NDepend, a powerful static analysis tool for .NET

Patrick Smacchia, the author of NDepend, offered me a license for NDepend and I was thrilled, as I was always interested in it. In this blog post, I’ll be talking about my opinion and thoughts after trying it for the first time.

Static code analysis

Being able to check the quality of your source code before it’s even ran is a very valuable thing to have. In static code analysis, a set of predefined rules are ran against your code to determine whether you need to change anything.

This type of analysis is powerful because it can save you a lot of time, especially in medium/big projects where things like technical debt is something you certainly don’t want to have.

NDepend

NDepend is a static analysis tool for .NET managed code. It contains a lot of predefined metrics, insights and visualizations out of the box. You can easily integrate it with Visual Studio and Azure DevOps.

NDepend is the only Visual Studio extension that is able to tell the developer that over the past hour, the code just written has introduced debt that would cost for example about 30 minutes should it have to be repaid later. Knowing this, the developer can fix the code before even committing it to the source control.

https://www.ndepend.com/

Overview

While trying out NDepend, I was using its Visual Studio’s extension. I used it on the current project I’m working on, which is ML.NET’s AutoML.

Analysis

Firstly, setting up NDepend on the project failed as it couldn’t find the dll files in the Debug folder. The author(s) already thought of this: manually selecting the folder/files.

Note that the test projects and assemblies couldn’t be loaded. If they were loaded, you’ll have to remove them.

Secondly, I ran the analysis and after a couple of seconds, the results were in! An HTML report was generated and auto-opened and the extension shows you some next steps to take.

The dashboard that the extension greets you with is full of information, exactly what you need for a quick overview.

NDepend adds a few tabs, one of them is the “Queries and Rules Explorer”. This tab shows the full list of the code rules (331 as of the time of writing), grouped by type.

Upon clicking on one of them, it takes you to a more detailed tab, “Queries and Rules Edit”. This tab shows you where exactly the rules fail or pass.

Critical Rules

NDepend contains a set of critical rules, which when violated, give an “error”.
These rules are part of the quality gates too. For example:

• Avoid types too big.
• Avoid non-readonly static fields.
• Don’t create threads explicitly.

CQLinq

CQLinq is a feature that comes with NDepend, which lets you query code using LINQ.
For instance, this is one of the predefined rules, which makes sure you don’t explicitly create your own threads:

warnif count > 0 from m in Application.Methods where
  m.CreateA ("System.Threading.Thread".AllowNoMatch())
select new {
   m,
   Debt = 60.ToMinutes().ToDebt(),
   Severity = Severity.Critical
}

This is a very good addition to the tool where people can add their own rules easily.

Conclusion

To sum up, NDepend turned out to be better than what I was expecting. The amount of information you get is incredible and insightful. Considering a license’s price, I highly doubt a solo developer would be able to afford it, but for medium/big teams, I’d say this tool is a must.