I need to know whether Static code analysis and code Quality are same or not because, I need to find out the tools for code quality and each time I google for it, I'm getting response for the tools related to Static Code Analysis.
Add a comment
|
3 Answers
"Code Quality" is a metric that tells you "how good the code is", eg. how understandable and maintainable it is. The problem is that it is such nebulous term that no one agrees what this metric should really mean and how it is supposed to be measured. See here.
For many programmers, code quality is very subjective term and what can be good code for one can be terrible code for other.
Now, Static code analysis tools can measure code quality if you define "code quality" as "number of unfixed issues in code". Which is pretty much only metric that static code analysis tools give you. Many (and I too) would argue that is not everything that "code quality" should be about. But it has two major advantages : it can be quantized (and compared over time) and can be made automatically without much effort (other than setting it up and taking CPU cycles during build).
So while static code analysis is not everything there is for code quality, it is good start.
Static code analysis is a technique that helps identify areas in which the quality of the code under analysis may be compromised. Notice the 'may', because while in many cases the points static code analysis tools make are good, false positives (things that are alright, but look suspicious enough to the tool that it'll tell you about them) are fairly common. It is not the only such technique, and it's not necessarily the best, either.
Code quality, however, is not a technique, or tool, it's a characteristic of the code, and it's not necessarily an objective one. Still, there are a few points that come up very often when talking about code quality (disclaimer: list not exhaustive, and there may be overlaps between different points):
- Completeness: Does the code do everything it has to do? Does it fulfill all the requirements?
- Correctness: Does the code do what it does correctly? Does it have unexpected side effects?
- Maintainability: How easy is the code to modify? If you have to add a new feature, or fix a bug, is it difficult to find where you have to do the changes? Do you have to make changes in many places even for trivial fixes?
- Reliability: How likely is the code to fail, for whatever reason?
- Security: Can unauthorized people make use of your code for purposes other than what the code is intended for? Does it introduce a vulnerability in the system?
Static code analysis tools usually help with correctness (by identifying areas in your code where you might have made mistakes which are not readily apparent), security and maintainability, but will not be able to tell you much about completeness, for example. And even then, they are not perfect and will not tell you everything you need to do for those areas. There are many other techniques and tools which can help with all of those and even other areas of code quality I have not mentioned (automated testing and code reviews are two popular examples, but there's many more).
Static code analysis is best performed by software (a compiler, a linter or what not), while code quality is best insured by peer reviews. The qualities that static analysis can ensure are only a fraction of the qualities that you will want your code to have.
TDD and BDD can also lead to an increase of automation in your QA, but they still cannot replace a second pair of eyes.
