Inspectopedia: Analyze code against inspections in your IDE or CI pipeline

https://www.jetbrains.com/pages/inspectopedia-by-jetbrains/

by KerryBeetge • 2 years ago

103 61 2 years ago

jetbrains.com

bugbuddy2• 2 years ago

This is super cool of them. It makes me feel like renewing my license.

mdaniel3• 2 years ago

from what to what?

bugbuddy2• 2 years ago

armchairhacker• 2 years ago

JetBrains inspections are great, but I wish there was a way to run them programmatically so they could be checked in CI.

(EDIT: should have RTFA)

RockRobotRock3• 2 years ago

Do they integrate existing linters in their IDE or have their own secret sauce? Probably a bit of both.

varikin• 2 years ago

All the Jetbrains IDEs have their own custom linter. It's pretty good, but my complaint has always been the inability to use it in CI/CD and to generate reports. The way I read this, they pulled their custom linter out of the IDEs and made it a standalone tool that can be added to CI/CD, which is great.

lpapez• 2 years ago

JetBrains inspections are great, but I wish there was a way to run them programmatically so they could be checked in CI.

Which is literally what the post is about...

Denvercoder93• 2 years ago

I wish there was a way to run them programmatically so they could be checked in CI.

I haven't used it, but thIs seems to be what their Qodana product is for: https://www.jetbrains.com/qodana/

KerryBeetge• 2 years ago

Exactly right.

s900mhz• 2 years ago

I THINK that’s exactly what this product is?

https://www.jetbrains.com/qodana/

Edited: Oops, should have refreshed. Someone beat me to it

RockRobotRock3• 2 years ago

PyCharm has saved me from so many stupid mistakes that would easily waste 15 minutes if I hadn't noticed them. I don't know how you could write high level code without an IDE.

zer00eyz2• 2 years ago

I use jet brains products, and I spend a fair bit of time in all sorts of flavors and setups in vim.

Neovim will let you configure your env to provide 90 percent of what an ide will do.

The 10 percent isnt "missing" its just going to be very different...

See how the other half lives and you might find some features you like and bring back home. You might find yourself running vim in pycharm ;)

jiggawatts• 2 years ago

You really can’t even begin to approach what the IntelliJ tools can do with a mere text editor. You’ll also spend more time tinkering with your Vim plugins than actually coding.

RockRobotRock3• 2 years ago

I might try that, thank you. Would love the best of both worlds

sva_• 2 years ago

I wonder what type of errors that are? My last experience with PyCharm was on an older 2014 ThinkPad on which it lagged too much, so I abandoned it. Could probably run it much better with my current laptop...

I just use VSCode for most things, or nvim if I want to edit something very specific that doesn't require much navigation between files. I'm not a huge fan of my editor annoying me with stuff all the time, but I'm wondering if I'm missing out.

xcv1234• 2 years ago

I wonder what type of errors that are?

The type of errors are type checking errors.

albertzeyer2• 2 years ago

I think some free-for-open-source-projects licence or so would make sense here. Or maybe make this completely free? It's good advertisement for their IDEs.

Note, I basically have scripted the same functionality as Qodana for our CI, but using the already existing capabilities of the IDE: https://github.com/rwth-i6/returnn/blob/master/tests/pycharm...

This script generates exactly the same warnings as the IDE does.

It downloads some PyCharm Community version and installs it.

It uses the bin/inspect.sh tool which is provided by the IDE.

The IDE bin/inspect.sh needs an existing PyCharm project (all the XML files etc), so this script creates the project files automatically.

This also needs the Python stubs, so this script can create those as well, in the same way the IDE would create them, or alternatively it can download them (I created them in advance for some PyCharm versions).

But then, bin/inspect.sh does not generate all the warnings you see in the IDE. The IDE additionally runs pycodestyle, and so I do the same in the script.

So, as you see, it took a bit of effort to get to all that within the CI, but now it works and I get the same warnings as in the IDE.

ellisv• 2 years ago

There is a community license, which includes a subset of their supported languages.

https://www.jetbrains.com/help/qodana/pricing.html#license-c...

lol768• 2 years ago

Must admit this seems like a very odd way of doing it, to me. Normally JetBrains are pretty decent at supporting OSS endeavours.

At present, OSS Java libraries can use Qodana Community, but OSS .NET libraries can't.

dflock• 2 years ago

How long does that CI job take to run, roughly?

albertzeyer2• 2 years ago

It's a quite big project (maybe 100k-200k lines, not sure), takes about 10 minutes or less on the GitHub Action node I get, which is not so fast.

It's completely from scratch through the whole project, every time. Maybe I could do it more cleverly and cache the last state somehow and only check changes files or so. But I wanted to keep that logic simple.

khaki54• 2 years ago

They already have a free for OSS you can get which gives you everything as far as I know. https://www.jetbrains.com/community/opensource/#support

keybored2• 2 years ago

Intellij has some nice static analysis for Java.[1] But I want it in my face. Because we had a bug where we used `==` on a boxed primitive. And the inspection didn’t help because it was just sitting there with some faint yellow background or whatever it is if you happened to visit that file. And the light-bulb action thing is effectively active on any line since you get the option of “invert conditional” or “use block in lambda” and useless things like that.

