5 ms·

We have a mandatory Sonar scan, and when I was hired, my tech lead proudly shown me the "A" grade they have been attributed, and said something like "we have a

by dgan 3y ago

We have a mandatory Sonar scan, and when I was hired, my tech lead proudly shown me the "A" grade they have been attributed, and said something like "we have a high standard to maintain" I have never seen such poorly written application in my 6 years of experience (and I am not only talking about style, stuff was absolutely utterly broken, while they had no clue what's wrong). I hate Sonar with passion. It only ever should be used to report vulnerabilities, not telling me to rename variables or that i "should refactor this code duplication!" I already have a fucking backlog with Jira tickets, don't tell what i am supposed or not to do, and when i am supposed to do it. But oh boy mangers love this stupid power burner

Klathmon 3y ago
I'm fighting against this now. We already use linters built and tuned by engineering, we have custom rules that solve real paint points and disabled everything that the team doesn't like or doesn't think provides value. Then management sweeps in and is trying to add sonar, and it's a nightmare. Besides tripling our total build time to run this horrible tool, they want us to waste time rewriting our codebase to follow these insane rules like "cognitive complexity", and editor integration that takes several seconds to update after every file change.
- stavros 3y ago
  I don't understand this. Why is management telling you what to do? In our company, the managers ask/push the teams to improve some metric, but the teams are responsible for the how. The metric is usually high-level, like "reduce the number of bugs reported", not "increase code coverage".
- therealdrag0 3y ago
  I think having cognitive complexity indicators are great. Many devs don’t think about that so having the visibility reminder is good on average. However it should not be blocking in any manner and it’s silly to drive a rewrite based on it. Engineering leaders should understand the architecture at a visceral level, know good patterns/design, and suggest refactors without static analysis tools.
  - dgan 3y ago
    "having them" is fine, being forced them down your throat is not. I mean like "your hotfix cannot be merged because you touched this piece of ancient code nobody understands and now it's complexity grew beyond the arbitrary threshold, please put all your tickets aside, and make a start refactoring this function because Sonar saud so"
    - therealdrag0 3y ago
      Totally agree! That sounds absurd.
CuriouslyC 3y ago
You wanna hear retarded? I worked at an org that used Snyk/Sonar, and would block PRs on failing quality gate score. The problem was that you couldn't see why you failed quality gate score in jenkins/github, only people with Sonar accounts could , so you had to find someone with a sonar account and get them to take a screenshot of the error before you could fix it.
arcbyte 3y ago
Sonar os actually an incredibly powerful tool for dev teams WHEN they know how to use it and configure it according to their agreed upon standards. When it's used thoughtlessly, as it often is, it's terrible.

by dgan 3y ago

Klathmon 3y ago

I'm fighting against this now. We already use linters built and tuned by engineering, we have custom rules that solve real paint points and disabled everything that the team doesn't like or doesn't think provides value. Then management sweeps in and is trying to add sonar, and it's a nightmare. Besides tripling our total build time to run this horrible tool, they want us to waste time rewriting our codebase to follow these insane rules like "cognitive complexity", and editor integration that takes several seconds to update after every file change.

stavros 3y ago
I don't understand this. Why is management telling you what to do? In our company, the managers ask/push the teams to improve some metric, but the teams are responsible for the how. The metric is usually high-level, like "reduce the number of bugs reported", not "increase code coverage".
therealdrag0 3y ago
I think having cognitive complexity indicators are great. Many devs don’t think about that so having the visibility reminder is good on average. However it should not be blocking in any manner and it’s silly to drive a rewrite based on it. Engineering leaders should understand the architecture at a visceral level, know good patterns/design, and suggest refactors without static analysis tools.
- dgan 3y ago
  "having them" is fine, being forced them down your throat is not. I mean like "your hotfix cannot be merged because you touched this piece of ancient code nobody understands and now it's complexity grew beyond the arbitrary threshold, please put all your tickets aside, and make a start refactoring this function because Sonar saud so"
  - therealdrag0 3y ago
    Totally agree! That sounds absurd.

CuriouslyC 3y ago

You wanna hear retarded? I worked at an org that used Snyk/Sonar, and would block PRs on failing quality gate score. The problem was that you couldn't see why you failed quality gate score in jenkins/github, only people with Sonar accounts could , so you had to find someone with a sonar account and get them to take a screenshot of the error before you could fix it.

arcbyte 3y ago

Sonar os actually an incredibly powerful tool for dev teams WHEN they know how to use it and configure it according to their agreed upon standards. When it's used thoughtlessly, as it often is, it's terrible.