Integrating static analysis tools with each other?

Question

How are folks integrating various static analysis tools such as PMD, Checkstyle, and FindBugs so that they are used together in some uniform way? In particular, I'm interested in generating a single uniform report that includes warnings from all tools. Also, I want to be able to mark-up my code with reasonably consistent looking warning suppressions.

My question here is not meant to address tool "overlap" where, say, PMD and Checkstyle are looking for the same things. That is another issue.

Please see some of my thoughts on the matter in an answer to a related question.

Answer 1

I am not clear on what qualifies as a single uniform report in your book but here is what I do.

I use Maven2 for builds and with it you can configure a series of reporting plugins (including PMD, CPD, checkstyle, coberturba, etc). Maven will also auto-generate a website (site plugin) for your project which contains all the reports in a nice easy-to-navigate webpage format.

Answer 2

If you build your project with Maven, and you have those tools "plugged in" to your Maven build, then the Maven report that is generated for the build will include the output of those static analysis tools.

Answer 3

I stumbled across JcReport today, which I think does exactly what you are looking for. At least, it handles the reports in a combined way; suppressions are still tool-specific. This tool claims to support automatically integrating the output of PMD, CPD, FindBugs, CheckStyle, and Cobertura into a single HTML report.

I haven't tried it yet, but definitely intend to soon.

Answer 4

Another option is glean. http://jbrugge.com/glean/

From their website: Glean is a framework of Ant scripts for generating feedback on a team's source code. Glean's goal is to make it possible to add feedback to your build cycle with as little pain as possible. The scripts drive a number of open-source tools and collect the resulting HTML for you to deploy to a project website or some other common team area. Add it at the end of a daily build cycle and it is a quick way to keep a number of feedback sources up to date and in one place.