Expertiza_Wiki - User contributions [en]

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-04-07T04:31:52Z

Jyang23: /* Design Pattern */

[[File:sahana.jpg|right]]
This project is developed as a contribution to Sahana Software Foundation (Eden).

== Background ==

Sahana Eden is an open source software project that provides effective solutions for critical humanitarian needs management either prior to or during a crisis (mainly disasters).<ref>http://sahanafoundation.org/products/eden/</ref> This platform has a rich feature set which can be rapidly customized to adapt to existing process and integrate with existing systems.

Sahana Eden’s features are designed to help emergency management practitioners to better mitigate, prepare for, respond to and recover from disasters more effectively and efficiently. With this logistic software, strategic planning and the deployment of efforts of human resources and supplies to victims is handled in an efficient manner. It coordinates the information of all the components required to relieve in some way the pain of the affected victims.

Sahana Eden is supported by Sahana Software Foundation<ref>http://sahanafoundation.org/about-us/</ref> whose mission it to save lives by providing information management solutions that enable organizations and communities to better prepare for and respond to disasters. This is a voluntary community consisted of disaster management practitioners, academics, companies and students.

== Motivation ==

Sahana Eden provides a wide range of functionality. Its main capabilities include organization registry, project tracking, human resources management, inventory&assets tracking, assessments, shelter management, scenario&events planning, GIS mapping, messaging, etc.

Among all the features, inventory tracking keep records of shipments; supports multiple catalogs of items; and allow organization to manage requests, donations and warehouse. However, we found that the systems does not have place where we can track some “Drop Off Sites” for collection of supplies in minor disasters or during our daily life. These drop off sites can convenience stores, supermarket, hospitals, etc. People can donate supplies to one of these sites which might be most convenient for them and the organizations then can collect useful goods themselves. After talking with one of the managers from Sahana Software Foundation, we decide to add this new feature to the system.

== Technique Overview ==

The basic Sahana Eden architecture is as follows:

{| border="1" class="wikitable"
|-
! Web Server
| Apache || Other web servers can also be used, such as Cherokee.
|-
! Application
| Sahana Eden ||
|-
! Web Framework
| Web2py ||
|-
! Programming Language
| Python & Java Script ||
|-
! Database
| MySQL, PostgreSQL, or SQLite || MySQL, PostgreSQL, and SQLite are supported. Other databases should be usable without major additional work since Web2Py supplies many connectors.
|-
! Operating System
| Linux (Debian recommended) || Windows and Mac OS X are possible, but only recommended for single-user environments.
|}

=== Web2py ===

Web2py<ref>http://www.infoworld.com/d/application-development/pillars-python-six-python-web-frameworks-compared-169442</ref> is an open source framework, licensed under the LGPL version 3 License, developed and interpreted with the Python language and agile concept development that follows good software engineering practices. It is based on the [http://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller Model View Controller(MVC)] pattern. It also includes a Database Abstraction Layer (DAL) that writes SQL dynamically so the communication between the application and any database will be transparent. Since this framework includes various options in security, data access control, input validation on forms, it is been said that is built for security, because the framework addresses many of these issues.

Because Sahana Eden needs to be accessible to users at remote locations, including the public, a browser-based solution was essential. The system also needs to be able to be used on offline laptops, so it needs to run on a lightweight stack.

Python<ref>https://www.python.org/</ref> was selected as a suitable high level language allowing the rapid customization of code required for each individual circumstance yet has a large number of powerful libraries available including for Geo-spatial Information Systems (GIS).<ref>http://www.gis.usu.edu/~chrisg/python/2009/</ref>

=== S3 Framework ===

The Sahana Eden Software Platform(S3) has been built around a Rapid Application Development (RAD) Framework.<ref>http://en.flossmanuals.net/sahana-eden/technical-overview/</ref> This provides a high level of automation to ensure that new solutions can be quickly and effectively developed. Once a database table is defined, the Sahana Eden Framework automatically generates HTML pages to handle CRUD (Create, Read, Update, Delete) as well as Search, Map and Pivot Reports. Web Services are available to import and export in XML, CSV, JSON and EXtensible Stylesheet Language (XSL) transforms are supported to produce other data standards.

The Sahana Eden Framework has flexible authorization policies which can be configured to grant permissions for different modules, tables as well as the ability to have multiple Organizations control their own data on a single Sahana Eden installation.

== Design ==

=== Database ===

This is a basic relation established on the system between the place and the contact for the drop off site. An organization to each drop off sites, and one organization can have different representative for each site. Both of them are many-to-one relationship<ref>http://en.wikipedia.org/wiki/Relational_database</ref>. A dropOffSite table has six attributes: name, flyer, comments, startTime and endTime which indicates the time period the site will be open for donation, and personId as a foreign key to person table.

[[File:SahanaER.png]]

=== Framework ===

In order to add the capability to manage drop off sites information from within the Sahana Eden instance, we have two options: installing a separate package, or integrating this into the Sahana Eden instance. We have decided to use the latter so that :

* We don’t need to define data, like users, locations, organizations, in multiple systems.
* We can use Sahana Eden’s messaging and mapping capabilities for the drop off sites in the future.
* The organization module can use drop off sites records of personnel.

=== Design Pattern ===

We have taken two design patterns into consider during our development.

* '''Factory Methods'''

In the controller, we return an s3_rest_controller() method, this function provides all the Sahana Eden framework support needed to access the resource, including automatic loading of the respective model definitions. With this method, we can have a working module and be able to see the CRUD (Create, Read, Update, Delete) user interface. We could define our own methods to do CRUD of drop off site module. In that case, the code will violate DRY principle. If all contributors to Sahana have done the CRUD themselves, there will be a lot of duplication and the readability of the system will decrease. However, we can replace the deault strings within the CRUD user interface with custom strings. To be specific, we use crud_strings() method in S3 framework to do customizations.

<pre>
def course():
return s3_rest_controller()
</pre>

* '''Oberserver'''

Observer pattern is widely used in GUI systems. By the nature of Model-View-Controller(MVC) architecture, the observer pattern is used to decouple the model from the view. View represents the Observer and the model is the Observable object. This kind of framework can be enhanced in future with new observers with minimal changes.

=== Component ===

As shown above, we'd like to be able to record information relating to staff in each drop off site, such as how long they will be there and contact number etc. To do this, we need to build a 'link' table between the person and the drop off site. The natural way to do this within Sahana Eden is to make the link table a 'component' of the drop off site table. The drop off site is the 'primary resource', and contact person are a 'component' of the course.

To realize the 'component' feature. First, we add a 'represent' function to allow a record in the drop off site table to be represented by its name.

<pre>
def place_represent(id):
table = db.dosite_place
query = (table.id == id)
record = db(query).select().first()
if record:
return record.name
else:
return "-"
</pre>

This code involves using Web2Py's Database Abstraction Layer (DAL) to do a SQL query.The variable db is an instance of the DAL class, which represents a database. Queries are written in a syntax that is much like a Python expression.

Then, we define a 'reusable field' which can be added to other table definitions to provide a foreign key reference to the drop off site table.

<pre>
place_id = S3ReusableField("place_id", db.dosite_place,
requires = IS_ONE_OF(db,
"dosite_place.id",
"%(name)s"),
represent = place_represent,
label = T("Place"),
ondelete = "RESTRICT")
</pre>

Note that this uses the represent function which we just defined. It also adds a 'requires' validator function. This provides both server-side validation and a client-side widget (in this case a dropdown of records in the drop off site table).

As to the controller, we don't need to create a separate REST controller to manage the component, since it will always be accessed via the existing drop off site controller, however we must then extend the controller with 2 new elements to allow the Sahana Eden framework to display the component: 'tabs' and an 'rheader'. Tabs are how the framework provides access to the different components in a web page for the primary resource. The 'resource header' is a section of HTML that provides a summary of the primary resource record, in this case the drop off site. This is displayed above the tabs so that when each component record is being viewed, its parent record is also visible at the same time.

We can simply add the following code into the controller model. Here, rheader is simply a variable passed through the REST controller unaltered & then serialized as rheader.xml() in the views.

<pre>
def place_rheader(r, tabs=[]):
if r.representation != "html":
# RHeader is a UI facility & so skip for other formats
return None
if r.record is None:
# List or Create form: rheader makes no sense here
return None

rheader_tabs = s3_rheader_tabs(r, tabs)

place = r.record

rheader = DIV(TABLE(
TR(
TH("%s: " % T("Name")),
place.name,
TH("%s: " % T("Start Date")),
place.start_date,
)
), rheader_tabs)

return rheader
</pre>

== Implementation ==

* Define dropOtffSite table in our new models and its relationship with person table and organization table.

<pre>
tablename = "dosite_place"
table = db.define_table(tablename,
Field("name", notnull=True, length=64, label=T("Place Name")),
s3db.pr_person_id(label=T("Place Contact")),
Field("flyer", "upload",label=T("Flyer Propaganda")),
s3_comments(),
s3base.s3_date("start_date",label="Collection Start Date"),
s3base.s3_date("end_date",label="Collection End Date"),
*s3_meta_fields()
)
</pre>

* Add editable features to the the Drop Off Site list.

<pre>
LIST_PLACE = T("List Drop-Off Sites")
s3.crud_strings[tablename] = Storage(
title_create = T("Add New Place"),
title_display = T("Place Details"),
title_list = LIST_PLACE,
title_update = T("Edit Place"),
title_search = T("Search Place"),
title_upload = T("Import Place"),
subtitle_create = T("Add New Place"),
subtitle_list = T("Place"),
label_list_button = LIST_PLACE,
label_create_button = T("Add New Place"),
label_delete_button = T("Delete Place"),
msg_record_created = T("Place added"),
msg_record_modified = T("Place updated"),
msg_record_deleted = T("Place deleted"),
msg_list_empty = T("No Place currently registered"))
</pre>

* Customized the view in controller so that it fits Sahana Eden's standard.

<pre>
def place():
return s3_rest_controller(rheader=place_rheader)
</pre>

== Deliverables ==

The application can be accessed with the following link: [http://152.46.16.162/eden Sahana Eden Site]

We go through one use case to see how the system handles a drop off site information collection.

*Accessing "DropOff Site" from the main menu

[[File:Ss1.png]]

* After click on the menu, we will see a welcome page first. This page gives users a brief introduction of what is drop off site and how does it works.

[[File:Ss2.png]]

* Click on "list of drop off site" link, we'll see a list of drop off sites with their detail information. Then we can add a new record by clicking the button "Adding a Record".

[[File:Ss3.png]]

* Fill in the table with detail. Notice that here when you fill in the person name, you can look up their name by enter part of their name.

[[File:Ss4.png]]]

* After successfully add a new record, we can go back to see the new drop off site information.

[[File:Ss5.png]]

== Future Work ==

Based on the information we have now for Drop Off Site. We plan to add a location attribute to this table so that we can map this location information to mapping feature of Sahana.

Sahana has a fully integrated mapping functionality which allows any location-based data to be visualized on a map. What we can do is to add a layer on the map. When user want to view drop off site information, one can select "Drop off sites" label besides the map, then he will see some marked location on map which indicates available sites. When we click on these marked places, information about the sites, including detailed address and contact number will be available for users in a small text field.

== Further Reading ==

* [http://web2py.com/init/default/documentation Web2py]

* [http://diveintopython.org/ Python]

* [http://docs.jquery.com/ Jquery]

* [http://docs.sencha.com/ext-js/3-4/ Ext_JS 3.4.0]

= Reference =
<references/>
---

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-04-07T04:24:16Z

Jyang23:

[[File:sahana.jpg|right]]
This project is developed as a contribution to Sahana Software Foundation (Eden).

== Background ==

Sahana Eden is an open source software project that provides effective solutions for critical humanitarian needs management either prior to or during a crisis (mainly disasters).<ref>http://sahanafoundation.org/products/eden/</ref> This platform has a rich feature set which can be rapidly customized to adapt to existing process and integrate with existing systems.

Sahana Eden’s features are designed to help emergency management practitioners to better mitigate, prepare for, respond to and recover from disasters more effectively and efficiently. With this logistic software, strategic planning and the deployment of efforts of human resources and supplies to victims is handled in an efficient manner. It coordinates the information of all the components required to relieve in some way the pain of the affected victims.

Sahana Eden is supported by Sahana Software Foundation<ref>http://sahanafoundation.org/about-us/</ref> whose mission it to save lives by providing information management solutions that enable organizations and communities to better prepare for and respond to disasters. This is a voluntary community consisted of disaster management practitioners, academics, companies and students.

== Motivation ==

Sahana Eden provides a wide range of functionality. Its main capabilities include organization registry, project tracking, human resources management, inventory&assets tracking, assessments, shelter management, scenario&events planning, GIS mapping, messaging, etc.

Among all the features, inventory tracking keep records of shipments; supports multiple catalogs of items; and allow organization to manage requests, donations and warehouse. However, we found that the systems does not have place where we can track some “Drop Off Sites” for collection of supplies in minor disasters or during our daily life. These drop off sites can convenience stores, supermarket, hospitals, etc. People can donate supplies to one of these sites which might be most convenient for them and the organizations then can collect useful goods themselves. After talking with one of the managers from Sahana Software Foundation, we decide to add this new feature to the system.

== Technique Overview ==

The basic Sahana Eden architecture is as follows:

{| border="1" class="wikitable"
|-
! Web Server
| Apache || Other web servers can also be used, such as Cherokee.
|-
! Application
| Sahana Eden ||
|-
! Web Framework
| Web2py ||
|-
! Programming Language
| Python & Java Script ||
|-
! Database
| MySQL, PostgreSQL, or SQLite || MySQL, PostgreSQL, and SQLite are supported. Other databases should be usable without major additional work since Web2Py supplies many connectors.
|-
! Operating System
| Linux (Debian recommended) || Windows and Mac OS X are possible, but only recommended for single-user environments.
|}

=== Web2py ===

Web2py<ref>http://www.infoworld.com/d/application-development/pillars-python-six-python-web-frameworks-compared-169442</ref> is an open source framework, licensed under the LGPL version 3 License, developed and interpreted with the Python language and agile concept development that follows good software engineering practices. It is based on the [http://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller Model View Controller(MVC)] pattern. It also includes a Database Abstraction Layer (DAL) that writes SQL dynamically so the communication between the application and any database will be transparent. Since this framework includes various options in security, data access control, input validation on forms, it is been said that is built for security, because the framework addresses many of these issues.

Because Sahana Eden needs to be accessible to users at remote locations, including the public, a browser-based solution was essential. The system also needs to be able to be used on offline laptops, so it needs to run on a lightweight stack.

Python<ref>https://www.python.org/</ref> was selected as a suitable high level language allowing the rapid customization of code required for each individual circumstance yet has a large number of powerful libraries available including for Geo-spatial Information Systems (GIS).<ref>http://www.gis.usu.edu/~chrisg/python/2009/</ref>

=== S3 Framework ===

The Sahana Eden Software Platform(S3) has been built around a Rapid Application Development (RAD) Framework.<ref>http://en.flossmanuals.net/sahana-eden/technical-overview/</ref> This provides a high level of automation to ensure that new solutions can be quickly and effectively developed. Once a database table is defined, the Sahana Eden Framework automatically generates HTML pages to handle CRUD (Create, Read, Update, Delete) as well as Search, Map and Pivot Reports. Web Services are available to import and export in XML, CSV, JSON and EXtensible Stylesheet Language (XSL) transforms are supported to produce other data standards.

The Sahana Eden Framework has flexible authorization policies which can be configured to grant permissions for different modules, tables as well as the ability to have multiple Organizations control their own data on a single Sahana Eden installation.

== Design ==

=== Database ===

This is a basic relation established on the system between the place and the contact for the drop off site. An organization to each drop off sites, and one organization can have different representative for each site. Both of them are many-to-one relationship<ref>http://en.wikipedia.org/wiki/Relational_database</ref>. A dropOffSite table has six attributes: name, flyer, comments, startTime and endTime which indicates the time period the site will be open for donation, and personId as a foreign key to person table.