Well I’ll just hedge and say that it wasn’t obvious to the three of us how to get an in-your-face warning.

[1] EDIT: I realize now that my brain for some reason thought that “in your face” would immediately translate to everybody else as “fail the build”. What a drunken (but not drunk though) mistake.

red0point• 2 years ago

If I remember correctly, there is an extensive „Inspection“ settings page where you can enable / disable / set the levels (hoe much in-your/face) of exactly such checks.

Maybe this would suit you?

https://www.jetbrains.com/help/idea/code-inspection.html#acc...

jupp0r2• 2 years ago

You shouldn't rely on a human reading an in-their-face warning. If you consider a particular static analysis check to be vital, run it in CI and make the PR introducing it red. Everything else is just an upcoming post mortem with "we should have noticed this" waiting to happen to you.

keybored2• 2 years ago

You shouldn't rely on a human reading an in-their-face warning. If you consider a particular static analysis check to be vital, run it in CI and make the PR introducing it red.

That’s what I meant (edited now). I want compilation to fail. Or whatever “CI” is.

We didn’t find a way to promote inspections to some kind of static analysis run.

Denvercoder93• 2 years ago

You can change how inspection errors are shown under the Color Scheme settings. You can make it bold, striked out text with a bright red background if you want. I seem to remember at some point you could also make it blink, though I can't find that anymore (probably for the best).

phyzome• 2 years ago

Generally you'll want to have some kind of linter in your build tool.

__jonas• 2 years ago

When I was using IDEA a lot I've had this one come up a couple of times and I've really appreciated it every time:

https://www.jetbrains.com/help/inspectopedia/SuspiciousNameC...

I thought it was so sweet that someone had thought of this very specific possible mistake and warned me about it to save me a little bit of time and trouble.

(Maybe not this exact one since it was in JS not Java I believe, but the same idea)

joshstrange• 2 years ago

Yep, I had some scaling code that swapped width/height in one place by accident and IDEA caught it. I really love this tool.

MichaelMug• 2 years ago

Does this do the same thing as SonarQube?

plutokras• 2 years ago

Seems like that's the case.

galaxyLogic4• 2 years ago

In WebStorm if I write:

  let see = someOb.comments;

it tells me I have the error :

   "Unresolved Variable 'comments' ".

But the error goes away if I rewrite it as:

    let see = someOb ['comments'];

Why is that?

GenerocUsername• 2 years ago

AST and Static Code analysis.

Much easier to interpolate the hardcoded token rather than a string...despite the string being a final string and not some concatenation or dynamic value

kroltan2• 2 years ago

Not really at all, the type checker understands it is a field reference (it's just an alternative syntax after all, it is absolutely 0% difference in behaviour.

However, it's a common typed-javascript idiom to use string-indexing when you're probing a value of unknown type. Even Typescript has settings to accept this.

wslh• 2 years ago

No Rust.

jasonlotito2• 2 years ago

Probably because RustRover is still in preview.

https://www.jetbrains.com/rust/

mdaniel3• 2 years ago

And even that's only partially true: they didn't pull the rust plugin just started to whine about it: https://plugins.jetbrains.com/plugin/8182--deprecated-rust and https://github.com/intellij-rust/intellij-rust/blob/c6657c02... (MIT)

rglover• 2 years ago

The influx of AI-generated code, an ever-evolving threat landscape, and the push for shorter release cycles can jeopardize code quality. All of these factors dictate the need for continuous and accurate code analysis to help development teams spot and fix code issues early on so they can consistently deliver readable, maintainable and secure code.

You know, I read stuff like this and I wonder if anybody has thought maybe those things jeopardizing code quality should be discouraged as opposed to adding yet-another-tool.

alfalfasprout• 2 years ago

Sadly, it's like outsourcing. People only learn once it comes back to bite them. It'll typically be in the form of a major security breach or the codebase becoming so painful to work in that it affects the business.

sb8244• 2 years ago

I mean, once the cat is out of the bag you have to care for it.

It can be discouraged, but people will still use it, so helping is still good.

Plus it helps non AI use cases at same time

jasonlotito2• 2 years ago

I mean, this isn't adding yet-another-tool. These inspections have existed for years inside of JetBrains IDEs. I feel like this is just an "encyclopedia of inspections." I don't see any other uses for it. They are just providing everything they are testing in the various tools they offer.

manbash• 2 years ago

I actually don't understand the "AI-generated code" excuse. Code analysis should be part of the pipeline regardless.

It's not like people are perfect code developers.

dmolony• 2 years ago

I think what they mean is 'an influx of AI-generated code (which is frequently garbage)'

Inspectopedia: Analyze code against inspections in your IDE or CI pipeline

Related Stories