonar-scanner分析项目

先现在sonar-scanner,下载地址 下载之后编辑E:\sonar-scanner-3.2.0.1227-windows\conf\sonar-scanner.properties

#Configure here general information about the environment, such as SonarQube server connection details for example
#No information about specific project should appear here

#----- Default SonarQube server
sonar.host.url=http://localhost:9000

#----- Default source code encoding
#sonar.sourceEncoding=UTF-8
sonar.jdbc.url=jdbc:mysql://127.0.0.1:3306/qjfsonar?useUnicode=true&characterEncoding=utf8&rewriteBatchedStatements=true&useConfigs=maxPerformance
sonar.jdbc.username=root
sonar.jdbc.password=root
复制代码

然后在想要分析的android根目录下创建一个sonar-project.properties，内容如下

#Configure here general information about the environment, such as SonarQube server connection details for example
#No information about specific project should appear here

#----- Default SonarQube server
#sonar.host.url=http://localhost:9000

#----- Default source code encoding
#sonar.sourceEncoding=UTF-8


# must be unique in a given SonarQube instance
sonar.projectKey=StickyNavLayout-demo
# this is the name displayed in the SonarQube UI
sonar.projectName=StickyNavLayout-demo
sonar.projectVersion=7.5
 
# Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows.
# Since SonarQube 4.2, this property is optional if sonar.modules is set. 
# If not set, SonarQube starts looking for source code from the directory containing 
# the sonar-project.properties file.
sonar.sources=E:\workplace\github\StickyNavLayout-demo\app\src
 
# Encoding of the source code. Default is default system encoding
#sonar.sourceEncoding=UTF-8
复制代码

然后在项目根目录下执行sonar-scanner 进行分析

方式二：Gradle配置（推荐）

做android开发的话，平时都在androidStudio上开发，如果按照方式一的话，每次新项目都要去创建文件，这样不是很方便，androidStudio gradle已经为我们添加好sonar-scaner，可以通过下面方式进行配置

根build.gradle配置

apply from: "dependencies.gradle"
apply plugin: 'com.alibaba.arouter'
buildscript {
    ext.kotlin_version = '1.2.30'
    repositories {
        maven { url "http://nexus.zhenai.com/content/repositories/jcenter/" }
        
        #1 配置maven创库
        maven {
            url "https://plugins.gradle.org/m2/"
        }
        
        google()
        jcenter()
    }
    dependencies {
        #2 配置 classpath
        classpath "org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:2.6.2"
        classpath 'com.android.tools.build:gradle:3.1.2'
        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
        classpath 'org.greenrobot:greendao-gradle-plugin:3.2.2'
        classpath "com.alibaba:arouter-register:1.0.0"
//        classpath "com.mob.sdk:MobSDK:+"
        classpath 'com.growingio.android:vds-gradle-plugin:2.4.3'
        //用于方便调试性能问题的打印插件。给访法加上@DebugLog，就能输出该方法的调用参数，以及执行时间
        classpath 'com.jakewharton.hugo:hugo-plugin:1.2.1'
        // NOTE: Do not place your application dependencies here; they belong
        // in the individual module build.gradle files

    }
}

#3配置plugin
apply plugin: "org.sonarqube"

#4配置task
sonarqube {
    properties {
        property "sonar.sourceEncoding", "UTF-8"
    }

}

#4配置sonarqube参数
subprojects {
    apply plugin: 'eclipse'
    apply plugin: 'idea'

    repositories {
        mavenCentral()
        jcenter()
    }

    sonarqube {
        properties {
            property "sonar.sources", "src"
            property "sonar.java.binaries", "build/intermediates/javac"
            property "sonar.host.url", "http://http://10.1.3.40:9000/"
            property "sonar.login", "admin"
            property "sonar.password", "admin"
            property "sonar.jdbc.url", "jdbc:mysql://http://10.1.3.40:3306/qjfsonar?useUnicode=true&characterEncoding=utf8&rewriteBatchedStatements=true&useConfigs=maxPerformance"
            property "sonar.jdbc.driverClassName", "com.mysql.jdbc.Driver"
            property "sonar.jdbc.username", "root"
            property "sonar.jdbc.password", "root"
        }

