Static Code Analysis & Phabricator's Arcanist
Code Reviews
Writing code is a tedious process as it involves many conditions. Often the programmers miss out scenarios which can result in bugs (rainy day scenarios). Another common scenario missed out is optimizing the code for space and time complexity (efficiency). The programmers will be busy trying to address the problem at hand and many a times they miss on optimizing.
When we have Peer code reviews, this can be improved. Having few issues with the code is fine but not having code reviews is not acceptable in any software development team.
Static Code Analysis
In simple terms this method is to assess the behavior of the code by performing lexical, syntax analysis as well as other advanced means. Control flow & Data flow analysis are also performed. Findbugs for Java is to a well established example.
Security considerations are one of the major aspects that static code analysis often targets. OWASP wiki entry on static code analysis is an excellent starting point to learn more.
Linting
Some of the basic static code analyzers are called Linters. Though there is no hard and fast rule to call a certain code analyzer as linting tool I think its safe to assume that the coding standard checkers can be called as a linting tool. The term is originated from a static code analyzer called “Lint”.
Code Review tools
The process of code review is quite tedious and as the complexity of the project increases, this gets tougher. There are numerous tools that helps developers to conduct effective code reviews. With the advent of Continuous Integration, its lot more easier to incorporate code review in an automated fashion. Once the automatic code review is done, its essential to report the issues in a easily addressable way.
New generation Project management and Source Control Management Software like Gitlab integrates automation of the review, CI and CD in an innovative manner.
(A Gitlab repository which is a CI + CD back end for a Github project.)
In addition to the modern all-in-one platforms, there are obviously tools like Reviewboard and others which is focused on the code review alone.
(Review Board an excellent, dedicated code review tool.)
Phabricator
Meet Phabricator – an excellent project management & source code management platform. The platform has a powerful CLI interface which makes it the swiss army knife of Software Development Process.
Well, I have not heard about it, who uses it ?
Honestly this is the most frequent comment I have heard about Phabricator. So here is a list of users:
- Wikimedia Foundation – yea, that small website guys!
- Asana.com
- Blender (https://developer.blender.org/)
- KDE
- then of-course, yours faithfully!
I rest my case.
In my opinion, Phabricator is the best project management and source hosting platform existing with its unique code review features, CLI tools etc. When it comes to CI and CD, phabricator is not the best and with tools like Gitlab and we just have to mirror Phabricator hosted repository and take care of the CI and CD. Needless to say, Phabricator also supports Subversion and Mercurial. Since they provide a powerful programmable API, it may be even possible to integrate with other code management solutions like Preforce.
Arcanist
This section is about arcanist & is intended for users who are new to it or know about it but haven’t set it up anytime.
Arcanist aka arc is the command line tool which is provided by Phabricator to help with code reviews, merging etc. In a nutshell, we can raise a code review, with pre-defined static code analysis and rules using this powerful tool.
There are four sections of this article:
- What is it?
- Which features can we use?
- Why should we bother?
- Quick start guide
What is it ?
Arcanist basically works on top of tools like Git, Differential, Linter etc and provides command line interface to them. It is a code review and revision management utility.
Which features can we use ?
- lint
- diff
- land
- anoid
Why Should we bother ?
Lint: Wouldn’t it be nice if someone could look into your code and point out syntax errors, wrong use of constructs, use of undeclared variable and many more ? It turns out that there are tools which do this exact work and are referred to as Lint. It also simplifies code review process for the reviewer as well as the author
Diff: Working on a project and not sure whether the changes made are ready to be pushed? This is where diff comes into play. If using Git, arc diff sends all commits in a range for review. By default, this range is
git merge-base origin/master HEAD..HEAD
Land: If the review raised through gets accepted, then we use arc land to publish the changes.
Quick Start Guide
Supported on: Linux, Mac OS X, Windows, FreeBSD & there is a quick way to setup anywhere with NixOS.
The one liner install on macOS and Linuxes using the awesome Nix package manager :
sudo mkdir /nix ; sudo chown -R $LOGNAME /nix; bash <(curl https://nixos.org/nix/install) ; . ~/.nix-profile/etc/profile.d/nix.sh;nix-shell -p arcanist
The manual, old school, Installation:
- mkdir ~/phabricator && cd ~/phabricator
- git clone https://github.com/phacility/libphutil.git
- git clone https://github.com/phacility/arcanist.git
- Add ~/phabricator/arcanist/bin to your PATH environment variable
Example:
export PATH=”/home/user/phabricator/arcanist/bin:$PATH”
- Try typing ‘arc’, if it shows usage exception, then we are good so far.