[[File:SahanaER.png]]

=== Framework ===

In order to add the capability to manage drop off sites information from within the Sahana Eden instance, we have two options: installing a separate package, or integrating this into the Sahana Eden instance. We have decided to use the latter so that :

* We don’t need to define data, like users, locations, organizations, in multiple systems.
* We can use Sahana Eden’s messaging and mapping capabilities for the drop off sites in the future.
* The organization module can use drop off sites records of personnel.

=== Design Pattern ===

* '''Factory Methods'''

In the controller, we return an s3_rest_controller() method, this function provides all the Sahana Eden framework support needed to access the resource, including automatic loading of the respective model definitions. With this method, we can have a working module and be able to see the CRUD (Create, Read, Update, Delete) user interface. We could define our own methods to do CRUD of drop off site module. In that case, the code will violate DRY principle. If all contributors to Sahana have done the CRUD themselves, there will be a lot of duplication and the readability of the system will decrease. However, we can replace the deault strings within the CRUD user interface with custom strings. To be specific, we use crud_strings() method in S3 framework to do customizations.

* '''Oberserver'''

Observer pattern is widely used in GUI systems. By the nature of Model-View-Controller(MVC) architecture, the observer pattern is used to decouple the model from the view. View represents the Observer and the model is the Observable object. This kind of framework can be enhanced in future with new observers with minimal changes.

=== Component ===

As shown above, we'd like to be able to record information relating to staff in each drop off site, such as how long they will be there and contact number etc. To do this, we need to build a 'link' table between the person and the drop off site. The natural way to do this within Sahana Eden is to make the link table a 'component' of the drop off site table. The drop off site is the 'primary resource', and contact person are a 'component' of the course.

To realize the 'component' feature. First, we add a 'represent' function to allow a record in the drop off site table to be represented by its name.

<pre>
def place_represent(id):
table = db.dosite_place
query = (table.id == id)
record = db(query).select().first()
if record:
return record.name
else:
return "-"
</pre>

This code involves using Web2Py's Database Abstraction Layer (DAL) to do a SQL query.The variable db is an instance of the DAL class, which represents a database. Queries are written in a syntax that is much like a Python expression.

Then, we define a 'reusable field' which can be added to other table definitions to provide a foreign key reference to the drop off site table.

<pre>
place_id = S3ReusableField("place_id", db.dosite_place,
requires = IS_ONE_OF(db,
"dosite_place.id",
"%(name)s"),
represent = place_represent,
label = T("Place"),
ondelete = "RESTRICT")
</pre>

Note that this uses the represent function which we just defined. It also adds a 'requires' validator function. This provides both server-side validation and a client-side widget (in this case a dropdown of records in the drop off site table).

As to the controller, we don't need to create a separate REST controller to manage the component, since it will always be accessed via the existing drop off site controller, however we must then extend the controller with 2 new elements to allow the Sahana Eden framework to display the component: 'tabs' and an 'rheader'. Tabs are how the framework provides access to the different components in a web page for the primary resource. The 'resource header' is a section of HTML that provides a summary of the primary resource record, in this case the drop off site. This is displayed above the tabs so that when each component record is being viewed, its parent record is also visible at the same time.

We can simply add the following code into the controller model. Here, rheader is simply a variable passed through the REST controller unaltered & then serialized as rheader.xml() in the views.

<pre>
def place_rheader(r, tabs=[]):
if r.representation != "html":
# RHeader is a UI facility & so skip for other formats
return None
if r.record is None:
# List or Create form: rheader makes no sense here
return None

rheader_tabs = s3_rheader_tabs(r, tabs)

place = r.record

rheader = DIV(TABLE(
TR(
TH("%s: " % T("Name")),
place.name,
TH("%s: " % T("Start Date")),
place.start_date,
)
), rheader_tabs)

return rheader
</pre>

== Implementation ==

* Define dropOtffSite table in our new models and its relationship with person table and organization table.

<pre>
tablename = "dosite_place"
table = db.define_table(tablename,
Field("name", notnull=True, length=64, label=T("Place Name")),
s3db.pr_person_id(label=T("Place Contact")),
Field("flyer", "upload",label=T("Flyer Propaganda")),
s3_comments(),
s3base.s3_date("start_date",label="Collection Start Date"),
s3base.s3_date("end_date",label="Collection End Date"),
*s3_meta_fields()
)
</pre>

* Add editable features to the the Drop Off Site list.

<pre>
LIST_PLACE = T("List Drop-Off Sites")
s3.crud_strings[tablename] = Storage(
title_create = T("Add New Place"),
title_display = T("Place Details"),
title_list = LIST_PLACE,
title_update = T("Edit Place"),
title_search = T("Search Place"),
title_upload = T("Import Place"),
subtitle_create = T("Add New Place"),
subtitle_list = T("Place"),
label_list_button = LIST_PLACE,
label_create_button = T("Add New Place"),
label_delete_button = T("Delete Place"),
msg_record_created = T("Place added"),
msg_record_modified = T("Place updated"),
msg_record_deleted = T("Place deleted"),
msg_list_empty = T("No Place currently registered"))
</pre>

* Customized the view in controller so that it fits Sahana Eden's standard.

<pre>
def place():
return s3_rest_controller(rheader=place_rheader)
</pre>

== Deliverables ==

The application can be accessed with the following link: [http://152.46.16.162/eden Sahana Eden Site]

We go through one use case to see how the system handles a drop off site information collection.

*Accessing "DropOff Site" from the main menu

[[File:Ss1.png]]

* After click on the menu, we will see a welcome page first. This page gives users a brief introduction of what is drop off site and how does it works.

[[File:Ss2.png]]

* Click on "list of drop off site" link, we'll see a list of drop off sites with their detail information. Then we can add a new record by clicking the button "Adding a Record".

[[File:Ss3.png]]

* Fill in the table with detail. Notice that here when you fill in the person name, you can look up their name by enter part of their name.

[[File:Ss4.png]]]

* After successfully add a new record, we can go back to see the new drop off site information.

[[File:Ss5.png]]

== Future Work ==

Based on the information we have now for Drop Off Site. We plan to add a location attribute to this table so that we can map this location information to mapping feature of Sahana.

Sahana has a fully integrated mapping functionality which allows any location-based data to be visualized on a map. What we can do is to add a layer on the map. When user want to view drop off site information, one can select "Drop off sites" label besides the map, then he will see some marked location on map which indicates available sites. When we click on these marked places, information about the sites, including detailed address and contact number will be available for users in a small text field.

== Further Reading ==

* [http://web2py.com/init/default/documentation Web2py]

* [http://diveintopython.org/ Python]

* [http://docs.jquery.com/ Jquery]

* [http://docs.sencha.com/ext-js/3-4/ Ext_JS 3.4.0]

= Reference =
<references/>
---

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-04-07T04:16:54Z

Jyang23:

[[File:sahana.jpg|right]]
This project is developed as a contribution to Sahana Software Foundation (Eden).

== Background ==

Sahana Eden is an open source software project that provides effective solutions for critical humanitarian needs management either prior to or during a crisis (mainly disasters).<ref>http://sahanafoundation.org/products/eden/</ref> This platform has a rich feature set which can be rapidly customized to adapt to existing process and integrate with existing systems.

Sahana Eden’s features are designed to help emergency management practitioners to better mitigate, prepare for, respond to and recover from disasters more effectively and efficiently. With this logistic software, strategic planning and the deployment of efforts of human resources and supplies to victims is handled in an efficient manner. It coordinates the information of all the components required to relieve in some way the pain of the affected victims.

Sahana Eden is supported by Sahana Software Foundation<ref>http://sahanafoundation.org/about-us/</ref> whose mission it to save lives by providing information management solutions that enable organizations and communities to better prepare for and respond to disasters. This is a voluntary community consisted of disaster management practitioners, academics, companies and students.

== Motivation ==

Sahana Eden provides a wide range of functionality. Its main capabilities include organization registry, project tracking, human resources management, inventory&assets tracking, assessments, shelter management, scenario&events planning, GIS mapping, messaging, etc.

Among all the features, inventory tracking keep records of shipments; supports multiple catalogs of items; and allow organization to manage requests, donations and warehouse. However, we found that the systems does not have place where we can track some “Drop Off Sites” for collection of supplies in minor disasters or during our daily life. These drop off sites can convenience stores, supermarket, hospitals, etc. People can donate supplies to one of these sites which might be most convenient for them and the organizations then can collect useful goods themselves. After talking with one of the managers from Sahana Software Foundation, we decide to add this new feature to the system.

== Technique Overview ==

The basic Sahana Eden architecture is as follows:

{| border="1" class="wikitable"
|-
! Web Server
| Apache || Other web servers can also be used, such as Cherokee.
|-
! Application
| Sahana Eden ||
|-
! Web Framework
| Web2py ||
|-
! Programming Language
| Python & Java Script ||
|-
! Database
| MySQL, PostgreSQL, or SQLite || MySQL, PostgreSQL, and SQLite are supported. Other databases should be usable without major additional work since Web2Py supplies many connectors.
|-
! Operating System
| Linux (Debian recommended) || Windows and Mac OS X are possible, but only recommended for single-user environments.
|}

=== Web2py ===

Web2py<ref>http://www.infoworld.com/d/application-development/pillars-python-six-python-web-frameworks-compared-169442</ref> is an open source framework, licensed under the LGPL version 3 License, developed and interpreted with the Python language and agile concept development that follows good software engineering practices. It is based on the [http://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller Model View Controller(MVC)] pattern. It also includes a Database Abstraction Layer (DAL) that writes SQL dynamically so the communication between the application and any database will be transparent. Since this framework includes various options in security, data access control, input validation on forms, it is been said that is built for security, because the framework addresses many of these issues.

Because Sahana Eden needs to be accessible to users at remote locations, including the public, a browser-based solution was essential. The system also needs to be able to be used on offline laptops, so it needs to run on a lightweight stack.

Python<ref>https://www.python.org/</ref> was selected as a suitable high level language allowing the rapid customization of code required for each individual circumstance yet has a large number of powerful libraries available including for Geo-spatial Information Systems (GIS).<ref>http://www.gis.usu.edu/~chrisg/python/2009/</ref>

=== S3 Framework ===

The Sahana Eden Software Platform(S3) has been built around a Rapid Application Development (RAD) Framework.<ref>http://en.flossmanuals.net/sahana-eden/technical-overview/</ref> This provides a high level of automation to ensure that new solutions can be quickly and effectively developed. Once a database table is defined, the Sahana Eden Framework automatically generates HTML pages to handle CRUD (Create, Read, Update, Delete) as well as Search, Map and Pivot Reports. Web Services are available to import and export in XML, CSV, JSON and EXtensible Stylesheet Language (XSL) transforms are supported to produce other data standards.

The Sahana Eden Framework has flexible authorization policies which can be configured to grant permissions for different modules, tables as well as the ability to have multiple Organizations control their own data on a single Sahana Eden installation.

== Design ==

=== Database ===

This is a basic relation established on the system between the place and the contact for the drop off site. An organization to each drop off sites, and one organization can have different representative for each site. Both of them are many-to-one relationship<ref>http://en.wikipedia.org/wiki/Relational_database</ref>. A dropOffSite table has six attributes: name, flyer, comments, startTime and endTime which indicates the time period the site will be open for donation, and personId as a foreign key to person table.

[[File:SahanaER.png]]

=== Framework ===

In order to add the capability to manage drop off sites information from within the Sahana Eden instance, we have two options: installing a separate package, or integrating this into the Sahana Eden instance. We have decided to use the latter so that :

* We don’t need to define data, like users, locations, organizations, in multiple systems.
* We can use Sahana Eden’s messaging and mapping capabilities for the drop off sites in the future.
* The organization module can use drop off sites records of personnel.

=== Design Pattern ===

* '''Factory Methods'''

In the controller, we return an s3_rest_controller() method, this function provides all the Sahana Eden framework support needed to access the resource, including automatic loading of the respective model definitions. We could define our own methods to do CRUD of drop off site module. In that case, the code will violate DRY principle. If all contributors to Sahana have done the CRUD themselves, there will be a lot of duplication and the readability of the system will decrease. However, we can replace the deault strings within the CRUD user interface with custom strings. To be specific, we use crud_strings() method in S3 framework to do customizations.

* '''Oberserver'''

Observer pattern is widely used in GUI systems. By the nature of Model-View-Controller(MVC) architecture, the observer pattern is used to decouple the model from the view. View represents the Observer and the model is the Observable object. This kind of framework can be enhanced in future with new observers with minimal changes.

=== Component ===

As shown above, we'd like to be able to record information relating to staff in each drop off site, such as how long they will be there and contact number etc. To do this, we need to build a 'link' table between the person and the drop off site. The natural way to do this within Sahana Eden is to make the link table a 'component' of the drop off site table. The drop off site is the 'primary resource', and contact person are a 'component' of the course.

To realize the 'component' feature. First, we add a 'represent' function to allow a record in the drop off site table to be represented by its name.

<pre>
def place_represent(id):
table = db.dosite_place
query = (table.id == id)
record = db(query).select().first()
if record:
return record.name
else:
return "-"
</pre>

This code involves using Web2Py's Database Abstraction Layer (DAL) to do a SQL query.The variable db is an instance of the DAL class, which represents a database. Queries are written in a syntax that is much like a Python expression.

Then, we define a 'reusable field' which can be added to other table definitions to provide a foreign key reference to the drop off site table.

<pre>
place_id = S3ReusableField("place_id", db.dosite_place,
requires = IS_ONE_OF(db,
"dosite_place.id",
"%(name)s"),
represent = place_represent,
label = T("Place"),
ondelete = "RESTRICT")
</pre>

Note that this uses the represent function which we just defined. It also adds a 'requires' validator function. This provides both server-side validation and a client-side widget (in this case a dropdown of records in the drop off site table).

As to the controller, we don't need to create a separate REST controller to manage the component, since it will always be accessed via the existing drop off site controller, however we must then extend the controller with 2 new elements to allow the Sahana Eden framework to display the component: 'tabs' and an 'rheader'. Tabs are how the framework provides access to the different components in a web page for the primary resource. The 'resource header' is a section of HTML that provides a summary of the primary resource record, in this case the drop off site. This is displayed above the tabs so that when each component record is being viewed, its parent record is also visible at the same time.

We can simply add the following code into the controller model. Here, rheader is simply a variable passed through the REST controller unaltered & then serialized as rheader.xml() in the views.

<pre>
def place_rheader(r, tabs=[]):
if r.representation != "html":
# RHeader is a UI facility & so skip for other formats
return None
if r.record is None:
# List or Create form: rheader makes no sense here
return None

rheader_tabs = s3_rheader_tabs(r, tabs)

place = r.record

rheader = DIV(TABLE(
TR(
TH("%s: " % T("Name")),
place.name,
TH("%s: " % T("Start Date")),
place.start_date,
)
), rheader_tabs)

return rheader
</pre>

== Implementation ==

* Define dropOtffSite table in our new models and its relationship with person table and organization table.

<pre>
tablename = "dosite_place"
table = db.define_table(tablename,
Field("name", notnull=True, length=64, label=T("Place Name")),
s3db.pr_person_id(label=T("Place Contact")),
Field("flyer", "upload",label=T("Flyer Propaganda")),
s3_comments(),
s3base.s3_date("start_date",label="Collection Start Date"),
s3base.s3_date("end_date",label="Collection End Date"),
*s3_meta_fields()
)
</pre>

* Add editable features to the the Drop Off Site list.

<pre>
LIST_PLACE = T("List Drop-Off Sites")
s3.crud_strings[tablename] = Storage(
title_create = T("Add New Place"),
title_display = T("Place Details"),
title_list = LIST_PLACE,
title_update = T("Edit Place"),
title_search = T("Search Place"),
title_upload = T("Import Place"),
subtitle_create = T("Add New Place"),
subtitle_list = T("Place"),
label_list_button = LIST_PLACE,
label_create_button = T("Add New Place"),
label_delete_button = T("Delete Place"),
msg_record_created = T("Place added"),
msg_record_modified = T("Place updated"),
msg_record_deleted = T("Place deleted"),
msg_list_empty = T("No Place currently registered"))
</pre>

* Customized the view in controller so that it fits Sahana Eden's standard.

