We build software using Hudson and Maven. We have C#, java and last, but not least PL/SQL sources (sprocs, packages, DDL, crud)

For C# and Java we do unit tests and code analysis, but we don't really know the health of our PL/SQL sources before we actually publish them to the target database.

### Requirements

There are a couple of things we wan't to test in the following priority:

1. Are the sources valid, hence "compilable"?
2. For packages, with respect to a certain database, would they compile?
3. Code Quality: Do we have code flaws like duplicates, too complex methods or other violations to a defined set of rules?

Also,

* the tool must run head-less (commandline, ant, ...)
* we want to do analysis on a partial code base (changed sources only)

### Tools

We did a little research and found the following tools that could potencially help:

* **[Cast Application Intelligence Platform (AIP)](http://www.castsoftware.com/Product/Application-Intelligence-Platform.aspx):** Seems to be a server that grasps information about "anything". Couldn't find a console version that would export in readable format.
* **[Toad for Oracle](http://www.toadsoft.com/toad_oracle.htm):** The Professional version is said to include something called Xpert validates a set of rules against a code base.
* **[Sonar](http://www.sonarsource.com) + [PL/SQL-Plugin](http://www.sonarsource.com/plugins/plugin-plsql/):** Uses Toad for Oracle to display code-health the sonar-way. This is for browsing the current state of the code base.
* **[Semantic Designs DMSToolkit](http://www.semanticdesigns.com/Products/DMS/DMSToolkit.html?Home=PLSQLTools):** Quite general analysis of source code base. Commandline available?
* **[Semantic Designs Clones Detector](http://www.semanticdesigns.com/Products/Clone/index.html?Home=PLSQLTools):** Detects clones. But also via command line?
* **[Fortify Source Code Analyzer](http://www.fortify.com/products/detect/in_development.jsp):** Seems to be focussed on security issues. But maybe it is extensible? *[more...](http://products.enterpriseitplanet.com/security/security/1101145596.html)*

So far, Toad for Oracle together with Sonar seems to be an elegant solution. But may be we are missing something here?

Any ideas? Other products? Experiences?

### Related Questions on SO:

* [Any Static Code Analysis Tools for Stored Procedures?](https://stackoverflow.com/questions/531430/any-static-code-analysis-tools-for-stored-procedures)
* <https://stackoverflow.com/questions/839707/any-code-quality-tool-for-pl-sql>
* [Is there a static analysis tool for Python, Ruby, Sql, Cobol, Perl, and PL/SQL?](https://stackoverflow.com/questions/956104/is-there-a-static-analysis-tool-for-python-ruby-sql-cobol-perl-and-pl-sql)