Carmine Vassallo

Engineering the operability of @SonarQube at @SonarSource | Computer Science PhD

[Carmine Vassallo @ccvassallo]

Excited to present how we dogfood at @SonarSource #DevOpsDaysZH #dodzh

[DevOpsDaysZH @DevOpsZH]

🐶 Want better products? Use them yourself! @ccvassallo showed us how dogfooding uncovers hidden flaws, improves deployment, and refines configurations based on real-world usage. A game-changer for teams! #dodzh #DevOpsDaysZH

[Romano Roth @RomanoRoth]

🚨 78% 𝐨𝐟 𝐃𝐞𝐯𝐞𝐥𝐨𝐩𝐞𝐫𝐬 𝐍𝐞𝐯𝐞𝐫 𝐂𝐡𝐚𝐧𝐠𝐞 𝐒𝐭𝐚𝐭𝐢𝐜 𝐂𝐨𝐝𝐞 𝐀𝐧𝐚𝐥𝐲𝐬𝐢𝐬 𝐂𝐨𝐧𝐟𝐢𝐠𝐮𝐫𝐚𝐭𝐢𝐨𝐧𝐬! 𝐀𝐫𝐞 𝐖𝐞 𝐔𝐬𝐢𝐧��� 𝐓𝐡𝐞𝐬𝐞 𝐓𝐨𝐨𝐥𝐬 𝐄𝐟𝐟𝐞𝐜𝐭𝐢𝐯𝐞𝐥𝐲?

𝐀𝐮𝐭𝐨𝐦𝐚𝐭𝐢𝐜 𝐒𝐭𝐚𝐭𝐢𝐜 𝐀𝐧𝐚𝐥𝐲𝐬𝐢𝐬 𝐓𝐨𝐨𝐥𝐬 (𝐀𝐒𝐀𝐓) are supposed to improve code quality and catch 𝐝𝐞𝐟𝐞𝐜𝐭𝐬 early, but are they actually 𝐡𝐞𝐥𝐩𝐢𝐧𝐠 developers or just creating 𝐧𝐨𝐢𝐬𝐞? 🤔

A recent 𝐬𝐭𝐮𝐝𝐲 by @ccvassallo, @spanichella, @fabiopalomba3, @prksch, Harald C. Gall, @azaidman analyzing 56 developers, 11 industry experts, and 176 open-source projects uncovered some eye-opening insights:

𝐇𝐨𝐰 𝐀𝐫𝐞 𝐀𝐒𝐀𝐓𝐬 𝐔𝐬𝐞𝐝?
🖥️ Continuous Integration (CI) (37%) – Focuses on error handling & logic flaws
🔎 Code Review (CR) (29%) – Prioritizes style conventions & redundancies
📝 Local Programming (LP) (31%) – Monitors code structure & style issues

𝐂𝐨𝐧𝐟𝐢𝐠𝐮𝐫𝐚𝐭𝐢𝐨𝐧 & 𝐏𝐫𝐢𝐨𝐫𝐢𝐭𝐢𝐳𝐚𝐭𝐢𝐨𝐧 𝐂𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞𝐬
🚫 78% of developers never change ASAT settings!
📌 Developers rarely adjust configurations, even though different warnings matter in different contexts.

𝐀𝐒𝐀𝐓 𝐢𝐧 𝐎𝐩𝐞𝐧-𝐒𝐨𝐮𝐫𝐜𝐞 𝐏𝐫𝐨𝐣𝐞𝐜𝐭𝐬
📁 66% of projects define ASATs in their repositories, yet...
⚖️ Only 37% enforce ASAT usage in contribution guidelines.
🛠️ The most commonly defined ASATs: ESLint, RuboCop, Flake8, and Checkstyle.

𝐓𝐡𝐞 𝐂𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞𝐬 𝐃𝐞𝐯𝐞𝐥𝐨𝐩𝐞𝐫𝐬 𝐅𝐚𝐜𝐞
⚠️ False-positive overload – Too many unhelpful warnings.
��� Lack of trust – ASAT severity ratings aren’t always reliable.
🎯 Better prioritization needed – Developers need smarter filtering.

𝐖𝐡𝐚𝐭 𝐍𝐞𝐞𝐝𝐬 𝐭𝐨 𝐂𝐡𝐚𝐧𝐠𝐞?
🔄 For ASAT Vendors – Improve warning prioritization & reduce false positives.
🛠️ For Developers – Tailor ASAT configurations based on context.
🔗 For Open-Source Projects – Enforce ASAT usage to improve code quality.

𝐅𝐢𝐧𝐚𝐥 𝐓𝐡𝐨𝐮𝐠𝐡𝐭:
🚀 ASATs are widely used but underutilized due to poor configuration and lack of enforcement.
🧠 Context-aware ASATs could boost developer confidence and improve code quality—but we need smarter adoption strategies.

