TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Sonar is destroying my job and it's driving me to despair

121 点作者 Crazyontap11 个月前

19 条评论

jimbokun11 个月前
&gt; In my case, I have a superior who administers Sonar and is, let’s say, completely committed to it. For any ‘exception granted’ we would have to book time with them days in advance then white-board the reason why Sonar is wrong, or produce a sample program - who has got time for that with tight deadlines?<p>This superior (sic) is what a negative productivity employee looks like.
评论 #40864923 未加载
nsxwolf11 个月前
We frequently have the issue of, upon refactoring code in such a way that involves moving it and its tests to a new file, Sonar will take away our previous &quot;credit&quot; for code coverage percentage, dropping our project below the threshold and failing.<p>The only workaround I&#x27;ve found is to create a new function, fill it full of many useless no-op lines, and write a test for that function, just to bump the percentages back up. This is often harder than it sounds, because the linter will block many types of useless no-op code. We then remove the code as part of another ticket.
评论 #40861002 未加载
Juliate11 个月前
The root issue is the superior not having a clue. Sonar in this case, is sadly enabling this type of superior to be even more harmful, not to the developers only, but to the actual business of the company.<p>And Sonar is far from being alone in this. JIRA is the most glaring example I can think of. Growing companies implement cargo-culted tools without understanding the needs and requirements, and let themselves drift into templates or &quot;best practices&quot; that are not relevant or beneficial to their own operations as-is, resulting in a sum of frustrations, whose impact on the work and the teams they acknowledge only way too late.<p>The care you need to inject not only in your tools, but how they are apprehended by both your customers and their primary users (which may have very different, if not opposed, perspectives on how&#x2F;why to use it), from pricing, to documentation, to use-cases...<p>This is especially very complex when your tool answers to a regulation requirement, because it&#x27;s very often received as a constraining&#x2F;oppressing &quot;solution&quot;, rather than an enabling one: it may be confortable to you as a seller, and confortable to your customer, but it may also be a counter-sale point to your (customer&#x27;s) users that will impact future consideration when they become purchasing agents themselves.
评论 #40860740 未加载
评论 #40861108 未加载
elpocko11 个月前
&gt;SonarQube (formerly Sonar) is an open-source platform developed by SonarSource for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs and code smells on 29 programming languages.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;SonarQube" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;SonarQube</a>
dexwiz11 个月前
No matter the industry, it sucks to have someone managing by dashboard. In classic post modernism, the signifier replaces the signified. If anything, it’s a great signal to the employee that it’s time to start looking elsewhere.
评论 #40860507 未加载
评论 #40861682 未加载
评论 #40860118 未加载
dgan11 个月前
Sonar tries hard to have an authority of a compiler, while having the resources of a linter.<p>I am not saying it&#x27;s snake oil, but honestly how i ve seen ut being used, it&#x27;s not that far
Emigre_11 个月前
Sonar doesn&#x27;t seem to really work in my limited experience. It adds a lot of of time to builds, at least in the cases I&#x27;ve seen, while there are alternate linters or code quality tools capable of doing the same at a fraction of the time. Build times and development speed matter!... They matter a lot. You need a quick feedback loop.
评论 #40860857 未加载
eigenvalue11 个月前
This sounds truly hellish, like being controlled by a stupid robot straight out of Kafka&#x27;s &quot;The Trial.&quot; They should allow special one off exception that are documented with a comment, similar to how you can disable Ruff warnings in python code for a single like<p><pre><code> # noqa: F401</code></pre>
评论 #40860781 未加载
zamalek11 个月前
I&#x27;m not sure how much value sonar adds where I work (dotnet). It enormously affects build times, and I&#x27;ve yet to experience a single true positive in 2 years (apart from the code coverage dashboard). The amount of MRR you can generate by vaguely being related to mitigating vulnerabilities is incredible.
评论 #40862008 未加载
icholy11 个月前
At my work you can mark any issue with &quot;won&#x27;t fix&quot;. The issues are right pretty often though.
ch_12311 个月前
Any sort of static analysis&#x2F;linting tools will occasionally make bad&#x2F;unhelpful&#x2F;stupid suggestions, some moreso than others. At any place where I&#x27;ve had to use such tools, I&#x27;ve always had the ability to either tweak the settings, or have a conversation with the people who decide them and make appropriate changes. In this case, it sounds like bad culture and&#x2F;or bad colleagues are driving this person to despair, and not Sonar as per se.
gewenyu9910 个月前
Well, we built Trunk Check to address some of these issues. Maybe it&#x27;ll suit your org better.<p>- We support hold-the-line: we only lint on diffs so you can refactor as you go. Gradual adoption. - Use existing configs: use standard OSS tools you know. Trunk Check runs them with standardized rules and output format. - Better config management: define config within each repo and still let you do shared configs across the org by defining your own plugin repos. - Better ignores: You can define line and project level ignores in the repo - Still have nightly reporting: We do let you run nightly on all changes and report them to track code base health and catch high-risk vulnerabilities and issues. There&#x27;s a web app to view everything.<p>Try it and let me know how it goes. <a href="https:&#x2F;&#x2F;docs.trunk.io&#x2F;check&#x2F;usage" rel="nofollow">https:&#x2F;&#x2F;docs.trunk.io&#x2F;check&#x2F;usage</a>
move-on-by11 个月前
I sympathize with the OP. Having said that, I’ve rolled out SonarCloud to two different companies and I would not hesitate to roll it out to a third if given the opportunity.<p>Initially, people always come out of the woodwork insisting that the gate requirements must be hard blockers and that we can just hand wave away the issues OP listed by tweaking the project rules. I always fight them, insisting that teams should be the owners and to gain quick adoption it should just be considered as another tool for PR reviewers. Eventually, people back off and come to accept that Sonar can be really helpful, but at the end of the day the developers should be trusted to make the right call for the situation. It’s not like we aren’t still requiring code reviews. I feel for OP, but it’s not Sonar’s fault the tool is being used for evil instead of good.<p>This last time I implemented SonarCloud, I took an anonymous survey to get peoples opinion. For the most part people liked the feedback Sonar provided. More junior engineers and more senior engineers liked it the most- midlevel engineers not so much. The junior liked getting quick feedback prior to asking for code reviews. The more senior engineers - who spend a lot of their time doing PR reviews - liked that it handled more of the generic stuff so that they could focus more on the business logic or other aspects of the PR. It’s just another tool in the toolbox.
评论 #40865570 未加载
评论 #40861681 未加载
sigotirandolas11 个月前
I saw a case where Sonar analysis was being requested by a government agency where software was built by consultants. From the government agency&#x27;s point of view it made some sense to ensure that the code delivered by the consultants wasn&#x27;t full-on spaghetti.<p>However, I saw it causing similar turd polishing behaviour: Sensible code needing to be changed because it exceeded some obstinate metric, any kind of code movement causing existing issues to appear as &quot;new&quot;, false positives due to incomplete language feature support, etc.
watwut11 个月前
Isn&#x27;t the actual issue here the superior managing the sonar being a controlling jerk? Turning off the rules on sonar is easy, technically. The issue is social.
评论 #40861263 未加载
philipwhiuk11 个月前
Sonarqube issues were the warning for the SOC-report powered issue scanners that have arrived more recently.
pacifika11 个月前
Are the defaults emphatic to the engineer or to the ruleset?
karussell11 个月前
add (2023)?
wetpaws11 个月前
We use sonar at work and this resonates so much with me.