During the implementation process, building applications with consistent code is considered one of the main objectives, which the development team aims to, because it affects the final product quality. Consistent code is the term that means writing code that follows the coding best practices and conforms to rules and standards. Peer review can be considered the method by which we can guarantee that the development team really writes consistent code. The automation took part of the job when static code analysis tools came into the picture. This article tries to explain the concept of static code analysis and tools that can be used to realize this concept. I will focus in this article on managed code analysis, so native or unmanaged code is out of article's scope.

Code analysis is nothing except inspecting code to find common mistakes, provide suggestions for code improvements and re-factoring, and detect violations of coding standards and rules. Code analysis can be considered one of the main quality metrics or KPIs in the implementation process.

There are many managed code analysis tools such as FxCop which is a standalone utility that can be used to analyze managed code against a library of predefined rules. Now this tool is fully integrated with the Visual Studio Team System IDE.

For managed code, Microsoft defines groups of rules related to the implementation process, which cover various aspects such as naming conventions, performance issues, security considerations, globalization, maintainability etc. All of these rules are about two hundreds and compose the library that the VSTS code analysis tool uses to check code consistency.

We will explore the most important rules in the guideline as the following:

Naming Conventions:

These rules enforce naming standards as described in the Design Guidelines. Using these rules verifies that names of items such as assemblies, classes, members, and variables conform to standards. Some rules will even help to detect misspellings in your assigned names.

Performance rules:

These rules help to detect places in your code that may be optimized for performance. They detect a wide variety of wasteful, redundant, or extraneous code.

Security rules:

These rules help to identify insufficient or incorrect security practices. Rules exist to find missing attributes, improper use of permissions, and opportunities of SQL injection attacks.

Design rules:

This group of rules focuses on the interfaces and structure of code and enforces proper implementation of common concepts such as classes, events, collections, namespaces, and parameters.

Globalization rules:

This group supports the internationalization of code and focuses on formatting. It also includes avoiding strings of literal text.

Maintainability rules:

These rules help to make your code easier to maintain and identify potential problems such as complexity and overuse of inheritance.

You can run the code analysis in VSTS by simple build of your application and any violations are detected by the tool will be listed in the error list window as warnings or compilation errors according to your project settings.