    }
}

allprojects {
    repositories {
        flatDir {
            dirs project(':app').file('libs')
            dirs project(':lib_live_agora').file('libs')
        }
        maven { url "http://nexus.zhenai.com/content/repositories/jcenter/" }
        maven { url "http://nexus.zhenai.com/content/repositories/igexin/" }
        maven {
            //珍爱本地Maven仓库地址
            url "http://nexus.zhenai.com/content/repositories/android-release/"
        }
//        maven {
////            电脑本地Maven仓库地址
//            url uri('D:/AndroidStudio/LocalMaven')
//        }
        maven { url "http://mvn.mob.com/android" }
        google()
        jcenter()
    }
    configurations.all {
        resolutionStrategy {
            force "com.android.support:support-v4:${supportLib}"
            force "com.android.support:support-annotations:${supportLib}"
            force "com.android.support:appcompat-v7:${supportLib}"
            force "com.android.support:design:${supportLib}"
            force "com.android.support:recyclerview-v7:${supportLib}"
            force "com.android.support:cardview-v7:${supportLib}"
            force "com.android.support:design:${supportLib}"
            force "com.android.support:support-compat:${supportLib}"
            force "com.android.support:support-core-ui:${supportLib}"
            force "com.android.support:support-core-utils:${supportLib}"
            force "com.android.support:support-fragment:${supportLib}"
            force "com.android.support.constraint:constraint-layout:1.1.0"
        }
    }
}




task clean(type: Delete) {
    delete rootProject.buildDir
}

复制代码

按照1，2,3,4步骤配置完成之后，然后执行

gradle sonarqube
复制代码

方式三：jenkins + jenkins Sonar插件+sonar-scaner插件

首先jenkins上按照Sonar插件

3.jenkins配置

sonar.projectKey=zhenai_consultation
sonar.projectName=zhenai_consultation
sonar.projectVersion=1.0
sonar.sourceEncoding=UTF-8
 sonar.sources=app/src,album/src,base/src,cropview/src,im-business/src,lib_live_agora/src,lib_log/src,performancelib/src,push/src,refreshlibrary/src,xrecyclerview/src
sonar.java.binaries = app/build/intermediates/classes
 sonar.host.url=http://127.0.0.1:9000/
 sonar.login= admin
 sonar.password=admin
 sonar.jdbc.url=jdbc:mysql://127.0.0.1:3306/qjfsonar?useUnicode=true&characterEncoding=utf8&rewriteBatchedStatements=true&useConfigs=maxPerformance
 sonar.jdbc.driverClassName=com.mysql.jdbc.Driver
 sonar.jdbc.username=root
 sonar.jdbc.password=root
复制代码

Task to run :scan JDK:JDK_8 Analysis properties: sonar.projectKey=test sonar.projectName=test sonar.projectVersion=1.0 sonar.sourceEncoding=UTF-8 sonar.sources=app sonar.java.binaries = app/build/intermediates/classes sonar.host.url=http://127.0.0.1:9000/ sonar.login= admin sonar.password=admin sonar.jdbc.url=jdbc:mysql://127.0.0.1:3306/qjfsonar?useUnicode=true&characterEncoding=utf8&rewriteBatchedStatements=true&useConfigs=maxPerformance sonar.jdbc.driverClassName=com.mysql.jdbc.Driver sonar.jdbc.username=root sonar.jdbc.password=root Additional arguments:-X

4.android lint插件开发

我们知道，android 自带一个叫lint的检查工具，可以检查android相关无用资源，OverDraw等问题， github上也有一个现成的开源插件库 但是最新sonar7.5这个库已经不支持了，sonar7.5变更了很多， 所以自己研究开发了一个地址

5.java 自定义规则插件开发

目前 java 检查规则是基于pmd这个插件进行二次开发，pmd的原理网上也有很多资料介绍，总体是使用java cc 生成解析器来解析源代码并生成AST(抽象语法树)

6.kotlin 自定义规则插件开发

6.1 自带插件

目前sonar 已经支持非常多第三方代码检查插件，例如sonar java,pmd,findbugs等，如果业务需要可以自定义自己插件

6.2 自定义插件

1.androidLint 以前sonar6.5之前是有第三方androidlint,但是7.5以后，第三方库不更新了，只有自己开发了一个 github.com/dengqu/sona…

7 建议开启的规则

android lint: 1.NewApi 代码中使用的某些API高于Manifest中的Min SDK 2.Deprecated 使用已经废弃的API 3.PxUsage 避免使用px，使用dp 4.DrawAllocation 避免在绘制或者解析布局(draw/layout)时分配对象。E.g.,Ondraw()中实例化Paint对象。 5.Node can be replaced by a TextView with compound drawables 可优化的布局：如包含一个Imageview和一个TextView的线性布局，可被采用CompoundDrawable的TextView代替。 6.Overdraw: Painting regions more than once 如果为RootView指定一个背景Drawable，会先用Theme的背景绘制一遍，然后才用指定的背景，这就是所谓的“Overdraw”。 可以设置theme的background为null来避免。 7.Hardcoded text 8.HashMap can be replaced with SparseArray 9.Layout hierarchy is too deep 10.Layout has too many views Memory allocations within drawing code