<pre>
def place():
return s3_rest_controller(rheader=place_rheader)
</pre>

== Deliverables ==

The application can be accessed with the following link: [http://152.46.16.162/eden Sahana Eden Site]

We go through one use case to see how the system handles a drop off site information collection.

*Accessing "DropOff Site" from the main menu

[[File:Ss1.png]]

* After click on the menu, we will see a welcome page first. This page gives users a brief introduction of what is drop off site and how does it works.

[[File:Ss2.png]]

* Click on "list of drop off site" link, we'll see a list of drop off sites with their detail information. Then we can add a new record by clicking the button "Adding a Record".

[[File:Ss3.png]]

* Fill in the table with detail. Notice that here when you fill in the person name, you can look up their name by enter part of their name.

[[File:Ss4.png]]]

* After successfully add a new record, we can go back to see the new drop off site information.

[[File:Ss5.png]]

== Future Work ==

Based on the information we have now for Drop Off Site. We plan to add a location attribute to this table so that we can map this location information to mapping feature of Sahana.

Sahana has a fully integrated mapping functionality which allows any location-based data to be visualized on a map. What we can do is to add a layer on the map. When user want to view drop off site information, one can select "Drop off sites" label besides the map, then he will see some marked location on map which indicates available sites. When we click on these marked places, information about the sites, including detailed address and contact number will be available for users in a small text field.

== Further Reading ==

* [http://web2py.com/init/default/documentation Web2py]

* [http://diveintopython.org/ Python]

* [http://docs.jquery.com/ Jquery]

* [http://docs.sencha.com/ext-js/3-4/ Ext_JS 3.4.0]

= Reference =
<references/>
---

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-04-07T04:04:18Z

Jyang23: /* Design */

[[File:sahana.jpg|right]]
This project is developed as a contribution to Sahana Software Foundation (Eden).

== Background ==

Sahana Eden is an open source software project that provides effective solutions for critical humanitarian needs management either prior to or during a crisis (mainly disasters).<ref>http://sahanafoundation.org/products/eden/</ref> This platform has a rich feature set which can be rapidly customized to adapt to existing process and integrate with existing systems.

Sahana Eden’s features are designed to help emergency management practitioners to better mitigate, prepare for, respond to and recover from disasters more effectively and efficiently. With this logistic software, strategic planning and the deployment of efforts of human resources and supplies to victims is handled in an efficient manner. It coordinates the information of all the components required to relieve in some way the pain of the affected victims.

Sahana Eden is supported by Sahana Software Foundation<ref>http://sahanafoundation.org/about-us/</ref> whose mission it to save lives by providing information management solutions that enable organizations and communities to better prepare for and respond to disasters. This is a voluntary community consisted of disaster management practitioners, academics, companies and students.

== Motivation ==

Sahana Eden provides a wide range of functionality. Its main capabilities include organization registry, project tracking, human resources management, inventory&assets tracking, assessments, shelter management, scenario&events planning, GIS mapping, messaging, etc.

Among all the features, inventory tracking keep records of shipments; supports multiple catalogs of items; and allow organization to manage requests, donations and warehouse. However, we found that the systems does not have place where we can track some “Drop Off Sites” for collection of supplies in minor disasters or during our daily life. These drop off sites can convenience stores, supermarket, hospitals, etc. People can donate supplies to one of these sites which might be most convenient for them and the organizations then can collect useful goods themselves. After talking with one of the managers from Sahana Software Foundation, we decide to add this new feature to the system.

== Technique Overview ==

The basic Sahana Eden architecture is as follows:

{| border="1" class="wikitable"
|-
! Web Server
| Apache || Other web servers can also be used, such as Cherokee.
|-
! Application
| Sahana Eden ||
|-
! Web Framework
| Web2py ||
|-
! Programming Language
| Python & Java Script ||
|-
! Database
| MySQL, PostgreSQL, or SQLite || MySQL, PostgreSQL, and SQLite are supported. Other databases should be usable without major additional work since Web2Py supplies many connectors.
|-
! Operating System
| Linux (Debian recommended) || Windows and Mac OS X are possible, but only recommended for single-user environments.
|}

=== Web2py ===

Web2py<ref>http://www.infoworld.com/d/application-development/pillars-python-six-python-web-frameworks-compared-169442</ref> is an open source framework, licensed under the LGPL version 3 License, developed and interpreted with the Python language and agile concept development that follows good software engineering practices. It is based on the [http://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller Model View Controller(MVC)] pattern. It also includes a Database Abstraction Layer (DAL) that writes SQL dynamically so the communication between the application and any database will be transparent. Since this framework includes various options in security, data access control, input validation on forms, it is been said that is built for security, because the framework addresses many of these issues.

Because Sahana Eden needs to be accessible to users at remote locations, including the public, a browser-based solution was essential. The system also needs to be able to be used on offline laptops, so it needs to run on a lightweight stack.

Python<ref>https://www.python.org/</ref> was selected as a suitable high level language allowing the rapid customization of code required for each individual circumstance yet has a large number of powerful libraries available including for Geo-spatial Information Systems (GIS).<ref>http://www.gis.usu.edu/~chrisg/python/2009/</ref>

=== S3 Framework ===

The Sahana Eden Software Platform(S3) has been built around a Rapid Application Development (RAD) Framework.<ref>http://en.flossmanuals.net/sahana-eden/technical-overview/</ref> This provides a high level of automation to ensure that new solutions can be quickly and effectively developed. Once a database table is defined, the Sahana Eden Framework automatically generates HTML pages to handle CRUD (Create, Read, Update, Delete) as well as Search, Map and Pivot Reports. Web Services are available to import and export in XML, CSV, JSON and EXtensible Stylesheet Language (XSL) transforms are supported to produce other data standards.

The Sahana Eden Framework has flexible authorization policies which can be configured to grant permissions for different modules, tables as well as the ability to have multiple Organizations control their own data on a single Sahana Eden installation.

== Design ==

=== Database ===

This is a basic relation established on the system between the place and the contact for the drop off site. An organization to each drop off sites, and one organization can have different representative for each site. Both of them are many-to-one relationship<ref>http://en.wikipedia.org/wiki/Relational_database</ref>. A dropOffSite table has six attributes: name, flyer, comments, startTime and endTime which indicates the time period the site will be open for donation, and personId as a foreign key to person table.

[[File:SahanaER.png]]

=== Framework ===

In order to add the capability to manage drop off sites information from within the Sahana Eden instance, we have two options: installing a separate package, or integrating this into the Sahana Eden instance. We have decided to use the latter so that :

* We don’t need to define data, like users, locations, organizations, in multiple systems.
* We can use Sahana Eden’s messaging and mapping capabilities for the drop off sites in the future.
* The organization module can use drop off sites records of personnel.

=== Design Pattern ===

* '''Factory Methods'''

In the controller, we return an s3_rest_controller() method, this function provides all the Sahana Eden framework support needed to access the resource, including automatic loading of the respective model definitions. We could define our own methods to do CRUD of drop off site module. In that case, the code will violate DRY principle. If all contributors to Sahana have done the CRUD themselves, there will be a lot of duplication and the readability of the system will decrease. However, we can replace the deault strings within the CRUD user interface with custom strings. To be specific, we use crud_strings() method in S3 framework to do customizations.

* '''Oberserver'''

Observer pattern is widely used in GUI systems. By the nature of Model-View-Controller(MVC) architecture, the observer pattern is used to decouple the model from the view. View represents the Observer and the model is the Observable object. This kind of framework can be enhanced in future with new observers with minimal changes.

=== Component ===

As shown above, we'd like to be able to record information relating to staff in each drop off site, such as how long they will be there and contact number etc. To do this, we need to build a 'link' table between the person and the drop off site. The natural way to do this within Sahana Eden is to make the link table a 'component' of the drop off site table. The drop off site is the 'primary resource', and contact person are a 'component' of the course.

There is no need to create a separate REST controller to manage the component, since it will always be accessed via the existing drop off site controller, however we must then extend the controller with 2 new elements to allow the Sahana Eden framework to display the component: 'tabs' and an 'rheader'. Tabs are how the framework provides access to the different components in a web page for the primary resource. The 'resource header' is a section of HTML that provides a summary of the primary resource record, in this case the drop off site. This is displayed above the tabs so that when each component record is being viewed, its parent record is also visible at the same time.

To realize the 'component' feature. First, we add a 'represent' function to allow a record in the drop off site table to be represented by its name.

Tip: This involves using Web2Py's Database Abstraction Layer (DAL) to do a SQL query.The variable db is an instance of the DAL class, which represents a database. Queries are written in a syntax that is much like a Python expression, but not quite. Look at the Web2Py book (http://web2py.com/book) for more on the DAL.

Define a 'reusable field' which can be added to other table definitions to provide a foreign key reference to the course table

== Implementation ==

* Define dropOtffSite table in our new models and its relationship with person table and organization table.

<pre>
tablename = "dosite_place"
table = db.define_table(tablename,
Field("name", notnull=True, length=64, label=T("Place Name")),
s3db.pr_person_id(label=T("Place Contact")),
Field("flyer", "upload",label=T("Flyer Propaganda")),
s3_comments(),
s3base.s3_date("start_date",label="Collection Start Date"),
s3base.s3_date("end_date",label="Collection End Date"),
*s3_meta_fields()
)

def place_represent(id):
table = db.dosite_place
query = (table.id == id)
record = db(query).select().first()
if record:
return record.name
else:
return "-"

place_id = S3ReusableField("place_id", db.dosite_place,
requires = IS_ONE_OF(db,
"dosite_place.id",
"%(name)s"),
represent = place_represent,
label = T("Place"),
ondelete = "RESTRICT")
</pre>

* Add editable features to the the Drop Off Site list.

<pre>
LIST_PLACE = T("List Drop-Off Sites")
s3.crud_strings[tablename] = Storage(
title_create = T("Add New Place"),
title_display = T("Place Details"),
title_list = LIST_PLACE,
title_update = T("Edit Place"),
title_search = T("Search Place"),
title_upload = T("Import Place"),
subtitle_create = T("Add New Place"),
subtitle_list = T("Place"),
label_list_button = LIST_PLACE,
label_create_button = T("Add New Place"),
label_delete_button = T("Delete Place"),
msg_record_created = T("Place added"),
msg_record_modified = T("Place updated"),
msg_record_deleted = T("Place deleted"),
msg_list_empty = T("No Place currently registered"))
</pre>

* Customized the view in controller so that it fits Sahana Eden's standard.

<pre>
def place_rheader(r, tabs=[]):
if r.representation != "html":
# RHeader is a UI facility & so skip for other formats
return None
if r.record is None:
# List or Create form: rheader makes no sense here
return None

rheader_tabs = s3_rheader_tabs(r, tabs)

place = r.record

rheader = DIV(TABLE(
TR(
TH("%s: " % T("Name")),
place.name,
TH("%s: " % T("Start Date")),
place.start_date,
)
), rheader_tabs)

return rheader

def place():
return s3_rest_controller(rheader=place_rheader)
</pre>

== Deliverables ==

The application can be accessed with the following link: [http://152.46.16.162/eden Sahana Eden Site]

We go through one use case to see how the system handles a drop off site information collection.

*Accessing "DropOff Site" from the main menu

[[File:Ss1.png]]

* After click on the menu, we will see a welcome page first. This page gives users a brief introduction of what is drop off site and how does it works.

[[File:Ss2.png]]

* Click on "list of drop off site" link, we'll see a list of drop off sites with their detail information. Then we can add a new record by clicking the button "Adding a Record".

[[File:Ss3.png]]

* Fill in the table with detail. Notice that here when you fill in the person name, you can look up their name by enter part of their name.

[[File:Ss4.png]]]

* After successfully add a new record, we can go back to see the new drop off site information.

[[File:Ss5.png]]

== Future Work ==

Based on the information we have now for Drop Off Site. We plan to add a location attribute to this table so that we can map this location information to mapping feature of Sahana.

Sahana has a fully integrated mapping functionality which allows any location-based data to be visualized on a map. What we can do is to add a layer on the map. When user want to view drop off site information, one can select "Drop off sites" label besides the map, then he will see some marked location on map which indicates available sites. When we click on these marked places, information about the sites, including detailed address and contact number will be available for users in a small text field.

== Further Reading ==

* [http://web2py.com/init/default/documentation Web2py]

* [http://diveintopython.org/ Python]

* [http://docs.jquery.com/ Jquery]

* [http://docs.sencha.com/ext-js/3-4/ Ext_JS 3.4.0]

= Reference =
<references/>
---

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-04-05T01:14:56Z

Jyang23:

[[File:sahana.jpg|right]]
This project is developed as a contribution to Sahana Software Foundation (Eden).

== Background ==

Sahana Eden is an open source software project that provides effective solutions for critical humanitarian needs management either prior to or during a crisis (mainly disasters).<ref>http://sahanafoundation.org/products/eden/</ref> This platform has a rich feature set which can be rapidly customized to adapt to existing process and integrate with existing systems.

Sahana Eden’s features are designed to help emergency management practitioners to better mitigate, prepare for, respond to and recover from disasters more effectively and efficiently. With this logistic software, strategic planning and the deployment of efforts of human resources and supplies to victims is handled in an efficient manner. It coordinates the information of all the components required to relieve in some way the pain of the affected victims.

Sahana Eden is supported by Sahana Software Foundation<ref>http://sahanafoundation.org/about-us/</ref> whose mission it to save lives by providing information management solutions that enable organizations and communities to better prepare for and respond to disasters. This is a voluntary community consisted of disaster management practitioners, academics, companies and students.

== Motivation ==

Sahana Eden provides a wide range of functionality. Its main capabilities include organization registry, project tracking, human resources management, inventory&assets tracking, assessments, shelter management, scenario&events planning, GIS mapping, messaging, etc.

Among all the features, inventory tracking keep records of shipments; supports multiple catalogs of items; and allow organization to manage requests, donations and warehouse. However, we found that the systems does not have place where we can track some “Drop Off Sites” for collection of supplies in minor disasters or during our daily life. These drop off sites can convenience stores, supermarket, hospitals, etc. People can donate supplies to one of these sites which might be most convenient for them and the organizations then can collect useful goods themselves. After talking with one of the managers from Sahana Software Foundation, we decide to add this new feature to the system.

== Technique Overview ==

The basic Sahana Eden architecture is as follows:

{| border="1" class="wikitable"
|-
! Web Server
| Apache || Other web servers can also be used, such as Cherokee.
|-
! Application
| Sahana Eden ||
|-
! Web Framework
| Web2py ||
|-
! Programming Language
| Python & Java Script ||
|-
! Database
| MySQL, PostgreSQL, or SQLite || MySQL, PostgreSQL, and SQLite are supported. Other databases should be usable without major additional work since Web2Py supplies many connectors.
|-
! Operating System
| Linux (Debian recommended) || Windows and Mac OS X are possible, but only recommended for single-user environments.
|}

=== Web2py ===

Web2py<ref>http://www.infoworld.com/d/application-development/pillars-python-six-python-web-frameworks-compared-169442</ref> is an open source framework, licensed under the LGPL version 3 License, developed and interpreted with the Python language and agile concept development that follows good software engineering practices. It is based on the [http://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller Model View Controller(MVC)] pattern. It also includes a Database Abstraction Layer (DAL) that writes SQL dynamically so the communication between the application and any database will be transparent. Since this framework includes various options in security, data access control, input validation on forms, it is been said that is built for security, because the framework addresses many of these issues.

Because Sahana Eden needs to be accessible to users at remote locations, including the public, a browser-based solution was essential. The system also needs to be able to be used on offline laptops, so it needs to run on a lightweight stack.

Python<ref>https://www.python.org/</ref> was selected as a suitable high level language allowing the rapid customization of code required for each individual circumstance yet has a large number of powerful libraries available including for Geo-spatial Information Systems (GIS).<ref>http://www.gis.usu.edu/~chrisg/python/2009/</ref>

=== S3 Framework ===

The Sahana Eden Software Platform(S3) has been built around a Rapid Application Development (RAD) Framework.<ref>http://en.flossmanuals.net/sahana-eden/technical-overview/</ref> This provides a high level of automation to ensure that new solutions can be quickly and effectively developed. Once a database table is defined, the Sahana Eden Framework automatically generates HTML pages to handle CRUD (Create, Read, Update, Delete) as well as Search, Map and Pivot Reports. Web Services are available to import and export in XML, CSV, JSON and EXtensible Stylesheet Language (XSL) transforms are supported to produce other data standards.

