Tell me more ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.
up vote 14 down vote favorite
4

What static code analysis tools are there for apex? The only one I seem to be able to find is the Force.com Security Source Code Scanner but that has the draw back of placing your request into a queue and running it when it can. I would like something I can run locally so I can make refactoring into a number of very short cycles.

share|improve this question

4 Answers

up vote 8 down vote accepted

Apologies for plugging myself, but I've been working on a static analysis tool. You can find some information and try out a single page at http://codescan.villagechief.com/.

The enterprise version is based on Sonar, so it's got graphs and timelines, code reviews functionality, and much more.

There are over 100 static analysis checks including many very specific to Apex; code complexity metrics, etc. You can also build your own rules using XPath, or use it for continuous integration by having it run your Apex class tests and recording the results.

On http://codescan.villagechief.com/ you can also try out the analysis by uploading a single file. It doesn't have all the functionality as the enterprise version though, and quite a few metrics and analysis points are not enabled.

There is an eclipse version of this as well which displays the static analysis results as you work in Eclipse (analysis is done locally, so you can fix it as you work).

Let me know if you want some more information or a demo.

share|improve this answer
I am impressed. The report looks good. – Bob Roberts Sep 28 '12 at 2:58
Please the following answer which just details what Ben already said. – Robert Apr 23 at 15:02
up vote 1 down vote

You can get a local version of the Checkmarx source code scanner to run in Eclipse as a plugin. I think you get 90 days for free.

See Apex security scanner - Eclipse Plug-in.

The report is the same as the one you get from the Force.com Security Source Code Scanner, just integrated into the IDE. So you can go straight to the applicable lines in the source code.

While this solution is more local than the version you run from the website, it still relies on sending the code off to Checkmarx for remote analysis.

share|improve this answer
up vote 1 down vote

Here are more details regarding the above mentioned Australian start-up called VillageChief *(http://codescan.villagechief.com) that is working on a static code analysis tooling.

enter image description here

They currently offer 3 solutions, 2 of them are free:

I just talked to their founder Ben van Klinken and promised him to somewhat market this, as I expect other Apex developers out there to have a strong need for this as well ;).

share|improve this answer
It may be more appropriate to add to the original answer about codescan than to add a (sorta) duplicate answer. – Sdry Apr 23 at 13:40
1  
You are right but this would not draw enough attention to a fact that many people might be interested in. No image no bullet points and the like ;) – Robert Apr 23 at 13:49
up vote 0 down vote

I believe Appirio debuted Cloud Metrics at DF12. Not sure if it is available publicly just yet

share|improve this answer
I checked the Appirio page and this doesn't seem to be a tool but more a service. I guess Appirio consultants will check you code manually and look if there is room for (paid) improvement ;) – Robert Apr 23 at 19:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.