Set up SonarQube static analysis on sonarcloud.io

[rdmark]

SonarQube offers powerful static analysis for open source projects on sonarcloud.io that is is straight forward to set up with a GitHub workflow to run analysis on each PR.

I've used it in multiple open source projects with success. It's good at finding buffer overflow, null pointer dereference, race condition and other serious potential bugs without a deluge of false positives.

Something worth considering as an alternative to Coverity. I can set up a bstring organization on sonarcloud.io to get started if you like.

[rdmark]

Example of the netatalk project on sonarcloud.io: https://sonarcloud.io/project/overview?id=Netatalk_netatalk

[msteinert]

Sounds good to me!

[rdmark]

@msteinert It turns out only you can set up the project in sonarcloud.io since it's your personal namespace.

[msteinert]

https://sonarcloud.io/project/overview?id=msteinert_bstring

Looks like there are a few things to fix.

[rdmark]

Ooh, look at that. Only two Security issues, and no Reliability issue above Medium severity. I'd say it's in very good shape.

Interesting to note that most of the Reliability issues are in the test code rather than the library itself.

[rdmark]

Filed #9 to address the important issues