The Sahana Eden Framework has flexible authorization policies which can be configured to grant permissions for different modules, tables as well as the ability to have multiple Organizations control their own data on a single Sahana Eden installation.

== Design ==

=== Database ===

This is a basic relation established on the system between the place and the contact for the drop off site. An organization to each drop off sites, and one organization can have different representative for each site. Both of them are many-to-one relationship<ref>http://en.wikipedia.org/wiki/Relational_database</ref>. A dropOffSite table has six attributes: name, flyer, comments, startTime and endTime which indicates the time period the site will be open for donation, and personId as a foreign key to person table.

[[File:SahanaER.png]]

=== Framework ===

In order to add the capability to manage drop off sites information from within the Sahana Eden instance, we have two options: installing a separate package, or integrating this into the Sahana Eden instance. We have decided to use the latter so that :

* We don’t need to define data, like users, locations, organizations, in multiple systems.
* We can use Sahana Eden’s messaging and mapping capabilities for the drop off sites in the future.
* The organization module can use drop off sites records of personnel.

=== Design Pattern ===

* '''Factory Methods'''

In the controller, we return an s3_rest_controller() method, this function provides all the Sahana Eden framework support needed to access the resource, including automatic loading of the respective model definitions. We could define our own methods to do CRUD of drop off site module. In that case, the code will violate DRY principle. If all contributors to Sahana have done the CRUD themselves, there will be a lot of duplication and the readability of the system will decrease. However, we can replace the deault strings within the CRUD user interface with custom strings. To be specific, we use crud_strings() method in S3 framework to do customizations.

* '''Oberserver'''

Observer pattern is widely used in GUI systems. By the nature of Model-View-Controller(MVC) architecture, the observer pattern is used to decouple the model from the view. View represents the Observer and the model is the Observable object. This kind of framework can be enhanced in future with new observers with minimal changes.

=== Component ===

As shown above, we'd like to be able to record information relating to staff in each drop off site, such as how long they will be there and contact number etc. To do this, we need to build a 'link' table between the person and the drop off site. The natural way to do this within Sahana Eden is to make the link table a 'component' of the drop off site table. The drop off site is the 'primary resource', and contact person are a 'component' of the course.

There is no need to create a separate REST controller to manage the component, since it will always be accessed via the existing course controller, however we must then extend the controller with 2 new elements to allow the Sahana Eden framework to display the component: 'tabs' and an 'rheader'. Tabs are how the framework provides access to the different components in a web page for the primary resource. The 'resource header' is a section of HTML that provides a summary of the primary resource record, in this case the course. This is displayed above the tabs so that when each component record is being viewed, its parent record is also visible at the same time.

== Implementation ==

* Define dropOtffSite table in our new models and its relationship with person table and organization table.

<pre>
tablename = "dosite_place"
table = db.define_table(tablename,
Field("name", notnull=True, length=64, label=T("Place Name")),
s3db.pr_person_id(label=T("Place Contact")),
Field("flyer", "upload",label=T("Flyer Propaganda")),
s3_comments(),
s3base.s3_date("start_date",label="Collection Start Date"),
s3base.s3_date("end_date",label="Collection End Date"),
*s3_meta_fields()
)

def place_represent(id):
table = db.dosite_place
query = (table.id == id)
record = db(query).select().first()
if record:
return record.name
else:
return "-"

place_id = S3ReusableField("place_id", db.dosite_place,
requires = IS_ONE_OF(db,
"dosite_place.id",
"%(name)s"),
represent = place_represent,
label = T("Place"),
ondelete = "RESTRICT")
</pre>

* Add editable features to the the Drop Off Site list.

<pre>
LIST_PLACE = T("List Drop-Off Sites")
s3.crud_strings[tablename] = Storage(
title_create = T("Add New Place"),
title_display = T("Place Details"),
title_list = LIST_PLACE,
title_update = T("Edit Place"),
title_search = T("Search Place"),
title_upload = T("Import Place"),
subtitle_create = T("Add New Place"),
subtitle_list = T("Place"),
label_list_button = LIST_PLACE,
label_create_button = T("Add New Place"),
label_delete_button = T("Delete Place"),
msg_record_created = T("Place added"),
msg_record_modified = T("Place updated"),
msg_record_deleted = T("Place deleted"),
msg_list_empty = T("No Place currently registered"))
</pre>

* Customized the view in controller so that it fits Sahana Eden's standard.

<pre>
def place_rheader(r, tabs=[]):
if r.representation != "html":
# RHeader is a UI facility & so skip for other formats
return None
if r.record is None:
# List or Create form: rheader makes no sense here
return None

rheader_tabs = s3_rheader_tabs(r, tabs)

place = r.record

rheader = DIV(TABLE(
TR(
TH("%s: " % T("Name")),
place.name,
TH("%s: " % T("Start Date")),
place.start_date,
)
), rheader_tabs)

return rheader

def place():
return s3_rest_controller(rheader=place_rheader)
</pre>

== Deliverables ==

We go through one use case to see how the system handles a drop off site information collection.

*Accessing "DropOff Site" from the main menu

[[File:Ss1.png]]

* After click on the menu, we will see a welcome page first. This page gives users a brief introduction of what is drop off site and how does it works.

[[File:Ss2.png]]

* Click on "list of drop off site" link, we'll see a list of drop off sites with their detail information. Then we can add a new record by clicking the button "Adding a Record".

[[File:Ss3.png]]

* Fill in the table with detail. Notice that here when you fill in the person name, you can look up their name by enter part of their name.

[[File:Ss4.png]]]

* After successfully add a new record, we can go back to see the new drop off site information.

[[File:Ss5.png]]

== Future Work ==

Based on the information we have now for Drop Off Site. We plan to add a location attribute to this table so that we can map this location information to mapping feature of Sahana.

Sahana has a fully integrated mapping functionality which allows any location-based data to be visualized on a map. What we can do is to add a layer on the map. When user want to view drop off site information, one can select "Drop off sites" label besides the map, then he will see some marked location on map which indicates available sites. When we click on these marked places, information about the sites, including detailed address and contact number will be available for users in a small text field.

== Further Reading ==

* [http://web2py.com/init/default/documentation Web2py]

* [http://diveintopython.org/ Python]

* [http://docs.jquery.com/ Jquery]

* [http://docs.sencha.com/ext-js/3-4/ Ext_JS 3.4.0]

= Reference =
<references/>
---

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-04-04T04:26:27Z

Jyang23:

[[File:sahana.jpg|right]]
This project is developed as a contribution to Sahana Software Foundation (Eden).

== Background ==

Sahana Eden is an open source software project that provides effective solutions for critical humanitarian needs management either prior to or during a crisis (mainly disasters).<ref>http://sahanafoundation.org/products/eden/</ref> This platform has a rich feature set which can be rapidly customized to adapt to existing process and integrate with existing systems.

Sahana Eden’s features are designed to help emergency management practitioners to better mitigate, prepare for, respond to and recover from disasters more effectively and efficiently. With this logistic software, strategic planning and the deployment of efforts of human resources and supplies to victims is handled in an efficient manner. It coordinates the information of all the components required to relieve in some way the pain of the affected victims.

Sahana Eden is supported by Sahana Software Foundation<ref>http://sahanafoundation.org/about-us/</ref> whose mission it to save lives by providing information management solutions that enable organizations and communities to better prepare for and respond to disasters. This is a voluntary community consisted of disaster management practitioners, academics, companies and students.

== Motivation ==

Sahana Eden provides a wide range of functionality. Its main capabilities include organization registry, project tracking, human resources management, inventory&assets tracking, assessments, shelter management, scenario&events planning, GIS mapping, messaging, etc.

Among all the features, inventory tracking keep records of shipments; supports multiple catalogs of items; and allow organization to manage requests, donations and warehouse. However, we found that the systems does not have place where we can track some “Drop Off Sites” for collection of supplies in minor disasters or during our daily life. These drop off sites can convenience stores, supermarket, hospitals, etc. People can donate supplies to one of these sites which might be most convenient for them and the organizations then can collect useful goods themselves. After talking with one of the managers from Sahana Software Foundation, we decide to add this new feature to the system.

== Technique Overview ==

The basic Sahana Eden architecture is as follows:

{| border="1" class="wikitable"
|-
! Web Server
| Apache || Other web servers can also be used, such as Cherokee.
|-
! Application
| Sahana Eden ||
|-
! Web Framework
| Web2py ||
|-
! Programming Language
| Python & Java Script ||
|-
! Database
| MySQL, PostgreSQL, or SQLite || MySQL, PostgreSQL, and SQLite are supported. Other databases should be usable without major additional work since Web2Py supplies many connectors.
|-
! Operating System
| Linux (Debian recommended) || Windows and Mac OS X are possible, but only recommended for single-user environments.
|}

=== Web2py ===

Web2py<ref>http://www.infoworld.com/d/application-development/pillars-python-six-python-web-frameworks-compared-169442</ref> is an open source framework, licensed under the LGPL version 3 License, developed and interpreted with the Python language and agile concept development that follows good software engineering practices. It is based on the [http://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller Model View Controller(MVC)] pattern. It also includes a Database Abstraction Layer (DAL) that writes SQL dynamically so the communication between the application and any database will be transparent. Since this framework includes various options in security, data access control, input validation on forms, it is been said that is built for security, because the framework addresses many of these issues.

Because Sahana Eden needs to be accessible to users at remote locations, including the public, a browser-based solution was essential. The system also needs to be able to be used on offline laptops, so it needs to run on a lightweight stack.

Python<ref>https://www.python.org/</ref> was selected as a suitable high level language allowing the rapid customization of code required for each individual circumstance yet has a large number of powerful libraries available including for Geo-spatial Information Systems (GIS).<ref>http://www.gis.usu.edu/~chrisg/python/2009/</ref>

=== S3 Framework ===

The Sahana Eden Software Platform(S3) has been built around a Rapid Application Development (RAD) Framework.<ref>http://en.flossmanuals.net/sahana-eden/technical-overview/</ref> This provides a high level of automation to ensure that new solutions can be quickly and effectively developed. Once a database table is defined, the Sahana Eden Framework automatically generates HTML pages to handle CRUD (Create, Read, Update, Delete) as well as Search, Map and Pivot Reports. Web Services are available to import and export in XML, CSV, JSON and EXtensible Stylesheet Language (XSL) transforms are supported to produce other data standards.

The Sahana Eden Framework has flexible authorization policies which can be configured to grant permissions for different modules, tables as well as the ability to have multiple Organizations control their own data on a single Sahana Eden installation.

== Design ==

=== Database ===

This is a basic relation established on the system between the place and the contact for the drop off site. An organization to each drop off sites, and one organization can have different representative for each site. Both of them are many-to-one relationship<ref>http://en.wikipedia.org/wiki/Relational_database</ref>. A dropOffSite table has six attributes: name, flyer, comments, startTime and endTime which indicates the time period the site will be open for donation, and personId as a foreign key to person table.

[[File:SahanaER.png]]

=== Framework ===

In order to add the capability to manage drop off sites information from within the Sahana Eden instance, we have two options: installing a separate package, or integrating this into the Sahana Eden instance. We have decided to use the latter so that :

* We don’t need to define data, like users, locations, organizations, in multiple systems.
* We can use Sahana Eden’s messaging and mapping capabilities for the drop off sites in the future.
* The organization module can use drop off sites records of personnel.

=== Design Pattern ===

* '''Factory Methods'''

In the controller, we return an s3_rest_controller() method, this function provides all the Sahana Eden framework support needed to access the resource, including automatic loading of the respective model definitions. We could define our own methods to do CRUD of drop off site module. In that case, the code will violate DRY principle. If all contributors to Sahana have done the CRUD themselves, there will be a lot of duplication and the readability of the system will decrease. However, we can replace the deault strings within the CRUD user interface with custom strings. To be specific, we use crud_strings() method in S3 framework to do customizations.

* '''Oberserver'''

Observer pattern is widely used in GUI systems. By the nature of Model-View-Controller(MVC) architecture, the observer pattern is used to decouple the model from the view. View represents the Observer and the model is the Observable object. This kind of framework can be enhanced in future with new observers with minimal changes.

=== Component ===

We'd like to be able to record information relating to each participant in the course, such as whether they actually attended and what grade they attained.

To do this, we need to build a 'link' table between the participants and the course.

The natural way to do this within Sahana Eden is to make the link table a 'component' of the course. The course is the 'primary resource', and participants are a 'component' of the course.

== Implementation ==

* Define dropOtffSite table in our new models and its relationship with person table and organization table.

<pre>
tablename = "dosite_place"
table = db.define_table(tablename,
Field("name", notnull=True, length=64, label=T("Place Name")),
s3db.pr_person_id(label=T("Place Contact")),
Field("flyer", "upload",label=T("Flyer Propaganda")),
s3_comments(),
s3base.s3_date("start_date",label="Collection Start Date"),
s3base.s3_date("end_date",label="Collection End Date"),
*s3_meta_fields()
)

def place_represent(id):
table = db.dosite_place
query = (table.id == id)
record = db(query).select().first()
if record:
return record.name
else:
return "-"

place_id = S3ReusableField("place_id", db.dosite_place,
requires = IS_ONE_OF(db,
"dosite_place.id",
"%(name)s"),
represent = place_represent,
label = T("Place"),
ondelete = "RESTRICT")
</pre>

* Add editable features to the the Drop Off Site list.

<pre>
LIST_PLACE = T("List Drop-Off Sites")
s3.crud_strings[tablename] = Storage(
title_create = T("Add New Place"),
title_display = T("Place Details"),
title_list = LIST_PLACE,
title_update = T("Edit Place"),
title_search = T("Search Place"),
title_upload = T("Import Place"),
subtitle_create = T("Add New Place"),
subtitle_list = T("Place"),
label_list_button = LIST_PLACE,
label_create_button = T("Add New Place"),
label_delete_button = T("Delete Place"),
msg_record_created = T("Place added"),
msg_record_modified = T("Place updated"),
msg_record_deleted = T("Place deleted"),
msg_list_empty = T("No Place currently registered"))
</pre>

* Customized the view in controller so that it fits Sahana Eden's standard.

<pre>
def place_rheader(r, tabs=[]):
if r.representation != "html":
# RHeader is a UI facility & so skip for other formats
return None
if r.record is None:
# List or Create form: rheader makes no sense here
return None

rheader_tabs = s3_rheader_tabs(r, tabs)

place = r.record

rheader = DIV(TABLE(
TR(
TH("%s: " % T("Name")),
place.name,
TH("%s: " % T("Start Date")),
place.start_date,
)
), rheader_tabs)

return rheader

def place():
return s3_rest_controller(rheader=place_rheader)
</pre>

== Deliverables ==

We go through one use case to see how the system handles a drop off site information collection.

*Accessing "DropOff Site" from the main menu

[[File:Ss1.png]]

* After click on the menu, we will see a welcome page first. This page gives users a brief introduction of what is drop off site and how does it works.

[[File:Ss2.png]]

* Click on "list of drop off site" link, we'll see a list of drop off sites with their detail information. Then we can add a new record by clicking the button "Adding a Record".

[[File:Ss3.png]]

* Fill in the table with detail. Notice that here when you fill in the person name, you can look up their name by enter part of their name.

[[File:Ss4.png]]]

* After successfully add a new record, we can go back to see the new drop off site information.

[[File:Ss5.png]]

== Future Work ==

Based on the information we have now for Drop Off Site. We plan to add a location attribute to this table so that we can map this location information to mapping feature of Sahana.

Sahana has a fully integrated mapping functionality which allows any location-based data to be visualized on a map. What we can do is to add a layer on the map. When user want to view drop off site information, one can select "Drop off sites" label besides the map, then he will see some marked location on map which indicates available sites. When we click on these marked places, information about the sites, including detailed address and contact number will be available for users in a small text field.

