Code Review (COBOL first) - Integrate the same functionality as in IDz

[FALLAI-Denis]

Description of the enhancement requested

Hi,

We are concerned with COBOL static code checking.

Currently we use the SonarQube product, but it does not give us satisfaction:

• lagging behind the COBOL standard supported by the IBM Enterprise COBOL compiler
• presence of bugs in the recognition of certain syntaxes which blocks Sonar analysis (the source is no longer analyzed)
• no support in SonarLint when writing COBOL code (with SonarLint connected mode, only certain serious anomalies are reported to the editor and not all defects)

IBM Developer for z/OS offers an online code review solution, and a batch code review with IBM z/OS Source Code Analysis:

• IDz - Source code analysis with Code Review
• IDz - Program Directory for IBM z/OS Source Code Analysis
• IDz - IBM Developer for z/OS; Using the Software Analyzer

We would like IBM Z Open Editor to offer the same code review functionality as IDz, even if the solution is under a paid license. ZOE would limit itself to implementing the interface to the paid solution, as it already does for IBM Dependency Based Build. ZOE could simply interface with IDz - The code review application for Linux and Windows and output analysis via VS Code - Problem Matcher.

It is necessary that the code review can be active at the time of the writing of code, but also at the time of the exécution of the CI build pipeline, in our case Jenkins, with the same control rules.

Writing custom rules, even if they must be coded in Java language, should be possible in a VS Code Workshop to avoid having to install an IDz environment.

Our global enterprise-level code review system must remain SonarQube. It is then necessary that the analysis reports of code review produced by the solution can be imported into SonarQube, and must make it possible to trigger a quality gate to allow the process of the CI build pipeline to be blocked:

• Sonar - Importing third-party issues
• Sonar - Generic issue import format
• Sonar - Importing issues from SARIF reports / Static Analysis Results Interchange Format (SARIF)

[FALLAI-Denis]

Hi,

See Run IBM IDZ Code Review in Batch based on the DBB Build Report

There must be a way to do the same thing from Z Open Editor and using the same technique as IBM User Build to drop the COBOL source and copy them into a workspace on z/OS or USS and calling the Code Review analysis ?

Thanks