mikerowecode

What is static analysis?

Simply, it’s a tool that analyses your code “at rest”. That is, it inspects the source code (or in some cases object code) statically, not in a running environment. (Dynamic analysis of running systems, such as with memory profilers like yourkit and valgrind, is a whole other topic.)

So what is it good for?

Early warning of problemsBy scanning the daily report for issues in recently introduced code, tech leads and senior developers can talk with the developers involved.

What is it NOT good for?

Gating check-ins/failing buildsThis usually just leads to “gaming the system” or poor refactoring to “get around” the rules, which helps no one. Static analyses are information that needs to be intrepeted by people, not an automatic way to prevent bad code being committed.Measuring developers’ performanceHopefully I don’t need to explain why this is a terrible idea.

How should I use my analysis tools?

Daily report to tech lead - new issuesTech leads can review a daily report as a starting point for conversations with developers. E.g. “I see you commited this method with a lot of nested ifs.. have you considered doing it this way instead?”High level graphs over time - complexity, etc.Dashboard of health.

So what’s the point?

Just this:Your project’s build system has the responsibilty to install any library that is required to support your code.Hopefully most of these will be taken care of by your dependency management system.