== Further Reading ==

* [http://web2py.com/init/default/documentation Web2py]

* [http://diveintopython.org/ Python]

* [http://docs.jquery.com/ Jquery]

* [http://docs.sencha.com/ext-js/3-4/ Ext_JS 3.4.0]

= Reference =
<references/>
---

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-03-31T21:39:25Z

Jyang23: /* Further Reading */

[[File:sahana.jpg|right]]
This project is developed as a contribution to Sahana Software Foundation (Eden).

== Background ==

Sahana Eden is an open source software project that provides effective solutions for critical humanitarian needs management either prior to or during a crisis (mainly disasters).<ref>http://sahanafoundation.org/products/eden/</ref> This platform has a rich feature set which can be rapidly customized to adapt to existing process and integrate with existing systems.

Sahana Eden’s features are designed to help emergency management practitioners to better mitigate, prepare for, respond to and recover from disasters more effectively and efficiently. With this logistic software, strategic planning and the deployment of efforts of human resources and supplies to victims is handled in an efficient manner. It coordinates the information of all the components required to relieve in some way the pain of the affected victims.

Sahana Eden is supported by Sahana Software Foundation<ref>http://sahanafoundation.org/about-us/</ref> whose mission it to save lives by providing information management solutions that enable organizations and communities to better prepare for and respond to disasters. This is a voluntary community consisted of disaster management practitioners, academics, companies and students.

== Motivation ==

Sahana Eden provides a wide range of functionality. Its main capabilities include organization registry, project tracking, human resources management, inventory&assets tracking, assessments, shelter management, scenario&events planning, GIS mapping, messaging, etc.

Among all the features, inventory tracking keep records of shipments; supports multiple catalogs of items; and allow organization to manage requests, donations and warehouse. However, we found that the systems does not have place where we can track some “Drop Off Sites” for collection of supplies in minor disasters or during our daily life. These drop off sites can convenience stores, supermarket, hospitals, etc. People can donate supplies to one of these sites which might be most convenient for them and the organizations then can collect useful goods themselves. After talking with one of the managers from Sahana Software Foundation, we decide to add this new feature to the system.

== Technique Overview ==

The basic Sahana Eden architecture is as follows:

{| border="1" class="wikitable"
|-
! Web Server
| Apache || Other web servers can also be used, such as Cherokee.
|-
! Application
| Sahana Eden ||
|-
! Web Framework
| Web2py ||
|-
! Programming Language
| Python & Java Script ||
|-
! Database
| MySQL, PostgreSQL, or SQLite || MySQL, PostgreSQL, and SQLite are supported. Other databases should be usable without major additional work since Web2Py supplies many connectors.
|-
! Operating System
| Linux (Debian recommended) || Windows and Mac OS X are possible, but only recommended for single-user environments.
|}

=== Web2py ===

Web2py<ref>http://www.infoworld.com/d/application-development/pillars-python-six-python-web-frameworks-compared-169442</ref> is an open source framework, licensed under the LGPL version 3 License, developed and interpreted with the Python language and agile concept development that follows good software engineering practices. It is based on the [http://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller Model View Controller(MVC)] pattern. It also includes a Database Abstraction Layer (DAL) that writes SQL dynamically so the communication between the application and any database will be transparent. Since this framework includes various options in security, data access control, input validation on forms, it is been said that is built for security, because the framework addresses many of these issues.

Because Sahana Eden needs to be accessible to users at remote locations, including the public, a browser-based solution was essential. The system also needs to be able to be used on offline laptops, so it needs to run on a lightweight stack.

Python<ref>https://www.python.org/</ref> was selected as a suitable high level language allowing the rapid customization of code required for each individual circumstance yet has a large number of powerful libraries available including for Geo-spatial Information Systems (GIS).<ref>http://www.gis.usu.edu/~chrisg/python/2009/</ref>

=== S3 Framework ===

The Sahana Eden Software Platform(S3) has been built around a Rapid Application Development (RAD) Framework.<ref>http://en.flossmanuals.net/sahana-eden/technical-overview/</ref> This provides a high level of automation to ensure that new solutions can be quickly and effectively developed. Once a database table is defined, the Sahana Eden Framework automatically generates HTML pages to handle CRUD (Create, Read, Update, Delete) as well as Search, Map and Pivot Reports. Web Services are available to import and export in XML, CSV, JSON and EXtensible Stylesheet Language (XSL) transforms are supported to produce other data standards.

The Sahana Eden Framework has flexible authorization policies which can be configured to grant permissions for different modules, tables as well as the ability to have multiple Organizations control their own data on a single Sahana Eden installation.

== Design ==

This is a basic relation established on the system between the place and the contact for the dropoff site. An organization to each drop off sites, and one organization can have different representative for each site. Both of them are many-to-one relationship<ref>http://en.wikipedia.org/wiki/Relational_database</ref>. A dropOffSite table has six attributes: name, flyer, comments, startTime and endTime which indicates the time period the site will be open for donation, and personId as a foreign key to person table.

[[File:SahanaER.png]]

== Implementation ==

* Define dropOtffSite table in our new models and its relationship with person table and organization table.

<pre>
tablename = "dosite_place"
table = db.define_table(tablename,
Field("name", notnull=True, length=64, label=T("Place Name")),
s3db.pr_person_id(label=T("Place Contact")),
Field("flyer", "upload",label=T("Flyer Propaganda")),
s3_comments(),
s3base.s3_date("start_date",label="Collection Start Date"),
s3base.s3_date("end_date",label="Collection End Date"),
*s3_meta_fields()
)

def place_represent(id):
table = db.dosite_place
query = (table.id == id)
record = db(query).select().first()
if record:
return record.name
else:
return "-"

place_id = S3ReusableField("place_id", db.dosite_place,
requires = IS_ONE_OF(db,
"dosite_place.id",
"%(name)s"),
represent = place_represent,
label = T("Place"),
ondelete = "RESTRICT")
</pre>

* Add editable features to the the Drop Off Site list.

<pre>
LIST_PLACE = T("List Drop-Off Sites")
s3.crud_strings[tablename] = Storage(
title_create = T("Add New Place"),
title_display = T("Place Details"),
title_list = LIST_PLACE,
title_update = T("Edit Place"),
title_search = T("Search Place"),
title_upload = T("Import Place"),
subtitle_create = T("Add New Place"),
subtitle_list = T("Place"),
label_list_button = LIST_PLACE,
label_create_button = T("Add New Place"),
label_delete_button = T("Delete Place"),
msg_record_created = T("Place added"),
msg_record_modified = T("Place updated"),
msg_record_deleted = T("Place deleted"),
msg_list_empty = T("No Place currently registered"))
</pre>

* Customized the view in controller so that it fits Sahana Eden's standard.

<pre>
def place_rheader(r, tabs=[]):
if r.representation != "html":
# RHeader is a UI facility & so skip for other formats
return None
if r.record is None:
# List or Create form: rheader makes no sense here
return None

rheader_tabs = s3_rheader_tabs(r, tabs)

place = r.record

rheader = DIV(TABLE(
TR(
TH("%s: " % T("Name")),
place.name,
TH("%s: " % T("Start Date")),
place.start_date,
)
), rheader_tabs)

return rheader

def place():
return s3_rest_controller(rheader=place_rheader)
</pre>

== Deliverables ==

We go through one use case to see how the system handles a drop off site information collection.

*Accessing "DropOff Site" from the main menu

[[File:Ss1.png]]

* After click on the menu, we will see a welcome page first. This page gives users a brief introduction of what is drop off site and how does it works.

[[File:Ss2.png]]

* Click on "list of drop off site" link, we'll see a list of drop off sites with their detail information. Then we can add a new record by clicking the button "Adding a Record".

[[File:Ss3.png]]

* Fill in the table with detail. Notice that here when you fill in the person name, you can look up their name by enter part of their name.

[[File:Ss4.png]]]

* After successfully add a new record, we can go back to see the new drop off site information.

[[File:Ss5.png]]

== Future Work ==

Based on the information we have now for Drop Off Site. We plan to add a location attribute to this table so that we can map this location information to mapping feature of Sahana.

Sahana has a fully integrated mapping functionality which allows any location-based data to be visualized on a map. What we can do is to add a layer on the map. When user want to view drop off site information, one can select "Drop off sites" label besides the map, then he will see some marked location on map which indicates available sites. When we click on these marked places, information about the sites, including detailed address and contact number will be available for users in a small text field.

== Further Reading ==

* [http://web2py.com/init/default/documentation Web2py]

* [http://diveintopython.org/ Python]

* [http://docs.jquery.com/ Jquery]

* [http://docs.sencha.com/ext-js/3-4/ Ext_JS 3.4.0]

= Reference =
<references/>
---

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-03-31T21:23:46Z

Jyang23: /* Drop Off Site Feature */

File:Ss5.png

2014-03-31T21:22:43Z

Jyang23:

File:Ss4.png

2014-03-31T21:11:52Z

Jyang23: DropOffSite Snapshot4

DropOffSite Snapshot4

File:Ss3.png

2014-03-31T21:11:22Z

Jyang23: DropOffSite Snapshot3

DropOffSite Snapshot3

File:Ss2.png

2014-03-31T21:08:28Z

Jyang23: DropOffSite Snapshot2

DropOffSite Snapshot2

File:Ss1.png

2014-03-31T21:06:37Z

Jyang23: DropOffSite Snapshot1

DropOffSite Snapshot1

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-03-31T20:59:29Z

Jyang23:

File:SahanaER.png

2014-03-31T20:35:13Z

Jyang23: drop off site ER

drop off site ER

File:ER.png

2014-03-31T15:09:22Z

Jyang23: uploaded a new version of "File:ER.png"

Sahana ER diagram

File:ER.png

2014-03-31T15:08:40Z

Jyang23: uploaded a new version of "File:ER.png"

Sahana ER diagram

File:ER.png

2014-03-31T15:07:55Z

Jyang23: Sahana ER diagram

Sahana ER diagram

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-03-31T14:50:29Z

Jyang23:

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-03-31T07:42:09Z

Jyang23:

[[File:sahana.jpg|right]]
This project is developed as a contribution to Sahana Software Foundation (Eden).

= Background =

Sahana Eden is an open source software project that provides effective solutions for critical humanitarian needs management either prior to or during a crisis (mainly disasters).<ref>http://sahanafoundation.org/products/eden/</ref> This platform has a rich feature set which can be rapidly customized to adapt to existing process and integrate with existing systems.

Sahana Eden’s features are designed to help emergency management practitioners to better mitigate, prepare for, respond to and recover from disasters more effectively and efficiently. With this logistic software, strategic planning and the deployment of efforts of human resources and supplies to victims is handled in an efficient manner. It coordinates the information of all the components required to relieve in some way the pain of the affected victims.

Sahana Eden is supported by Sahana Software Foundation<ref>http://sahanafoundation.org/about-us/</ref> whose mission it to save lives by providing information management solutions that enable organizations and communities to better prepare for and respond to disasters. This is a voluntary community consisted of disaster management practitioners, academics, companies and students.

= Motivation =

Sahana Eden provides a wide range of functionality. Its main capabilities include organization registry, project tracking, human resources management, inventory&assets tracking, assessments, shelter management, scenario&events planning, GIS mapping, messaging, etc.

Among all the features, inventory tracking keep records of shipments; supports multiple catalogs of items; and allow organization to manage requests, donations and warehouse. However, we found that the systems does not have place where we can track some “Drop Off Sites” for collection of supplies in minor disasters or during our daily life. These drop off sites can convenience stores, supermarket, hospitals, etc. People can donate supplies to one of these sites which might be most convenient for them and the organizations then can collect useful goods themselves. After talking with one of the managers from Sahana Software Foundation, we decide to add this new feature to the system.

= Technique Overview =

The basic Sahana Eden architecture is as follows:

{| border="1" class="wikitable"
|-
! Web Server
| Apache || Other web servers can also be used, such as Cherokee.
|-
! Application
| Sahana Eden ||
|-
! Web Framework
| Web2py ||
|-
! Programming Language
| Python & Java Script ||
|-
! Database
| MySQL, PostgreSQL, or SQLite || MySQL, PostgreSQL, and SQLite are supported. Other databases should be usable without major additional work since Web2Py supplies many connectors.
|-
! Operating System
| Linux (Debian recommended) || Windows and Mac OS X are possible, but only recommended for single-user environments.
|}

== Web2py ==

Web2py<ref>http://www.infoworld.com/d/application-development/pillars-python-six-python-web-frameworks-compared-169442</ref> is an open source framework, licensed under the LGPL version 3 License, developed and interpreted with the Python language and agile concept development that follows good software engineering practices. It is based on the [http://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller Model View Controller(MVC)] pattern. It also includes a Database Abstraction Layer (DAL) that writes SQL dynamically so the communication between the application and any database will be transparent. Since this framework includes various options in security, data access control, input validation on forms, it is been said that is built for security, because the framework addresses many of these issues.

Because Sahana Eden needs to be accessible to users at remote locations, including the public, a browser-based solution was essential. The system also needs to be able to be used on offline laptops, so it needs to run on a lightweight stack.

Python<ref>https://www.python.org/</ref> was selected as a suitable high level language allowing the rapid customization of code required for each individual circumstance yet has a large number of powerful libraries available including for Geo-spatial Information Systems (GIS).<ref>http://www.gis.usu.edu/~chrisg/python/2009/</ref>

== S3 Framework ==

The Sahana Eden Software Platform(S3) has been built around a Rapid Application Development (RAD) Framework.<ref>http://en.flossmanuals.net/sahana-eden/technical-overview/</ref> This provides a high level of automation to ensure that new solutions can be quickly and effectively developed. Once a database table is defined, the Sahana Eden Framework automatically generates HTML pages to handle CRUD (Create, Read, Update, Delete) as well as Search, Map and Pivot Reports. Web Services are available to import and export in XML, CSV, JSON and EXtensible Stylesheet Language (XSL) transforms are supported to produce other data standards.

The Sahana Eden Framework has flexible authorization policies which can be configured to grant permissions for different modules, tables as well as the ability to have multiple Organizations control their own data on a single Sahana Eden installation.

= Design =

This is a basic relation established on the system between the place and the contact for the dropoff site.

We assign an organization to each drop off sites, and one organization can have different representative for each site. Both of them are many-to-one relationship<ref>http://en.wikipedia.org/wiki/Relational_database</ref>.

= Implementation =

= Drop Off Site Feature =

= Future Work =

Based on the information we have now for Drop Off Site. We plan to add a location attribute to this table so that we can map this location information to mapping feature of Sahana.

Sahana has a fully integrated mapping functionality which allows any location-based data to be visualized on a map. What we can do is to add a layer on the map. When user want to view drop off site information, one can select "Drop off sites" label besides the map, then he will see some marked location on map which indicates available sites. When we click on these marked places, information about the sites, including detailed address and contact number will be available for users in a small text field.

= Further Reading =

* [http://web2py.com/init/default/documentation]

* [http://diveintopython.org/]

* [http://docs.jquery.com/]

* [http://docs.sencha.com/ext-js/3-4/]

= Reference =
<references/>
---

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-03-31T07:04:07Z

Jyang23:

[[File:sahana.jpg|right]]
This project is developed as a contribution to Sahana Software Foundation (Eden).

= Background =

Sahana Eden is an open source software project that provides effective solutions for critical humanitarian needs management either prior to or during a crisis (mainly disasters). This platform has a rich feature set which can be rapidly customized to adapt to existing process and integrate with existing systems.

Sahana Eden’s features are designed to help emergency management practitioners to better mitigate, prepare for, respond to and recover from disasters more effectively and efficiently. With this logistic software, strategic planning and the deployment of efforts of human resources and supplies to victims is handled in an efficient manner. It coordinates the information of all the components required to relieve in some way the pain of the affected victims.

Sahana Eden is supported by Sahana Software Foundation whose mission it to save lives by providing information management solutions that enable organizations and communities to better prepare for and respond to disasters. This is a voluntary community consisted of disaster management practitioners, academics, companies and students.

