Code audit tools

The families of tools (linter, static analyser, profiler, coverage analyser, dependency analyser), static versus dynamic analysis, reading a report and the quality gate that blocks a delivery.

27 cards
4 topics
Free

Study this deck

The outline, topic by topic

Each topic is weighted the way the exam weighs it.

Concepts
Questions
Sort and link
Scenarios

A few cards from the deck

Linter: what is it?
Show the answer
A tool that reads the source code without running it to report style faults, suspicious constructs and simple errors.
An unused variable, a needless import or a non-compliant name are its usual catches. It is fast and runs on every save or every commit.
The quality gate is "no blocker or critical alert". How many alerts in this report make it fail?

```text
SEVERITE FICHIER LIGNE REGLE
minor cart.py 12 unused-variable
blocker user.py 48 possible-none-dereference
major api.py 90 duplicated-string-literal
critical order.py 31 cognitive-complexity-too-high
info utils.py 7 commented-out-code
`
- 2
- 1
- 3
- 5
Show the answer
2
Only blocker (user.py) and critical (order.py) match the gate. The major, minor and info alerts should be dealt with, but they do not block the delivery.
… analysis observes the program while it runs; … analysis reads it without running it.
Show the answer
Dynamic analysis observes the program while it runs; static analysis reads it without running it.
They complement each other: static analysis sees paths nobody has run, dynamic analysis sees real behaviour (time, memory, data). A profiler and a coverage analyser are dynamic.
Static analysis: what is it?
Show the answer
Examination of the code without running it, which reasons over all possible paths to look for defects.
It covers paths the tests do not reach, but it ignores real data: it sometimes flags cases that will never happen.
The analyser reports "possible division by zero" on a line, but the function starts with assert divisor != 0. What do you do?
- Turn the rule off across the whole project so as never to see it again
- Check the guard, then mark a justified false positive
- Delete the reported line
- Lower the quality gate so that the delivery passes
Show the answer
Check the guard, then mark a justified false positive
Turning the rule off would also hide the real divisions by zero in other functions. A false positive is handled case by case, and the justification lets the next reviewer redo the check. Beware: an assert disappears when Python runs with -O.

Study this deck