Metrics

Hello guys,

Metrics can not only be found in software development but also in everyday situations like news or in your car. But as well as you should not just simply believe printed or shown details you should interpret them correctly. In your car for example the shown data when you hit 100 km/h is not very important until you find yourself in a speed limit of 30 km/h. 

And you should be sure that the given information is correct itself. So, it’s very hard to find a tool that brings you comfort in handling and setting up, provides you with all necessary information and creating the benefit you need for your software, maybe a warning when “you are too fast or too slow”.

In this week’s blog post (to be fair, it’s a two-week-post) we talk about clean and safe code and how you can automatically check the quality of your code. We will speak about tools we already use, tools that we want to use and tools that do not meet our requirements. If you have any detailed questions about the software as outlined here, just let us know below.

Initial Situation

As we are using Azure DevOps for planning and managing our project, many metrics are already implemented and working before we already thought about using some additional software. But nevertheless, we wanted (at least) to check out some other metric tools to maybe improve our code much more. 

So, we checked the internet for some ideas and suggestions what kind of software there is and what we want for Unidash. 

Additional Metrics

We found many different sites with lists of tools that may improve code or deployment and also monitor the system while running. 

We’ve seen that there are three categories (for us) that we could split up into different tools:

1. Team efficiency/Project planning
2. Business agility/Deployment
3. Security/Quality Assurance

As we use Azure DevOps, we already implemented nearly every tool that applies to ‘Project Planning’ and ‘Business Agility’. What makes life pretty easy when you choose a powerful tool to host your project (thanks Gino).

So, we concentrated on Security and Quality Assurance. We found different tools for it, which we wanted to check out.

Candidate No. 1: SonarQube

SonarQube checks your code for weaknesses and smelly parts so you can easily find and fix them if you want to. 

SonarQube would be a perfect addition to what we already have. We are checking how and where we want to install it as our server and some of our work devices may not have enough power to keep everything smooth, but we are looking into it. We want to centralize it so everyone can use the benefits without having troubles while installing or monitoring it on their local devices.

---

Another perfect supplement would be “Vault” which stores user secrets and app configurations in an encrypted environment. As we use many APIs for Unidash we may want to check this one out.

---

Last but not least, we are looking into “Clair” which analyzes Docker Containers for vulnerabilities. It’s another very handy tool if it is set up correctly. 

---

We won’t use Jenkins, which was brought up by @profberk as we already have a perfectly working CI at Azure DevOps.

So far, thanks for reading.

If you have any questions or comments, just let us know below, every comment is highly appreciated.

Cheers and stay healthy,
-RawBean-