= Motivation =

Sahana Eden provides a wide range of functionalities. Its main capabilities include organization registry, project tracking, human resources management, inventory&assets tracking, assessments, shelter management, scenario&events planning, gis mapping, messaging, etc.

Among all the features, inventory tracking keep records of shipments; supports multiple catalogs of items; and allow organization to manage requests, donations and warehouse. However, we found that the systems does not have place where we can track some “Drop Off Sites” for collection of supplies in minor disasters or during our daily life. These drop off sites can convenience stores, supermarket, hospitals, etc. People can donate supplies to one of these sites which might be most convenient for them and the organizations then can collect useful goods themselves. After talking with one of the managers from Sahana Software Foundation, we decide to add this new feature to the system.

= Technique Overview =

The basic Sahana Eden architecture is as follows:

{| border="1" class="wikitable"
|-
! Web Server
| Apache || Other web servers can also be used, such as Cherokee.
|-
! Application
| Sahana Eden ||
|-
! Web Framework
| Web2py ||
|-
! Programming Language
| Python & Java Script ||
|-
! Database
| MySQL, PostgreSQL, or SQLite || MySQL, PostgreSQL, and SQLite are supported. Other databases should be usable without major additional work since Web2Py supplies many connectors.
|-
! Operating System
| Linux (Debian recommended) || Windows and Mac OS X are possible, but only recommended for single-user environments.
|}

== Web2py ==

Web2py is an open source framework, licensed under the LGPL version 3 License, developed and interpreted with the Python language and agile concept development that follows good software engineering practices. It is based on the Model View Controller (MVC) pattern. It also includes a Database Abstraction Layer (DAL) that writes SQL dynamically so the communication between the application and any database will be transparent. Since this framework includes various options in security, data access control, input validation on forms, it is been said that is built for security, because the framework addresses many of these issues.

Because Sahana Eden needs to be accessible to users at remote locations, including the public, a browser-based solution was essential. The system also needs to be able to be used on offline laptops, so it needs to run on a lightweight stack.

Python was selected as a suitable high level language allowing the rapid customization of code required for each individual circumstance yet has a large number of powerful libraries available including for Geospatial Information Systems (GIS).

== S3 Framework ==

The Sahana Eden Software Platform(S3) has been built around a Rapid Application Development (RAD) Framework. This provides a high level of automation to ensure that new solutions can be quickly and effectively developed. Once a database table is defined, the Sahana Eden Framework automatically generates HTML pages to handle CRUD (Create, Read, Update, Delete) as well as Search, Map and Pivot Reports. Web Services are available to import and export in XML, CSV, JSON and EXtensible Stylesheet Language (XSL) transforms are supported to produce other data standards.

The Sahana Eden Framework has flexible authorization policies which can be configured to grant permissions for different modules, tables as well as the ability to have multiple Organizations control their own data on a single Sahana Eden installation.

= Design =

This is a basic relation established on the system between the place and the contact for the dropoff site.

We assign an organization to each drop off sites, and one organization can have different representatives for each site.

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-03-31T06:48:15Z

Jyang23: /* Technique Overview */

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-03-31T06:46:46Z

Jyang23:

CSC/ECE 517 Spring 2014/oss S1402 jyy

2014-03-31T06:37:31Z

Jyang23: Created page with "This project is developed as a contribution to Sahana Software Foundation (Eden). right = Background = Sahana Eden is an open source software project that ..."

This project is developed as a contribution to Sahana Software Foundation (Eden).
[[File:sahana.jpg|right]]

= Background =

Sahana Eden is an open source software project that provides effective solutions for critical humanitarian needs management either prior to or during a crisis (mainly disasters). This platform has a rich feature set which can be rapidly customized to adapt to existing process and integrate with existing systems.

Sahana Eden’s features are designed to help emergency management practitioners to better mitigate, prepare for, respond to and recover from disasters more effectively and efficiently. With this logistic software, strategic planning and the deployment of efforts of human resources and supplies to victims is handled in an efficient manner. It coordinates the information of all the components required to relieve in some way the pain of the affected victims.

Sahana Eden is supported by Sahana Software Foundation whose mission it to save lives by providing information management solutions that enable organizations and communities to better prepare for and respond to disasters. This is a voluntary community consisted of disaster management practitioners, academics, companies and students.

= Motivation =

Sahana Eden provides a wide range of functionalities. Its main capabilities include organization registry, project tracking, human resources management, inventory&assets tracking, assessments, shelter management, scenario&events planning, gis mapping, messaging, etc.

Among all the features, inventory tracking keep records of shipments; supports multiple catalogs of items; and allow organization to manage requests, donations and warehouse. However, we found that the systems does not have place where we can track some “Drop Off Sites” for collection of supplies in minor disasters or during our daily life. These drop off sites can convenience stores, supermarket, hospitals, etc. People can donate supplies to one of these sites which might be most convenient for them and the organizations then can collect useful goods themselves. After talking with one of the managers from Sahana Software Foundation, we decide to add this new feature to the system.

= Technique Overview =

The basic Sahana Eden architecture is as follows:

CSC/ECE 517 Spring 2014

2014-03-31T06:28:49Z

Jyang23:

*[[CSC/ECE_517_Fall_2012/example_page]]
*[[CSC/ECE 517 Spring 2014/ch1a 1e rm]]
*[[CSC/ECE 517 Spring 2014/ch1 1w1h jg ]]
*[[CSC/ECE 517 Spring 2014/ch1 1w1b np]]
*[[CSC/ECE 517 Spring 2014/ch1 1w1f mj]]
*[[CSC/ECE 517 Spring 2014/ch1a 1d mm]]
*[[CSC/ECE 517 Spring 2014/ch1a 1c yj]]
*[[CSC/ECE 517 Spring 2014/ch1 1w1l m]]
*[[CSC/ECE 517 Spring 2014/ch1 1w1m bm]]
*[[CSC/ECE 517 Spring 2014/ch1a 1p fy]]
*[[CSC/ECE 517 Spring 2014/oss E1401 lmn]]
*[[CSC/ECE 517 Spring 2014/oss E1402 mmb]]
*[[CSC/ECE 517 Spring 2014/oss E1404 mnp]]
*[[CSC/ECE 517 Spring 2014/oss E1406 st]]
*[[CSC/ECE 517 Spring 2014/oss S1402 jyy]]

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T04:24:15Z

Jyang23:

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.<ref>http://www.ccs.neu.edu/home/lieber/courses/cs4500/f07/lectures/code-review-types.pdf</ref>

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues.<ref>http://brakemanscanner.org/ </ref> Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools<ref>http://getbarkeep.org/</ref>. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction.<ref>https://github.com/ooyala/barkeep/wiki/Comparing-Barkeep-to-other-code-review-tools</ref> Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time<ref>http://getbarkeep.org/</ref>.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.<ref>http://www.sitepoint.com/code-metrics-and-you/</ref>

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.<ref>http://www.sitepoint.com/code-metrics-and-you/</ref>

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis.<ref>http://blog.8thcolor.com/2013/09/pullreview-reach-your-ruby-code-skill-walhalla/</ref> It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It [http://en.wikipedia.org/wiki/Parsing parses] the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks, etc. It helps in breaking down complex and long methods.<ref>http://blog.martyandrews.net/2008/09/roodi-checkstyle-for-ruby.html</ref>

'''Advantages'''

* Extendable: One advantage of Roodi is that the shipped checks can also be easily configured with a [http://en.wikipedia.org/wiki/Yaml YAML] file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code<ref>http://en.wikipedia.org/wiki/Crucible_(software)</ref>. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles<ref>https://www.atlassian.com/software/crucible/overview </ref>. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review<ref>https://confluence.atlassian.com/display/CRUCIBLE/The+Crucible+workflow</ref>.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool.<ref>http://code.google.com/p/jupiter-eclipse-plugin/wiki/UserGuide</ref> It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an [http://en.wikipedia.org/wiki/Xml XML] file format and maintains them in the project configuration management system alongside the source code.<ref>http://whiteboxqa.com/StudentMaterial/Books/IP-WBT-01-JavaPowerTools.pdf</ref>

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews.<ref>http://www.reviewboard.org/</ref> It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4<ref>http://www.reviewboard.org/docs/manual/dev/users/getting-started/workflow/</ref>.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service.<ref>https://developers.google.com/appengine/articles/rietveld?hl=zh-cn</ref> It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| MIT || Open Source || Ruby || Ruby Gem || Free
|-
! Flog
| Ruby Sadists || Open Source || Ruby || Ruby Gem || Free
|-
! Saikuro
| Ubit || Open Source || Ruby || Ruby Gem || Free
|-
! PullReview
| Brussels || Open Source || Ruby || Desktop Client || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= See Also =

* [http://en.wikipedia.org/wiki/Code_review Code Review]

* [http://en.wikipedia.org/wiki/Static_program_analysis Static program analysis]

* [http://en.wikipedia.org/wiki/Software_inspection Software inspection]

* [http://en.wikipedia.org/wiki/Debugging Debugging]

* [http://en.wikipedia.org/wiki/Ruby_gems Ruby Gems]

* [http://en.wikipedia.org/wiki/Ruby_(programming_language) Ruby]

* [http://en.wikipedia.org/wiki/Ruby_on_Rails Ruby on Rails]

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T04:13:51Z

Jyang23:

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T04:10:07Z

Jyang23:

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.<ref>http://www.ccs.neu.edu/home/lieber/courses/cs4500/f07/lectures/code-review-types.pdf</ref>

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues.<ref>http://brakemanscanner.org/ </ref> Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction.<ref>https://github.com/ooyala/barkeep/wiki/Comparing-Barkeep-to-other-code-review-tools</ref> Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time<ref>http://getbarkeep.org/</ref>.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.<ref>http://www.sitepoint.com/code-metrics-and-you/</ref>

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.<ref>http://www.sitepoint.com/code-metrics-and-you/</ref>

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis.<ref>http://blog.8thcolor.com/2013/09/pullreview-reach-your-ruby-code-skill-walhalla/</ref> It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It [http://en.wikipedia.org/wiki/Parsing parses] the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks, etc. It helps in breaking down complex and long methods.<ref>http://blog.martyandrews.net/2008/09/roodi-checkstyle-for-ruby.html</ref>

'''Advantages'''

* Extendable: One advantage of Roodi is that the shipped checks can also be easily configured with a [http://en.wikipedia.org/wiki/Yaml YAML] file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code<ref>http://en.wikipedia.org/wiki/Crucible_(software)</ref>. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles<ref>https://www.atlassian.com/software/crucible/overview </ref>. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review<ref>https://confluence.atlassian.com/display/CRUCIBLE/The+Crucible+workflow</ref>.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool.<ref>http://code.google.com/p/jupiter-eclipse-plugin/wiki/UserGuide</ref> It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an [http://en.wikipedia.org/wiki/Xml XML] file format and maintains them in the project configuration management system alongside the source code.<ref>http://whiteboxqa.com/StudentMaterial/Books/IP-WBT-01-JavaPowerTools.pdf</ref>

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews.<ref>http://www.reviewboard.org/</ref> It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service.<ref>https://developers.google.com/appengine/articles/rietveld?hl=zh-cn</ref> It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| MIT || Open Source || Ruby || Ruby Gem || Free
|-
! Flog
| Ruby Sadists || Open Source || Ruby || Ruby Gem || Free
|-
! Saikuro
| Ubit || Open Source || Ruby || Ruby Gem || Free
|-
! PullReview
| Brussels || Open Source || Ruby || Desktop Client || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T04:06:15Z

Jyang23: /* PullReview */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.<ref>http://www.ccs.neu.edu/home/lieber/courses/cs4500/f07/lectures/code-review-types.pdf</ref>

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues.<ref>http://brakemanscanner.org/ </ref> Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time<ref>http://getbarkeep.org/</ref>.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis.<ref>http://blog.8thcolor.com/2013/09/pullreview-reach-your-ruby-code-skill-walhalla/</ref> It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It [http://en.wikipedia.org/wiki/Parsing parses] the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks, etc. It helps in breaking down complex and long methods.<ref>http://blog.martyandrews.net/2008/09/roodi-checkstyle-for-ruby.html</ref>

'''Advantages'''

* Extendable: One advantage of Roodi is that the shipped checks can also be easily configured with a [http://en.wikipedia.org/wiki/Yaml YAML] file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code<ref>http://en.wikipedia.org/wiki/Crucible_(software)</ref>. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles<ref>https://www.atlassian.com/software/crucible/overview </ref>. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review<ref>https://confluence.atlassian.com/display/CRUCIBLE/The+Crucible+workflow</ref>.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool.<ref>http://code.google.com/p/jupiter-eclipse-plugin/wiki/UserGuide</ref> It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an [http://en.wikipedia.org/wiki/Xml XML] file format and maintains them in the project configuration management system alongside the source code.<ref>http://whiteboxqa.com/StudentMaterial/Books/IP-WBT-01-JavaPowerTools.pdf</ref>

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews.<ref>http://www.reviewboard.org/</ref> It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service.<ref>https://developers.google.com/appengine/articles/rietveld?hl=zh-cn</ref> It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| MIT || Open Source || Ruby || Ruby Gem || Free
|-
! Flog
| Ruby Sadists || Open Source || Ruby || Ruby Gem || Free
|-
! Saikuro
| Ubit || Open Source || Ruby || Ruby Gem || Free
|-
! PullReview
| Brussels || Open Source || Ruby || Desktop Client || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T04:04:45Z

Jyang23: /* Roodi */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.<ref>http://www.ccs.neu.edu/home/lieber/courses/cs4500/f07/lectures/code-review-types.pdf</ref>

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues.<ref>http://brakemanscanner.org/ </ref> Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time<ref>http://getbarkeep.org/</ref>.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It [http://en.wikipedia.org/wiki/Parsing parses] the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks, etc. It helps in breaking down complex and long methods.<ref>http://blog.martyandrews.net/2008/09/roodi-checkstyle-for-ruby.html</ref>

'''Advantages'''

* Extendable: One advantage of Roodi is that the shipped checks can also be easily configured with a [http://en.wikipedia.org/wiki/Yaml YAML] file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code<ref>http://en.wikipedia.org/wiki/Crucible_(software)</ref>. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles<ref>https://www.atlassian.com/software/crucible/overview </ref>. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review<ref>https://confluence.atlassian.com/display/CRUCIBLE/The+Crucible+workflow</ref>.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool.<ref>http://code.google.com/p/jupiter-eclipse-plugin/wiki/UserGuide</ref> It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an [http://en.wikipedia.org/wiki/Xml XML] file format and maintains them in the project configuration management system alongside the source code.<ref>http://whiteboxqa.com/StudentMaterial/Books/IP-WBT-01-JavaPowerTools.pdf</ref>

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews.<ref>http://www.reviewboard.org/</ref> It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service.<ref>https://developers.google.com/appengine/articles/rietveld?hl=zh-cn</ref> It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| MIT || Open Source || Ruby || Ruby Gem || Free
|-
! Flog
| Ruby Sadists || Open Source || Ruby || Ruby Gem || Free
|-
! Saikuro
| Ubit || Open Source || Ruby || Ruby Gem || Free
|-
! PullReview
| Brussels || Open Source || Ruby || Desktop Client || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T04:02:59Z

Jyang23: /* Jupiter */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.<ref>http://www.ccs.neu.edu/home/lieber/courses/cs4500/f07/lectures/code-review-types.pdf</ref>

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues.<ref>http://brakemanscanner.org/ </ref> Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It [http://en.wikipedia.org/wiki/Parsing parses] the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks, etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that the shipped checks can also be easily configured with a [http://en.wikipedia.org/wiki/Yaml YAML] file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code<ref>http://en.wikipedia.org/wiki/Crucible_(software)</ref>. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles<ref>https://www.atlassian.com/software/crucible/overview </ref>. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review<ref>https://confluence.atlassian.com/display/CRUCIBLE/The+Crucible+workflow</ref>.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool.<ref>http://code.google.com/p/jupiter-eclipse-plugin/wiki/UserGuide</ref> It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an [http://en.wikipedia.org/wiki/Xml XML] file format and maintains them in the project configuration management system alongside the source code.<ref>http://whiteboxqa.com/StudentMaterial/Books/IP-WBT-01-JavaPowerTools.pdf</ref>

