infer VS SonarQube

Also, a much more realistic approach would be to use static analyzers, such as fbinfer: https://fbinfer.com/

There are also static analyzers, for example PVS-Studio which is commercial and solid: https://pvs-studio.com/en/ The GCC compiler, starting with version 10, has a static analyzer that you activate with the “-fanalyzer” option. It’s still quite limited but I use it. Be sure the get GCC version 11.2 or later because the analyzer got much better after version 10. Facebook has a no-cost analyzer, but I haven’t tried it yet: https://fbinfer.com/

The research team at Meta has developed a new static analyzer that catches deadlocks in Java code for Android without ever running the app. What distinguished this work from past efforts is its ability to analyze revisions within large software libraries with hundreds of millions of lines–enough time and space so problems can be found before they manifest themselves as bugs or crashes. The proposed analyzer is open-sourced and forms part of the Infer static analysis framework.

A tool to detect bugs in Java and C/C++/Objective-C code before it ships\ (22 comments)

And run a security scan like Sonarqube: https://www.sonarqube.org

​​2. Static analyser tools such as SonarQube are used to analyse source code in search of technical debt.

Never had anything like that though for four years my life revolved around getting PMD, checkstyle and Sonar rules to pass so my pull request would merge.

Love it and have a suggestion: Use SonarQube. We set up the free version and use open-source plugins where needed. Set clear expectations for metrics like Cyclomatic complexity, code duplication, no critical/high vulnerabilities, % of test coverage. Leave no doubt what the expecations are, track progress over time, and if you do need to make resource changes, you will have objective data to use to make your decisions.

I'm surprised none mentioned it, but check out https://www.sonarqube.org/

I recommend https://www.sonarqube.org/ in a heartbeat. I used it in my last two jobs and never looked back

Check out SonarCube to see how much “cognitive load” your code puts devs through. Use Docker for a quick setup.

SonarQube (formerly Sonar) looks for code smells, security no-no's and common bugs. It also shows you all kinds of statistics and breakdowns by project / file / contributor / whatever. It's a pretty nifty tool; it's also pretty effective at keeping egos in check.

SonarQube