👉 link to the study: https://t.co/L7u1pL16ik

#SoftwareEngineering #CodeQuality #ASAT #SoftwareDevelopment #ContinuousIntegration

[Carmine Vassallo @ccvassallo]

Can't wait to showcase how we dogfood #SonarQube at @SonarSource!

[DevOpsDaysZH @DevOpsZH]

🚀 Thrilled to welcome @ccvassallo as an Ignite Speaker at DevOpsDays Zürich!

Don’t miss his talk: “Eating Your Own Dog Food - The Secret Sauce for Better Product Development” 🐾

👉 Learn more: https://t.co/GrrCuiklkN

#DevOpsDaysZH #dodzh #devops #devopsdays

[Michael Hilton @michaelhilton]

I have known @redeemJustin for over 20 years now. He is a great guy. If you are looking for a place to help, you could consider helping here...

[Carmine Vassallo @ccvassallo]

Last Thursday, I had a great time with my colleague @CotineauJeremy and the DevOps Meetup Zurich folks discussing how we dogfood @SonarQube in @SonarSource.

Looking forward to the next events on the topic!

#devops #sonarqube #sonar #cleancode

[Carmine Vassallo @ccvassallo]

Hi, Zurich peeps 👋 don't miss our DevOps meetup talk next November 30!

RSVP 👇

[Sonar @SonarSource]

🇨🇭Nov 30, Join us at a DevOps meet-up in Zürich!

SonarQube operability engineers @ccvassallo and @CotineauJeremy will deliver a talk on how the practice of dogfooding has driven the quality and deployment strategy of @SonarQube 🐶

RSVP in replies 👇

[Romano Roth @RomanoRoth]

📣#DevOps Enthusiasts in Zurich! 📣
🗓️ 30.11.2023 | ⏰ 17:30-21:00 | 📍 @DigicompCH, Limmatstrasse 50 Zürich
👉Agile from Piracy to Slavery @BiellaDanilo
👉Clean as You Deploy: Dogfooding Your Own Product Operability @ccvassallo
RSVP now! https://t.co/7fpGfKPrPV
See you there! 🤝

[Carmine Vassallo @ccvassallo]

At @DevopsdaysGe, @alainkermis and @CotineauJeremy keep cleaning as they code #cleancode w/ @SonarSource

[Carmine Vassallo @ccvassallo]

.@KrisBuytaert reflecting on the past 14 years of #devops

[Carmine Vassallo @ccvassallo]

Attending @SonarSource’s Grand Raout annual event in Interlaken #GR23

[Carmine Vassallo @ccvassallo]

“We’ll have a new Renaissance when everyone programs” - missed this quote from @timoreilly!

Talk by @florian_georg at #devopszh

[Carmine Vassallo @ccvassallo]

@dvmarcilio @UberEng That's awesome, congrats!

[Carmine Vassallo @ccvassallo]

Today marks the end of my first week at @SonarQube. Wish me good luck on this new adventure!

[Vladimir Kovalenko @vovak_]

Hi,

Tomorrow (Wednesday) I'm defending my PhD thesis.
You can watch the defence live at 17:30 CET.

Links: https://t.co/i1sTjIrbgh

See you tomorrow!

[Sebastian Proksch @prksch]

Interested in Software Engineering? CI/CD? Want to do a PhD in an awesome group, a recognized university, and in a great county? I have a position for you! Work with me on the next generation of CI/CD tools! Please reach out if you have any open questions. https://t.co/hLfGDj55AD

[DevOps Institute @DEVOPSINST]

A great #SKILUpDay session on #ContinuousTesting from @ccvassallo! If you missed it, @MindsEyeCCF has you covered! Check out this visual summary:

[DevOps Institute @DEVOPSINST]

“Developers are typically not aware of violations of CD principles...such principle violations are a big problem because they lower the expected benefits deriving from the adoption of CD...” @ccvassallo is just getting started during #SKILUpDay

[DevOps Institute @DEVOPSINST]

Join us on November 19 for our virtual event all about #ContinuousTesting! You’ll get to hear from Carmine Vassallo on getting continuous testing done right. Register today, you won’t want to miss #SKILupDay👉 https://t.co/wzBzce3PYY

[Michael Hilton @michaelhilton]

@gasparevitta I talked to a great engineer who once said that CI should either take “tea time, lunch time, or bedtime”

[Linda Erlenhov @LindaErlenhov]

Here’s the video of the full presentation on what developers thinks distinguishes bots from other tools for ESEC/FSE that’s ongoing this week. The session for our study is on Tuesday 17.30 UTC. https://t.co/xk85NoZiRv