- To set up tab completion add the following to you PATH environment variable
source /path/to/arcanist/resources/shell/bash-completion
Example:-
source /home/user/phabricator/arcanist/resources/shell/bash-completion
Configuring arc for a project :
This section assumes that you have a Phabricator installation at https://phabricator.steem.io
- Goto project directory
- Create a file with name ‘.arcconfig’ (without quotes)
- Paste the following in the file.
{"phabricator.uri" : "https://phabricator.steem.io"}
- Run
arc install-certificate
and follow the instructions.
The commands could be used in this sequence:
arc lint –> arc diff –> arc land
arc lint
Setting up lint :
\1. Create a file with name .arclint
in project directory
\2. Detailed documentation for setting up .arclint
can be found here.
An example of .arclint
file :
{ “linters”: { “lint”: { “type”: “pep8”, “include”: “(\.py$)” } } }
“lint” –> this is a custom name given by you, it doesn’t affect anything.
“type” –> to specify the linter we would like to use.
“include” –> regex for the format of files to lint.
“exclude” –> can be used to exclude files matching include tag in specific directories.
arc diff
First time while using this command, it will ask for access token which can be obtained by following the instructions.
Specify Test plan, reviewers and proceed.
A review request can be updated any number of times before it has been reviewed or separate reviews can be raised using
arc diff –create arc land
Once a review gets accepted, the changes can be published using this command. It is the last step in the standard Differential pre-publish code review workflow. arc anoid
Extended read: arc tasks, arc browse.
Encouragement
The Phabricator command line tooling sounds little weird when we first read the documentation. But once you setup, which is very fast if you follow the documentation as it is, its very powerful. The tools are written in PHP7.X and don’t be concerned, its blazing fast. I have been extensively using it, even to review documents. ie, instead of Google Doc, Tracking via Mircorsoft word’s tracking etc.
(A sample document under review.)
Summary
As already mentioned, test-driven, peer-reviewed code is the only acceptable way to develop software. Code review tools like Phabricator’s inbuilt tools are highly recommended irrespective of the tooling, language that a developer is using.
Thank you for your contribution @bobinson.
After analyzing your tutorial we suggest the following points listed below:
Code / Commands sections are better displayed using the code markup Link.
In the next tutorial we suggest you use the tutorials template. Link
Good information on the code review tool that is always useful for a programmer to use.
Your contribution has been evaluated according to Utopian policies and guidelines, as well as a predefined set of questions pertaining to the category.
To view those questions and the relevant answers related to your post, click here.
Need help? Chat with us on Discord.
[utopian-moderator]
I agree. I had tried to format it but in some places it got cluttered. Let me see how I can it better. Generally I type on Typora and get the content as Markup. This time used another editor and the output became HTML.
@portugalcoin Thanks for your suggestions - I have formatted with the code sections for better clarity.
Thank you for your review, @portugalcoin! Keep up the good work!
Hi @bobinson san, Thanks for this post.
I was wondering if we can use these tools and services to validate sensitive codes?
@inuke,
Both Phabricator and Gitlab can be installed locally - ie lets say in a bank's data center or so. That will make it capable of working with any type of code.
That's awesome. Thanks, mate.
This post has been rewarded with 100% upvote from @indiaunited-bot community account. We are happy to have you as one of the valuable member of the community.
If you would like to delegate to @IndiaUnited you can do so by clicking on the following links: 5SP, 10SP, 15SP, 20SP 25SP, 50SP, 100SP, 250SP. Be sure to leave at least 50SP undelegated on your account.
Please contribute to the community by upvoting this comment and posts made by @indiaunited.
Hey, @bobinson!
Thanks for contributing on Utopian.
We’re already looking forward to your next contribution!
Get higher incentives and support Utopian.io!
Simply set @utopian.pay as a 5% (or higher) payout beneficiary on your contribution post (via SteemPlus or Steeditor).
Want to chat? Join us on Discord https://discord.gg/h52nFrV.
Vote for Utopian Witness!
This codes are out of my range. haha
This post has been included in the latest edition of SoS Daily News - a digest of all you need to know about the State of Steem.
Editor of the The State of Steem SoS Daily News.
Promoter of The State of Steem SoS Weekly Forums.
Editor of the weekly listing of steem radio shows, podcasts & social broadcasts.
Founder of the A Dollar A Day charitable giving project.