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews.<ref>http://www.reviewboard.org/</ref> It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service.<ref>https://developers.google.com/appengine/articles/rietveld?hl=zh-cn</ref> It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| MIT || Open Source || Ruby || Ruby Gem || Free
|-
! Flog
| Ruby Sadists || Open Source || Ruby || Ruby Gem || Free
|-
! Saikuro
| Ubit || Open Source || Ruby || Ruby Gem || Free
|-
! PullReview
| Brussels || Open Source || Ruby || Desktop Client || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T04:01:24Z

Jyang23: /* Rietveld */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.<ref>http://www.ccs.neu.edu/home/lieber/courses/cs4500/f07/lectures/code-review-types.pdf</ref>

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues.<ref>http://brakemanscanner.org/ </ref> Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It [http://en.wikipedia.org/wiki/Parsing parses] the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks, etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that the shipped checks can also be easily configured with a [http://en.wikipedia.org/wiki/Yaml YAML] file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an [http://en.wikipedia.org/wiki/Xml XML] file format and maintains them in the project configuration management system alongside the source code.<ref>http://whiteboxqa.com/StudentMaterial/Books/IP-WBT-01-JavaPowerTools.pdf</ref>

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews.<ref>http://www.reviewboard.org/</ref> It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service.<ref>https://developers.google.com/appengine/articles/rietveld?hl=zh-cn</ref> It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| MIT || Open Source || Ruby || Ruby Gem || Free
|-
! Flog
| Ruby Sadists || Open Source || Ruby || Ruby Gem || Free
|-
! Saikuro
| Ubit || Open Source || Ruby || Ruby Gem || Free
|-
! PullReview
| Brussels || Open Source || Ruby || Desktop Client || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T04:00:32Z

Jyang23: /* Review Board */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.<ref>http://www.ccs.neu.edu/home/lieber/courses/cs4500/f07/lectures/code-review-types.pdf</ref>

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues.<ref>http://brakemanscanner.org/ </ref> Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It [http://en.wikipedia.org/wiki/Parsing parses] the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks, etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that the shipped checks can also be easily configured with a [http://en.wikipedia.org/wiki/Yaml YAML] file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an [http://en.wikipedia.org/wiki/Xml XML] file format and maintains them in the project configuration management system alongside the source code.<ref>http://whiteboxqa.com/StudentMaterial/Books/IP-WBT-01-JavaPowerTools.pdf</ref>

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews.<ref>http://www.reviewboard.org/</ref> It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| MIT || Open Source || Ruby || Ruby Gem || Free
|-
! Flog
| Ruby Sadists || Open Source || Ruby || Ruby Gem || Free
|-
! Saikuro
| Ubit || Open Source || Ruby || Ruby Gem || Free
|-
! PullReview
| Brussels || Open Source || Ruby || Desktop Client || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:55:19Z

Jyang23: /* Jupiter */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It [http://en.wikipedia.org/wiki/Parsing parses] the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks, etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that the shipped checks can also be easily configured with a [http://en.wikipedia.org/wiki/Yaml YAML] file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an [http://en.wikipedia.org/wiki/Xml XML] file format and maintains them in the project configuration management system alongside the source code.<ref>http://whiteboxqa.com/StudentMaterial/Books/IP-WBT-01-JavaPowerTools.pdf</ref>

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [ http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| MIT || Open Source || Ruby || Ruby Gem || Free
|-
! Flog
| Ruby Sadists || Open Source || Ruby || Ruby Gem || Free
|-
! Saikuro
| Ubit || Open Source || Ruby || Ruby Gem || Free
|-
! PullReview
| Brussels || Open Source || Ruby || Desktop Client || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:49:06Z

Jyang23: /* Comparison */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It [http://en.wikipedia.org/wiki/Parsing parses] the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks, etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that the shipped checks can also be easily configured with a [http://en.wikipedia.org/wiki/Yaml YAML] file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [ http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| MIT || Open Source || Ruby || Ruby Gem || Free
|-
! Flog
| Ruby Sadists || Open Source || Ruby || Ruby Gem || Free
|-
! Saikuro
| Ubit || Open Source || Ruby || Ruby Gem || Free
|-
! PullReview
| Brussels || Open Source || Ruby || Desktop Client || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:48:29Z

Jyang23: /* Comparison */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It [http://en.wikipedia.org/wiki/Parsing parses] the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks, etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that the shipped checks can also be easily configured with a [http://en.wikipedia.org/wiki/Yaml YAML] file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [ http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| MIT || Open Source || Ruby || Ruby Gem || Free
|-
! Flog
| Ruby Sadists || Open Source || Ruby || Ruby Gem || Free
|-
! Saikuro
| Zev Blut || Open Source || Ruby || Ruby Gem || Free
|-
! PullReview
| Brussels || Open Source || Ruby || Desktop Client || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:38:57Z

Jyang23: /* Comparison */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps [http://en.wikipedia.org/wiki/Quality_assurance quality assurance] (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source [http://en.wikipedia.org/wiki/Vulnerability_(computing) vulnerability] scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in [http://en.wikipedia.org/wiki/Web_server web server] or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [ http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Roodi
| SmartBear || Proprietary || || Desktop Client || Paid
|-
! Flog
| codestriker.sourceforge.net || Open Source || Pearl || Web Application || Free
|-
! Saikuro
| codestriker.sourceforge.net || Open Source || Pearl || Web Application || Free
|-
! Dust
| codestriker.sourceforge.net || Open Source || Pearl || Web Application || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:34:31Z

Jyang23:

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code. Users can attend commits made to any [http://en.wikipedia.org/wiki/Git_(software) Git] repository, see [http://en.wikipedia.org/wiki/Diffs diffs], write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also [ http://en.wikipedia.org/wiki/Script_(computing) script] tools. It comes with a command line client and [http://en.wikipedia.org/wiki/REST REST] APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a [http://githooks.com/ git hook]. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the [http://en.wikipedia.org/wiki/Cyclomatic_complexity cyclomatic complexity] at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is [http://en.wikipedia.org/wiki/SaaS “SAAS”] solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreview sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company [https://www.atlassian.com/ Atlassian], tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with [http://en.wikipedia.org/wiki/JIRA JIRA] which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative [http://en.wikipedia.org/wiki/Eclipse_(software) Eclipse] code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* [http://en.wikipedia.org/wiki/Cross-platform Cross-platform] Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar], [http://en.wikipedia.org/wiki/ClearCase ClearCase], [http://en.wikipedia.org/wiki/Concurrent_Versions_System CVS], Git, [http://en.wikipedia.org/wiki/Mercurial Mercurial], [http://en.wikipedia.org/wiki/Perforce Perforce], and [http://en.wikipedia.org/wiki/Subversion_(software) Subversion]. It can be installed on any server running [http://en.wikipedia.org/wiki/Apache Apache] or [ http://en.wikipedia.org/wiki/Lighttpd lighttpd] and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It provides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Collaborator
| SmartBear || Proprietary || || Desktop Client || Paid
|-
! Code Striker
| codestriker.sourceforge.net || Open Source || Pearl || Web Application || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Gerrit
| code.google.com || Open Source || Java || Web Application || Free
|-
! Groogle
| groogle.sourceforge.net || Open Source || PHP || Web Application || Free
|-
! JCR
| jcodereview.sourceforge.net || Open Source || Java || Web Application || Free
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Malevich
| malevich.codeplex.com || Open Source || || Web Application || Free
|-
! Perforce
| perforce.com || Proprietary || Multiple || Both || Paid
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:28:56Z

Jyang23: /* Rietveld */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code.Users can attend commits made to any Git repository, see diffs, write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also script tools. It comes with a command line client and REST APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a githook. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the cyclomatic complexity at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is “SAAS” solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreviews sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company Atlassian, tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with JIRA which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative Eclipse code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* Cross-platform: Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc
review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like Bazaar, ClearCase, CVS, Git, Mercurial, Perforce, and Subversion. It can be installed on any server running Apache or lighttpd and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It prrovides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Collaborator
| SmartBear || Proprietary || || Desktop Client || Paid
|-
! Code Striker
| codestriker.sourceforge.net || Open Source || Pearl || Web Application || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Gerrit
| code.google.com || Open Source || Java || Web Application || Free
|-
! Groogle
| groogle.sourceforge.net || Open Source || PHP || Web Application || Free
|-
! JCR
| jcodereview.sourceforge.net || Open Source || Java || Web Application || Free
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Malevich
| malevich.codeplex.com || Open Source || || Web Application || Free
|-
! Perforce
| perforce.com || Proprietary || Multiple || Both || Paid
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:28:37Z

Jyang23: /* Other Tools */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code.Users can attend commits made to any Git repository, see diffs, write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also script tools. It comes with a command line client and REST APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a githook. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the cyclomatic complexity at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is “SAAS” solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreviews sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company Atlassian, tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with JIRA which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative Eclipse code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* Cross-platform: Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc
review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like Bazaar, ClearCase, CVS, Git, Mercurial, Perforce, and Subversion. It can be installed on any server running Apache or lighttpd and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It prrovides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Collaborator
| SmartBear || Proprietary || || Desktop Client || Paid
|-
! Code Striker
| codestriker.sourceforge.net || Open Source || Pearl || Web Application || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Gerrit
| code.google.com || Open Source || Java || Web Application || Free
|-
! Groogle
| groogle.sourceforge.net || Open Source || PHP || Web Application || Free
|-
! JCR
| jcodereview.sourceforge.net || Open Source || Java || Web Application || Free
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Malevich
| malevich.codeplex.com || Open Source || || Web Application || Free
|-
! Perforce
| perforce.com || Proprietary || Multiple || Both || Paid
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:27:52Z

Jyang23: /* Code Review Tools for Ruby */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code.Users can attend commits made to any Git repository, see diffs, write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also script tools. It comes with a command line client and REST APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a githook. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the cyclomatic complexity at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is “SAAS” solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreviews sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company Atlassian, tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with JIRA which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative Eclipse code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* Cross-platform: Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc
review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like Bazaar, ClearCase, CVS, Git, Mercurial, Perforce, and Subversion. It can be installed on any server running Apache or lighttpd and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It prrovides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Collaborator
| SmartBear || Proprietary || || Desktop Client || Paid
|-
! Code Striker
| codestriker.sourceforge.net || Open Source || Pearl || Web Application || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Gerrit
| code.google.com || Open Source || Java || Web Application || Free
|-
! Groogle
| groogle.sourceforge.net || Open Source || PHP || Web Application || Free
|-
! JCR
| jcodereview.sourceforge.net || Open Source || Java || Web Application || Free
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Malevich
| malevich.codeplex.com || Open Source || || Web Application || Free
|-
! Perforce
| perforce.com || Proprietary || Multiple || Both || Paid
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:25:22Z

Jyang23: /* References */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code.Users can attend commits made to any Git repository, see diffs, write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also script tools. It comes with a command line client and REST APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a githook. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the cyclomatic complexity at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is “SAAS” solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreviews sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company Atlassian, tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with JIRA which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative Eclipse code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* Cross-platform: Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc
review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like Bazaar, ClearCase, CVS, Git, Mercurial, Perforce, and Subversion. It can be installed on any server running Apache or lighttpd and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It prrovides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= Comparison =

{| border="1" class="wikitable"
|+ Comparison of code review tools
!
! Maintainer
! License
! Developed In
! Desktop Client vs Web App
! Cost
|-
! Brakeman
| brakemanscanner.org || Open Source || Ruby || Desktop Client || Free
|-
! Barkeep
| Ooyala || Open Source || Ruby || Web Application || Free
|-
! Collaborator
| SmartBear || Proprietary || || Desktop Client || Paid
|-
! Code Striker
| codestriker.sourceforge.net || Open Source || Pearl || Web Application || Free
|-
! Crucible
| Atlassian || Proprietary || Java || Web Application || Paid
|-
! Gerrit
| code.google.com || Open Source || Java || Web Application || Free
|-
! Groogle
| groogle.sourceforge.net || Open Source || PHP || Web Application || Free
|-
! JCR
| jcodereview.sourceforge.net || Open Source || Java || Web Application || Free
|-
! Jupiter
| code.google.com || Open Source || Java || Desktop Client (Eclipse) || Free
|-
! Malevich
| malevich.codeplex.com || Open Source || || Web Application || Free
|-
! Perforce
| perforce.com || Proprietary || Multiple || Both || Paid
|-
! Rietveld
| Google App Engine || Open Source|| Python || Web Application || Free
|-
! Review Board
| reviewboard.org || MIT || Python || Web Application || Free
|}

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:13:56Z

Jyang23: /* References */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code.Users can attend commits made to any Git repository, see diffs, write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also script tools. It comes with a command line client and REST APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a githook. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the cyclomatic complexity at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is “SAAS” solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreviews sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company Atlassian, tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with JIRA which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative Eclipse code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* Cross-platform: Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc
review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like Bazaar, ClearCase, CVS, Git, Mercurial, Perforce, and Subversion. It can be installed on any server running Apache or lighttpd and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It prrovides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

= References =
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:13:23Z

Jyang23: /* Code Review Tools for Python */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code.Users can attend commits made to any Git repository, see diffs, write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also script tools. It comes with a command line client and REST APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a githook. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the cyclomatic complexity at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is “SAAS” solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreviews sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company Atlassian, tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with JIRA which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative Eclipse code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* Cross-platform: Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc
review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like Bazaar, ClearCase, CVS, Git, Mercurial, Perforce, and Subversion. It can be installed on any server running Apache or lighttpd and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It prrovides rich extension framework to add features to Review Board.

== Rietveld ==

Rietveld is a web-based collaborative code review tool for use with Subversion to run on Google’s cloud service. It is written by Guido van Rossum, Python creator. While this web app was primarily written to serve as a showcase for using Django with Google App Engine, the scalable infrastructure for web applications that developer helped build, serves as a useful tool for the open source community, especially the Python community. Rietveld is inspired by Mondrian, which once has been intensively used inside Google to review their code.Part of the Rietveld’s code derived from Mondrian.

'''Workflow'''

The feature sets of Rietveld and Review Board are strikingly similar, which is not surprising as they both used Mondrian as a model. van Rossum originally wanted to turn Mondrian into a free software project, but it was too tied to "proprietary Google infrastructure", so he started over, with Rietveld as the result. Both tools are implemented in Python using the Django framework, but one major difference is that Rietveld is written to use Google App Engine.

'''Advantage'''

* Simplified deployment: For free software projects, where code review is purposely done in the open, Rietveld provides a way to quickly try the application out. They don’t need to find a server and run the application, as which would be required with Review Board.

* Cross platform: It is extremely easy to install Rietveld in a different environment by replacing the App Engine-specific pieces, but that clearly is not where it is targeted.

* Free and open to public: Anyone can browse the system, but only users who have a Google account can add issues, comments, and conduct reviews using the tool.

* Introduction to the Google App Engine interface: While Rietveld does not provide much in the way of additional functionality from Review Board, and in fact it lags Review Board in some areas, Rietveld does provide a very nice introduction to the Google App Engine interface. Developers can use the code as a template for their own ideas once Google makes more App Engine accounts available.

== References ==
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:10:01Z

Jyang23:

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code.Users can attend commits made to any Git repository, see diffs, write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also script tools. It comes with a command line client and REST APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a githook. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the cyclomatic complexity at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is “SAAS” solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreviews sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company Atlassian, tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with JIRA which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative Eclipse code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* Cross-platform: Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc
review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like Bazaar, ClearCase, CVS, Git, Mercurial, Perforce, and Subversion. It can be installed on any server running Apache or lighttpd and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It prrovides rich extension framework to add features to Review Board.

== References ==
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T03:07:09Z

Jyang23: /* Code Review Tools for Java */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code.Users can attend commits made to any Git repository, see diffs, write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also script tools. It comes with a command line client and REST APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a githook. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the cyclomatic complexity at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is “SAAS” solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreviews sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

== Other Tools ==

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company Atlassian, tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with JIRA which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative Eclipse code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* Cross-platform: Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc
review comments and the corresponding source code.

