Static Code Analysis Tools Resources

Hi James, Thanks for your question. Think of CodeSonar as a three layer architecture. There are build, analysis and storage layers. All layers can be combined together and run in a single environment (VM, container, ...) or they can all be split into their respective environments. The most popular deployment puts compute and storage together, or build and compute together. Each of the components can be run anywhere in the Azure ecosystem. Kicking off the CI/CD process can be done from a command-line as part of the build process and there is a well-documented API available as well. The GrammaTech support team can assist with detailed information if needed. Disclaimer: I am employed by GrammaTech

Micro Focus has a comprehensive set of free training tools! Check out this one on SCA (https://www.youtube.com/watch?v=Fsi20Aa_Vlg&list=PLkBNdmbcM4MPs0XrGEptpuhVNWr1XFkJK) and the whole collection of Fortify Unplugged videos on YouTube at https://www.youtube.com/c/FortifyUnplugged!

Hi Vikash, Typically, Klocwork scans* these days are automated through CI/CD pipelines and as part of the overall DevOps infrastructure. This all started 5-10 years back with the use of tools like Jenkins, Bamboo and TeamCity running on premise and managing the different project builds and pipelines. More recently, CI/CD pipelines have shifted to the cloud and now we more commonly see the cloud-based CI/CD platforms like Azure DevOps, GiLab CI and GitHub Actions as the driver. In all cases, Klocwork has two main modes of operation as part of CI/CD pipelines - either a complete milestone analysis, where the results are uploaded to a central dashboard for compliance reporting and collaboration, which is typically performed with each new commit to the master branch as a confirmation that the code is still secure, reliable and compliant to whatever standards are required, or a super-fast incremental update analysis of the changes local to the feature branch or integration branches, which is run with each commit or pull requests, and helps us to understand whether the changes meet our requirements for the code, in order to maintain security, reliability and compliance. Fundamentally, Klocwork provides the necessary command line interfaces and open APIs in order to seamlessly integrate it into any CI/CD pipeline or DevOps automation project. *Klocwork scans can be used for the detection of coding issues, security vulnerabilities, logic issues and coding standard compliance violations for C, C++, C#, Java, JavaScript and Python code. If this doesn't answer your question, please contact me at creycraft@perforce.com and I'll get you in touch with one of our product experts.