Static Code Analysis | Apache Ozone
Skip to main content
Apache Ozone
Docs
Latest Docs
Docs 2.0.0 (Archived)
Docs 1.4.1 (Archived)DownloadRoadmapBlog
Community
Communication Channels
Who Uses Ozone?
Report An Issue
Ask a Question
How to Contribute
Events and Media
Search
Version:
2.2.0
Next
2.2.0
2.1.1
Overview
Quick Start
Core Concepts
User Guide
Administrator Guide
System Internals
Developer Guide
Build
Run
Test
Unit Tests
Integration Tests
Acceptance Tests
Continuous Integration
Static Analysis
Project
Developer Guide
Test
Static AnalysisVersion: 2.2.0
On this page
Static Code Analysis
Apache Ozone uses static code analysis tools to identify potential bugs, code smells, security vulnerabilities, and other issues before they make it into production. SonarQube is the primary tool used for comprehensive code quality analysis.
SonarQube Overview​
SonarQube is an open-source platform for continuous inspection of code quality. It performs automatic reviews with static analysis to detect:
Bugs and logic errors
Code smells (maintainability issues)
Security vulnerabilities
Duplicated code
Test coverage gaps
Coding standard violations
SonarCloud for Apache Ozone​
Apache Ozone uses SonarCloud, a cloud-based version of SonarQube, for continuous code quality analysis.
Accessing SonarCloud​
The Ozone project's SonarCloud dashboard is publicly available at: https://sonarcloud.io/project/overview?id=hadoop-ozone
When Analysis Runs​
SonarCloud analysis is triggered automatically on:
Merges to the main branch
Release tag creation
The analysis is integrated into the GitHub Actions CI workflow in .github/workflows/ci.yml.
Understanding SonarQube Results​
Dashboard Overview​
The SonarCloud dashboard provides high-level metrics including:
Quality Gate Status: Overall pass/fail status based on quality thresholds
Bugs: Logic errors and potential runtime issues
Vulnerabilities: Security issues
Code Smells: Maintainability issues
Coverage: Percentage of code covered by tests
Duplications: Percentage of duplicated code
Issue Severity Levels​
SonarQube categorizes issues by severity:
Blocker: Issues that must be fixed immediately (risk of system failure)
Critical: High-impact issues requiring urgent attention
Major: Default severity for most issues
Minor: Low-impact issues with minimal risk
Info: Non-critical issues that represent best practice violations
Addressing SonarQube Issues​
Fixing Common Issues​
1. Code Smells​
Typically maintenance-related issues like:
// Before: Magic number
if (retryCount > 5) {
// Retry logic
}
// After: Named constant
private static final int MAX_RETRY_COUNT = 5;
if (retryCount > MAX_RETRY_COUNT) {
// Retry logic
}
2. Bugs​
Logic errors that could cause runtime issues:
// Before: Potential NullPointerException
String value = map.get("key").toString();
// After: Null check
String rawValue = map.get("key");
String value = rawValue != null ? rawValue.toString() : "";
3. Security Vulnerabilities​
Issues that could expose security weaknesses:
// Before: Hardcoded credentials
private static final String PASSWORD = "p@ssw0rd";
// After: Configuration-based approach
private String password = configuration.get("security.password");
Other Static Analysis Tools​
In addition to SonarQube, Ozone uses several other static analysis tools:
1. SpotBugs (Formerly FindBugs)​
Detects potential bugs in Java code through bytecode analysis.
# Run SpotBugs
cd hadoop-ozone/dev-support/checks
./findbugs.sh
Configuration is in hadoop-ozone/dev-support/checks/findbugs.sh
2. PMD​
Source code analyzer that finds common programming flaws.
# Run PMD
cd hadoop-ozone/dev-support/checks
./pmd.sh
Rules are defined in dev-support/pmd/pmd-ruleset.xml
3. Checkstyle​
Enforces coding standards and conventions.
# Run Checkstyle
cd hadoop-ozone/dev-support/checks
./checkstyle.sh
4. RAT​
Enforces Apache license header in all files
# Run rat
cd hadoop-ozone/dev-support/checks
./rat.sh
Exclusions are defined in dev-support/rat/rat-exclusions.txt
Best Practices​
Fix issues early: Address static analysis findings as you develop
Prioritize by severity: Focus on Blocker and Critical issues first
Maintain test coverage: Keep coverage high to catch regressions
Understand false positives: Some issues may be false alarms; use @SuppressWarnings with care
Run locally before pushing: Run static analysis checks locally to catch issues early
# Run all static analysis checks
cd hadoop-ozone/dev-support/checks
./findbugs.sh
./pmd.sh
./checkstyle.sh
./rat.sh
Resources​
SonarSource Rules - Detailed explanations of Java rules
SpotBugs Bug Patterns - Explanations of bug patterns
PMD Rules - Complete list of PMD rules
Checkstyle Checks - Available Checkstyle checks
cspell.yaml
Edit this page
Previous
Continuous Integration
Next
Project
SonarQube Overview
SonarCloud for Apache Ozone
Accessing SonarCloud
When Analysis Runs
Understanding SonarQube Results
Dashboard Overview
Issue Severity Levels
Addressing SonarQube Issues
Fixing Common Issues
Other Static Analysis Tools
1. SpotBugs (Formerly FindBugs)
2. PMD
3. Checkstyle
4. RAT
Best Practices
Resources
Apache Software Foundation
Foundation
License
Events
Sponsorship
Privacy
Security
Thanks
Community
GitHub Discussions
Jira Issues
Slack
Mailing List
YouTube
Twitter
Repositories
Ozone
Website
Docker Image
Docker Runner Image
Copyright © 2026 The Apache Software Foundation. Licensed under the Apache License, Version 2.0.
The Apache Software Foundation, Apache Ozone, Ozone, Apache, the Apache Feather, and the Apache Ozone project logo are either registered trademarks or trademarks of the Apache Software Foundation.