Are you interested in a PR to run Sonar analysis?

[fathzer]

Hi,

SonarCloud is a code review tool I've been using for my personal/professional projects for a long time and (almost) always found its advice useful.
It is free for open source projects.

I ran a quick analysis in my own environment. You can can see its result here. It found some code smells that myPi did not.

Let me know if you are interested. I would create a PR to setup a workflow that analyses lichess-bot code. On your side, you would have to create an account on SonarCloud.io (I'm pretty sure you can use your Github account to create it).

PS: I do not work for or have any link with SonarCloud ;-)

[MarkZH]

We use flake8 for code smell analysis (see here for the settings we use). You can see by the --max-complexity=10 argument that we allow for more function complexity than the default. Some of these are interesting, though: function name should be snake case, use a more specific exception class, and rename variable to not shadow a built-in.

[fathzer]

Hi,

I reviewed my knowledge on setting up Sonar ... and it can be even simpler than I was thinking.

Sonar has two modes:

• An automatic one.
• A mode with analysis trigerred externally, for instance by a Github action.

The differences are explained here. Basically, the automatic mode:

• Pro:
  • requires no change or pull request on Github side.
  • analyses all changes to the main branch and all pull requests.
• Cons:
  • does not support test code coverage analysis.
  • will not analyse other branches.

I propose that you start with the automatic mode using the instructions below.

If you want test code coverage, or analyse other branches, tell me. I would create a pull request and give you instructions for the Sonar project to respond to Github's actions.

Here are the instructions for setting Sonar in automatic mode.

1- Signup to SonarCloud with lichess-bot-dev Github account
2- Once your logged in, click on import in front of lichess-bot-dev organization.
3- On next screen select Free Plan, then click on Create organization
4- On next screen click Analyse new project
5- On next screen check lichess-bot and then Set Up.
6- On next screen, I suggest to select Previous version (you can choose a number of days, if you prefered). Then, click Create project.

A first analysis is launched, that's all :-)

[fathzer]

We use flake8 for code smell analysis (see here for the settings we use). You can see by the --max-complexity=10 argument that we allow for more function complexity than the default. Some of these are interesting, though: function name should be snake case, use a more specific exception class, and rename variable to not shadow a built-in.

I think the security hotspot that highlights the use of http is also interesting :-)