SonarQube - Combining Sonar way, FindBugs, PMD and Checkstyle without duplicates

Question

I'm looking for best practices using SonarQube with the FindBugs, PMD and Checkstyle plugins.

1. How do the rules in SonarQube's default quality profile "Sonar way" relate to those of the plugins? Are they completely different rules or does the Sonar way contain the most important rules from those plugins?
2. What is the best way of combining those rule sets? How can I avoid duplicate checks?
3. Sonar v.3.x contains a "Sonar way with Findbugs" profile. I can't find it in v.4.5.1 - what happened to it?

Venettavenezia

Answer 1

The SonarQube Java plugin alone already covers all the Checkstyle and PMD rules - which is why the related plugins are no more bundled in SonarQube. So you can get rid of those plugins and forget the related rules.

Concerning Findbugs, most rules are complementary to the SonarQube Java plugin rules. There's no "Sonar way with Findbugs" profile anymore because that's the convention for all the language plugin to have only a "Sonar way" profile.

Vanthe

One example for (partly) duplicate rules are findbugs:UUF_UNUSED_FIELD and squid:S1068. The squid rule matches a lot more often than the findBugs one. On the other hand it does not find package private fields, which in turn are found by the findBugs one. There are some duplicates, though. Also the technical debt is quite different (5 vs. 30 Min). Can I contribute experience like that to SonarQube somewhere? – Venettavenezia

You can come and discuss this on the user mailling list: sonarqube.org/get-support – Vanthe

@Fabrice-SonarQubeTeam Since what version are PMD rules already are included in SonarQube Java plugin? Related to this old Jira issue, we need a new profile for Java Android (maybe Java+Lint+PMD+FindBugs). What is the best way to configure it? – Teodorateodorico

It is not true that SonarQube supports all checks of CheckStyle! See for example the AnnotationLocation rule. – Oxygenate