==Other Tools==

* [https://code.google.com/p/gerrit/ Gerrit] is a web based code review system, facilitating online code reviews for projects using the Git version control system.

* [http://jcodereview.sourceforge.net/ JCR] is a web application for performing and managing formal code reviews. It can be used for reviews of any type of source code, although it has some special smarts for reviewing Java projects. It has special features to make large-scale reviews not only practical but easy and fast.

* [http://www.sonarqube.org/ Sonar] is an open platform to manage code quality.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like Bazaar, ClearCase, CVS, Git, Mercurial, Perforce, and Subversion. It can be installed on any server running Apache or lighttpd and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It prrovides rich extension framework to add features to Review Board.

== References ==
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T02:55:10Z

Jyang23: /* Saikuro */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code.Users can attend commits made to any Git repository, see diffs, write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also script tools. It comes with a command line client and REST APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a githook. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the cyclomatic complexity at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro looks like this:

[[File:Saikuro_1.png]]

* More examples can be viewed [http://saikuro.rubyforge.org/ here].

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is “SAAS” solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreviews sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

== Other Tools ==

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company Atlassian, tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with JIRA which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative Eclipse code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* Cross-platform: Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc
review comments and the corresponding source code.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like Bazaar, ClearCase, CVS, Git, Mercurial, Perforce, and Subversion. It can be installed on any server running Apache or lighttpd and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It prrovides rich extension framework to add features to Review Board.

== References ==
<references/>
----

CSC/ECE 517 Spring 2014/ch1 1w1f mj

2014-02-11T02:53:08Z

Jyang23: /* Roodi */

[http://en.wikipedia.org/wiki/Code_review Code review] is the process of evaluation of computer [http://http://en.wikipedia.org/wiki/Source_code source code], with the intention of finding and fixing faults and design errors neglected in the initial development phase. Code review helps in improving the overall quality of software and maintains the consistency in software design and implementation. The reviewer examines the code and reports the findings to the author, which helps in improving the developer’s skill.

= Introduction =

Code review is a phase in the software development process in which the authors of code, peer reviewers, and perhaps quality assurance (QA) testers get together to review code.<ref>http://searchsoftwarequality.techtarget.com/definition/code-review </ref> It facilitates systematic examination of source code for vulnerabilities such as buffer overflows, race conditions, memory leakage, size violations, and duplicate statements. Code review can also help in looking for security breaches to the software which requires higher security.

= Types of Code review =

Code review practices can be divided into the following categories.

=== Formal inspections===

Formal inspections refers to a heavy process with several participants sitting together to review code. The defects discovered in this process are usually recorded in great detail.

=== Lightweight code review ===

* Over the shoulder: An “over-the-shoulder” review is the most common and informal code review technique where the developer stands over the author’s workstation while the author walks the reviewer through a set of code changes.

* Email pass around: The author bundles up all source code and sends it to reviewers. Reviewers examine the code, communicate with other developers and suggest changes via e-mail.

* Pair Programming: In Pair Programming, two developers write code at the same workstation and there is continuous free-form discussion and review.

* Tool assisted code review: Reviewers use specialized tools in different stages of the code review, which includes collecting files, transmitting and displaying files, commentary, and defects among all participants, collecting metrics, etc.

= Code Review Tools for Ruby =

== Brakeman ==

Brakeman is an open source vulnerability scanner tool explicitly designed for Ruby on Rails applications. It can be used at any stage of the development to statically analyze Rails application code and find out the security issues. Brakeman carefully inspects the source code of your application and you do not need to set up your whole application stack to use it. Brakeman scans through the application code and produce a summary of all security issues it has found. Brakeman is extremely suspicious and hence sometimes it provides “false positives.” It does not finds security vulnerabilities in web server or other software as it just scans the source code and not the entire application stack.

'''Advantages'''

* No Configuration Necessary: Brakeman does not require any setup or configuration once it is installed.

* Run It Anytime: As it’s working is based on just the source code, Brakeman can be used at any stage of the development process.

* Ruby Specific: Brakeman is especially built for applications developed in Ruby on Rails, so it can easily check configuration settings for best practices.

* Flexible Testing: Each check performed by Brakeman is independent, so testing can be limited to a subset of all the checks Brakeman comes with.

* Speed: Brakeman is much faster than other “black box” website scanners. Even large applications do not take more than a few minutes to scan.

'''Example'''

Here's one example of warnings Brakeman reports: SQL injection.

* A Rails 3.x code segment looks like this :

<pre>
username = params[:user][:name].downcase
password = params[:user][:password]

User.first.where("username = '" + username + "' AND password = '" + password + "'")
</pre>

* Brakeman would produce a warning like this:

<pre>
Possible SQL injection near line 37:
User.first.where((((("username = '" + params[:user][:name].downcase) + "' AND password = '") + params[:user][:password]) + "'"))
</pre>

== Barkeep ==

Barkeep is one of the friendly Code Review System which can be used by developers to keep high quality standard of code.Users can attend commits made to any Git repository, see diffs, write comments, and have those comments emailed to your fellow committers. Barkeep is unopinionated. It can be used with pre-commit or post-commit workflows, and also script tools. It comes with a command line client and REST APIs.

Barkeep is a small codebase written in Ruby. It's easy to add new features and APIs as per the requirement.

'''Advantages'''

* Naturally supports post-commit workflows: Barkeep supports post-commit code review workflow. Here, once the part of the code of the developer is ready, he pushes it to the master, so that it becomes available to other developer to begin integrating it. Code review happens when it's conducive for the team (within 1-2 days), and any comments are addressed in future commits.

* Clean User Interface: Barkeep is designed with a basic UI. The general actions, like leaving a quick comment and approving a commit, are low-friction. Also it provides various keyboard shortcuts for ease of use.

* Hackable: The codebase of barkeep is small, obtainable and fun to hack on. It can be easily extended and improved with time.

==Flog==

Flog gives feedback about the quality of Ruby code by scoring using the [http://c2.com/cgi/wiki?AbcMetric ABC metric]: assignments, branches, calls, with particular attention placed on calls. The ABC metric is a neat measurement since it combines a lot of information in a way that we can easily understand. But this leads to one important feature of Flog, that is the score reported is very opinionated. This score is custom built to apply commonly accepted design patterns for Ruby. Therefore, we can think of Flog as a modified ABC measurement.

Flog takes the following branching terms into consideration: and, case, else, if, or, rescue, until, when and while. There are other rules that add to branch total, but these are the most important. Assignments are much more simple, Flog add one to the score per assignment. Calls are defined as any instance method call that takes the flow out of the current scope.

'''Advantages'''

* Keep track of code complexity: Flog reports code complexity of each method. In this way, developer is able to know what code segment in the project is different to follow.

* ABC metric: Flog reports ABC metric which is an easily understood measurement of code complexity.

* Ruby support: It support different version of Ruby including 1.8 and 1.9 syntax.

* Speed: Flog executes quite fast, which makes it perfect for a githook. A pre-commit hook which checks code complexity and returns non-zero for any score higher than 61 works quite well.

'''Example'''

* Original code

<pre>
class Test
def blah
a = eval "1+1"
if a == 2 then
puts "yay"
end
end
end
</pre>

* What we see in Flog

<pre>
class Test
def blah # 11.2 =
a = eval "1+1" # 1.2 + 6.0 +
if a == 2 then # 1.2 + 1.2 + 0.4 +
puts "yay" # 1.2
end
end
end
</pre>

* Report generated

<pre>
Test#blah: (11.2)
6.0: eval
1.2: branch
1.2: ==
1.2: puts
1.2: assignment
0.4: lit_fixnum
</pre>

== Saikuro ==

Saikuro is mainly designed to analyze cyclomatic complexity, which is a graphical measurement to indicate the complexity of a program, on Ruby program. Given a source project, Saikuro will find each instance method in it, calculate its cyclomatic complexity and generate a report listing all the result according to each method found. In addition, Saikuro also counts the number of lines per method as well as the number of tokens on each line, and generate another report on that.

Saikuro measures complexity, but as we all know, Ruby is a tricky language. Saikuro adds a branch when it encounters conditional statements like if, unless, while, until, for, elsif and when, but it also adds a branch if the code uses a block. This is because using a block in Ruby very often changes the control flow. Keeping the cyclomatic complexity at a low number is very essential, it ensures your code is simple to test and debug.

'''Advantages'''

* Cyclomatic complexity: Saikuro calculates cyclomatic complexity in a more 'Ruby' way so that it is more concise on Ruby projects.

* Different kind of targets: Saikuro can be recursively used on a dir or a specific troublesome class.

* Lightweight and quick: It is very similar to the code evaluation tool Flog we covered before. It is a quick reporting tool that can help users understand where they have excess complexity in their projects.

'''Example'''

* A report generated by Saikuro can be viewed [http://saikuro.rubyforge.org/ here].
[[File:Saikuro_1.png]]

== PullReview ==

PullReview is an Automated Code Review Tool for Ruby developers using GitHub. PullReview is “SAAS” solution. It requires no servers to install, no extra software. Setup is very easy - Click the button, link to GitHub, and PullReview can start reviewing your branches. It provides feedback very quickly, without having to sit and wait for a colleague to come and have a look. Another important feature is that it does not keep to static analysis. It aggregates several analysis results, and points out the problems at hand – in order of impact. It also tells you ways to make your code better.

'''Advantages'''

* Telling You Where to Go Next: PullReview make your coding more robust, it improves you as a coder. It tells you why best practices are what they are – and where to apply them. PullReview analyzes your branches using all important metrics. It tells you what you are doing wrong and what the impact is.

* Ruby Specific: Like Brakeman, Roodi is specifically built for Ruby on Rails which helps in checking composition and structure settings for best practices.

* Quick Setup: No setting up of servers or installing a plethora of tools is required. Pullreviews sets up quickly and saves time.

'''Example''' can be viewed [https://www.pullreview.com/site/onboarding here].

== Roodi ==

Roodi stands for Ruby Object Oriented Design Inferometer. It parses the Ruby code and warns about the design issues from the list configured for example Class line count check, for loop check, parameter number check, cyclomatic checks,etc. It helps in breaking down complex and long methods.

'''Advantages'''

* Extendable: One advantage of Roodi is that The shipped checks can also be easily configured with a YAML file, which is easy to manipulate. In that way, users are able to write customized class to add new checks. A checker class registers the types of AST nodes it’s interested and then handle the matched subtrees.

'''Example Usage'''

* Check all ruby files recursively under the current directory:

<pre>
$ roodi
</pre>

* Check all ruby files in a rails app:

<pre>
$ roodi "rails_app/**/*.rb"
</pre>

* Check one controller and one model file in a rails app:

<pre>
$ roodi app/controller/sample_controller.rb app/models/sample.rb
</pre>

* Check all ruby files in a rails app with a custom configuration file:

<pre>
$ roodi -config=my_roodi_config.yml "rails_app/**/*.rb"
</pre>

* For more details, please refer to [https://github.com/roodi/roodi here].

== Other Tools ==

= Code Review Tools for Java =

== Crucible ==

Crucible is a collaborative code review application developed by software company Atlassian, tailored to distributed teams, and facilitates asynchronous review and commenting on code. Crucible also articulates with prominent source control tools, such as Git and Subversion. Crucible is a flexible application that caters for a wide range of team sizes and work styles. Crucible also supports integration with JIRA which is Atlassian's issue tracking and project management application.

'''Workflow '''

1. Creating a Review.

2. Adding content to the review.

3. Performing the review

4. Summarising and closing the review.

''' Advantages '''

* Flexible Code Review: Crucible provides configurable options to track and complete reviews - Defined workflow, Moderator, One or more participants. It also supports in-line code discussions.

* Pre-commit support: It allows code review before check in which ensures that any code going into production has been reviewed. It allows code review from command line.During the pre-commit review process code is re-factored, changed, and updated. Crucible takes this into account and makes sure all files you are reviewing are easily updated and current.

* Traceability: Developers have a unified view that shows all the activity in their code for commits and reviews. It supports creating filters which provides notification of code committed by new team members. The review coverage report provides information about which parts have already been reviewed and which are currently in review.

* Notifications: It provides automatic or manual way of notifying reviewers who have not completed your code reviews. Crucible provides multiple features to help team stay on top of their workload.

== Jupiter==

Jupiter is an open source collaborative Eclipse code review tool. It uses a simple, lightweight code review process that is easy to learn and adopt. The result of a research project by the Collaborative Software Development Laboratory at the University of Hawaii, the Jupiter plug-in stores code reviews in an XML file format and maintains them in the project configuration management system alongside the source code.

'''Workflow'''

The code review process implemented in Jupiter is relatively simple, and it should suffice for most
projects. In Jupiter, you conduct a code review in the following four stages:

Configuration: The reviewer initiator sets up the review, specifies the files to be reviewed and what issues can be raised.

Individual code review: Each reviewer examines the code individually, using a review checklist and raising issues as they encounter them. Jupiter saves the issues you create in XML form directly in the
project directory.

Team review: The review team (including the author) meet to discuss issues and decide on actions to take. This generally involves a face-to-face meeting, using Jupiter to help work through all the review issues.

Rework: The developer goes through the raised issues and fixes them.

Throughout the whole process, the review files are stored and updates in the source code repository, providing a history of raised issues and how they have been corrected.

Jupiter is an innovative and flexible tool that helps automate peer code reviews and track issues. Until
recently, it was quite unique in this domain. Of late, however, it does have a commercial competitor,
Crucible, which we mentioned before.

'''Advantages'''

* Free: It is open source and free. Jupiter uses the CPL License.

* Cross-platform: Jupiter is based upon the Eclipse plug-in architecture. It is available for all platforms supported by Eclipse.

* More simply data reuse and sharing: Jupiter stores data in XML format as well as CM repository. Users of Jupiter share their data ﬁles the same way they share their code using CVS or some other CM repository.

* Sorting and Filtering: Jupiter provides ﬁlters and sorting to facilitate going over the code
review issues.

* File integration: Jupiter has the capability to easily jump back and forth between speciﬁc
review comments and the corresponding source code.

=Code Review Tools for Python=

== Review Board ==

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It works well with small projects as well as large companies. Review Board integrates with various version control systems like Bazaar, ClearCase, CVS, Git, Mercurial, Perforce, and Subversion. It can be installed on any server running Apache or lighttpd and is free for both personal and commercial use. There is also an official commercial Review Board hosting service, RBCommons for Review Board.

'''Workflow (pre-commit)'''
1. Make a change to your local source tree.

2. Create a review request for your new change.

3. Publish the review request and wait for your reviewers to see it.

4. Wait for feedback from the reviewers.

5. If they’re ready for it to go in:
: 5.1 Submit your change to the repository.
: 5.2 Click Close ‣ Submitted on the review request action bar.

6. If they’ve requested changes:
: 6.1 Update the code in your tree and generate a new diff.
: 6.2 Upload the new diff, specify the changes in the Change Description box, and publish.
: 6.3 Jump back to step 4.

'''Advantages'''

* Easily track your team's review requests: The dashboard provides an up-to-the-minute overview of all the review requests. Provides easy controls to group/ sort your review requests, and see what's left to review.

* Review all kinds of files: Along with code review, Review Board can also be used to review other files by the team members. You can upload screenshots of your feature, or a file showing log output of a unit test run.

* All history at one place: With Review Board, the entire history of development is in one place. Each change's review request shows the entire development discussion and each iteration of the change that people have reviewed.

* Helpful command-line tools and Extensible: The RBTools command line tools make it easy to quickly create review requests based on the changes in your source tree and to keep them up-to-date. The fully-featured REST and Python API provides automation and integration. It prrovides rich extension framework to add features to Review Board.

== References ==
<references/>
----

File:Saikuro1.jpg

2014-02-11T02:43:40Z

Jyang23: uploaded a new version of "File:Saikuro1.jpg"

Saikuro example

File:Saikuro1.jpg

2014-02-11T02:42:32Z

Jyang23: uploaded a new version of "File:Saikuro1.jpg"

Saikuro example