View Source

DACI Decision

Status
Impact	This decision affects the level of quality of the application code developed and deployed by the Lab Booster team, that can in turn affect the level of security of the application, its performance , and the end-user experience.
Driver	KRONTIRAS-ext, Pavlos
Approver	KRONTIRAS-ext, Pavlos
Contributors	Who is directly impacted and must be consulted?
Informed	Who should be informed of this decision?
Due date
Outcome	What did you decide?

Tips and info

Contributor? Add your recommendation and reasoning here.

Contributors: I am seeking the right people to get involved in the decision. Add your comments to this page, let's get the conversation started.

Please add:

The people directly impacted by this so we can include them.
Any references to previous work and investigations that we can leverage.
Any constraints and challenges we need to consider to make this decision and following action plan.

Here's an example you can use as a guide.

Decision characteristics
The decision will have a material impact on the customer experience OR will significantly impact the roadmap OR will adversely disrupt an internal business process.
The decision will involve a less than material change to customer experience OR will impact the roadmap OR will impact an existing internal business process
All other decisions

Background

The code of the DataLab application may include inefficiencies, error prone code, or coding errors (bugs). Code Quality tools evaluate the quality of the code and can raise alerts for performance risks, inefficiencies, logical errors, unnecessary code etc. and suggested corrective actions that will improve the quality of the code.

Current state

No standardized code quality tools are used.

Data for decision support

Using code quality tools can reduce development time up to 20% (https://medium.com/@ISHIRInc/top-7-code-quality-tools-you-cant-miss-in-2025-for-cleaner-safer-code-1ec1edde4e72)

Options considered

	Option 1: Do nothing	Option 2: SonarQube	Option 3: Qodana
Description		https://www.sonarsource.com/products/sonarqube/	https://www.jetbrains.com/qodana/
Rollout plan
Pros and cons	No change, BAU Code quality remains questionable Vulnerabilities, inefficient code, potential bugs etc., can continue to be added to the application Additional effort spent on debugging problems that might have otherwise been caught during the build/scanning of the code	Support for multiple programming languages Integration with popular CI/CD tools Ease of use & deployment Detailed reports Plugin can scan code in real time during development Customizable rules Comprehensive service with code quality + security analysis Can be difficult to integrate Not very user friendly UI Only static analysis Learning curve can be steep Can be resource intensive for scans of large projects	Supports multiple languages include Javascript, Typescript, and Python Based on 20+ years of data & feedback from users 2,500+ inspection checks Identifies issues + suggests fixes Identifies vulnerabilities from dependencies and imports Integrates with CI/CD pipeline tools (including GitLab) to enforce quality gates, i.e. build fails if quality standards not met Low cost Can be self-hosted (i.e. more secure) Unlimited lines of code analyzed Integration with IntelliJ IDEA and MS Visual Studio Code
Risks
Estimated cost and effort		Limited functionality for free Developer license $160/year https://www.sonarsource.com/plans-and-pricing/	Starts at €5/month/user (min 3 users) €15/month or €180/year https://www.jetbrains.com/qodana/buy/?billing=yearly

FAQ

Q1.

A1.

References

Relevance	Link
Review of code analysis tools	https://thectoclub.com/tools/best-code-analysis-tools/
SonarQube review	https://www.gartner.com/reviews/market/application-security-testing/vendor/sonarsource/product/sonarqube-server/likes-dislikes?marketSeoName=application-security-testing&vendorSeoName=sonarsource&productSeoName=sonarqube-server
Crucible review	https://www.gartner.com/reviews/market/application-development-life-cycle-management/vendor/atlassian/product/crucible/likes-dislikes?marketSeoName=application-development-life-cycle-management&vendorSeoName=atlassian&productSeoName=crucible

Follow-up action items

Type your task here. Use "@" to assign a user and "//" to select a due date.

Learn more: https://www.atlassian.com/team-playbook/plays/daci

This work is licensed under a Creative Commons Attribution-Non Commercial-Share Alike 4.0 International License.