Eliminate sonar.cxx.funccomplexity.threshold property

[ghost]

In my project, in the Administration / C++ (Community) tab, I can parameterize the Cyclomatic complexity threshold:

However, there is no such setting to parameterize the Cognitive complexity threshold.

A workaround would be to set the appropriate property in the sonar-project.properties file, but I have not found the correct property name.

• cxx plugin version 1.1.0
• SonarQube version 6.7.3

[ivangalkin]

Hi @phcouton and thank you for reaching out!

1. The settings you are mentioned are used in order to generate the following complexity metrics:

• Complex Functions (number of complex functions)
• Complex Functions (% = number of complex function / total number of functions)
• Complex Functions Lines of Code (NCLOC in complex functions)
• Complex Functions Lines of Code (% = NCLOC in complex function / total NCLOC * 100)

Please see the screenshot:

So the setting you've mentioned allows to decide, which function is complex and which is not.

2. There are following additional checks (SquidSensor):

• cxx:ClassComplexity
• cxx:FileComplexity
• cxx:FunctionComplexity
• cxx:FunctionCognitiveComplexity

(replace 'cxx' with 'c' if you use the c-plugin)

They can be parametrized with a threshold too. So if these checks are activated (please see https://github.com/SonarOpenCommunity/sonar-cxx/wiki/Activate-quality-rules) they can warn you about the particular file/class/function, which is above the maximum allowed complexity.

Please see a couple of screenshots below:

I hope it helps. Regards

[ghost]

Thanks @ivangalkin for these details.

I already know that I can change the threshold in a quality profile, but proceeding that way will impact all the projects using that profile (~40 projects in my case, and since I don't own them, I don't want to change them). What I am trying to do is to change the threshold for one specific project without impacting the other projects.

You can do that for the cyclomatic complexity threshold in the project's settings, but I can't do it for the cognitive complexity. To be clearer, the capture in my previous post was taken in the project settings page:

That said, where does your complexity measures comes from? I can only see that (with the cognitive complexity checks enabled):

Regards

[ivangalkin]

There are two disjunct types of settings for the cognitive complexity:

a) for the metrics: The only way to change them is the property sonar.cxx.funccomplexity.threshold. The only way to set a project-specific value is to change this property for your sonar scanner (cli tool / maven plugin / gradle plugin etc).

b) for the checks: The only way to change them is the customization of the corresponding quality rule. The only way to set a project-specific value is to introduce a custom quality profile:

• copy an existing profile
• change the rule in the newly created copy
• assign this copied profile to some desired project

W.r.t. cognitive complexity: again there are metrics and there are checks. Currently there is

• only 1 metric, which is "cognitive complexity of the whole project". It's impossible to customize it, because the formula for calculation of this metric is hard-coded.
• there is no other metrics involving cognitive complexity (no thresholds, no densities of cognitive-complex functions, no LOC-% of cognitive-complex functions etc.)
• only 1 check, which is "check if cognitive complexity for a function implementation is below threshold". You can set the custom threshold... and you can create custom quality profiles as described.

Please keep in mind this split between metrics and checks. Does that make sense to you?

[jmecosta]

Yes makes sense to me. So your proposal is just to apply the same approach as ij normal complexity metrics

…

On Thu, 9 Aug 2018, 15:10 ivangalkin, ***@***.***> wrote: There are two disjunct types of settings for the cognitive complexity: a) for the metrics: The only way to change them is the property sonar.cxx.funccomplexity.threshold. The only way to set a project-specific value is to change this property for your sonar scanner (cli tool / maven plugin / gradle plugin etc). b) for the checks: The only way to change them is the customization of the corresponding quality rule. The only way to set a project-specific value is to introduce a custom quality profile: - copy an existing profile - change the rule in the newly created copy - assign this copied profile to some desired project W.r.t. cognitive complexity: again there are metrics and there are checks. Currently there is - only 1 metric, which is "cognitive complexity of the whole project". It's impossible to customize it, because the formula for calculation of this metric is hard-coded. - there is no other metrics involving cognitive complexity (no thresholds, no densities of cognitive-complex functions, no LOC-% of cognitive-complex functions etc.) - only 1 check, which is "check if cognitive complexity for a function declaration is below threshold". You can set the custom threshold... and you can create custom quality profiles as described. Please keep in mind this split between metrics and checks. Does that make sense to you? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1538 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA_jyJ-JHFYibC6NyIYhPQ_r51bvIe6kks5uPCbQgaJpZM4V1ZQm> .

[jmecosta]

one question for me, the rule in the profile is activated with threshold 15. if the parameter in project is 10, does that mean that functions that have complexity between 10 and 15 will not show as issues however will show in the complexity graph. this looks like a inconsistency and in fact the 2 values should be the same?

[ivangalkin]

@jmecosta: both default values for max cyclomatic complexities == 10...

• cxx:FunctionComplexity, default == 10 (a)
• sonar.cxx.funccomplexity.threshold == 10 (b)

... so at least the initial settings are consistent.

I believe however, that having two parameters is at least not intuitive (probably that confused @phcouton in the first place) and maybe even wrong (because changes on (a) do not affect (b) and vice versa). I don't known which technical solution would ensure the consistency the best.

The least we can do is to change the description of the key sonar.cxx.funccomplexity.threshold

- Cyclomatic complexity threshold used to classify a function as complex
+ Cyclomatic complexity threshold used to classify a function as complex. This classification affects the metrics "Complex Functions" and "Complex Functions Lines of Code" only. It doesn't affect the check cxx:FunctionComplexity 

Or something like that.

[ghost]

It seems I had some confusion between checks and metrics properties; it makes sense for me now. So, I agree that a modified rule in a derived quality profile is the way to proceed.

However, creating a new quality profile requires "admin" rights, and not everyone can always do that...

[jmecosta]

You can be project admin in newer versions of SQ. This permisson was introduced to allow non admin to modify quality profiles to satisfy this requeriment

…

On Thu, 9 Aug 2018, 16:18 phcouton, ***@***.***> wrote: It seems I had some confusion between checks and metrics properties; it makes sense for me now. So, I agree that a modified rule in a derived quality profile is the way to proceed. However, creating a new quality profile requires "admin" rights, and not everyone can always do that... — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1538 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA_jyOAjpdKMWzCRBK3x9NpjzNCJXrPjks5uPDa-gaJpZM4V1ZQm> .

[jmecosta]

At least the rest api allows to retrieve the define value in the rule. Imo thats the way to go, the only existent value should be in the rule since thats the typical way project admins change the quality settings

…

On Thu, 9 Aug 2018, 16:24 ivangalkin, ***@***.***> wrote: @jmecosta <https://github.com/jmecosta>: both default values for max cyclomatic complexities == 10... - cxx:FunctionComplexity, default == 10 (a) - sonar.cxx.funccomplexity.threshold == 10 (b) ... so at least the initial settings are consistent. I believe however, that having two parameters is at least not intuitive (probably that confused @phcouton <https://github.com/phcouton> in the first place) and maybe even wrong (because changes on (a) do not affect (b) and vice versa). I don't known which technical solution would ensure the consistency the best. The least we can do is to change the description of the key sonar.cxx.funccomplexity.threshold - Cyclomatic complexity threshold used to classify a function as complex+ Cyclomatic complexity threshold used to classify a function as complex. This classification affects the metrics "Complex Functions" and "Complex Functions Lines of Code" only. It doesn't affect the check cxx:FunctionComplexity Or something like that. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1538 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA_jyFEQYLQAHBTJSKvk--sOaXmRxM3Uks5uPDgigaJpZM4V1ZQm> .

[ivangalkin]

@jmecosta yes, one can extract the injected/annotated parameter from the corresponding visitor; maybe there is even a more elegant way; I will change the issue's description, so that we can track the real problem.