We have spent many years testing our applications and systems manually and with test automation tools. During this time many bug root causes have been classified and could be detected automatically with special static analysis tools. Most of them could be applied at the early stages of development even before code is integrated into the main development branch. In this talk, I will go through available solutions and demonstrate what kinds of issues may be detected automatically reducing the time and effort of traditional testing.

1. Static analysis tools as the best
friend of QA
Mikalai Alimenkou
@xpinjection
https://t.me/xpinjection_channel
https://xpinjection.com

3. Telegram channel
https://t.me/xpinjection_channel

4. Disclaimer
This talk is based on
personal experience

6. C’mon, bro! Show us the pyramid!

7. Where is
QUALITY?

9. Why most of test automation is too late?
Quality has already degraded and testing just find it,
preventing further propagation
Long feedback cycle for all roles
It is too late when work is done, so fixes cause rework
and additional efforts
Root cause analysis is not easy and doesn’t prevent
issues in the future
Test automation is not cheap

10. Main focus on quality degradation

11. Shift left for defect prevention

12. Traditional static code analysis

13. Static code analysis evaluation
Can find weaknesses in the code at the exact location
Relatively fast if proper automated tools are used
Automated tools can scan the entire code base and
provide mitigation recommendations
Issues are found earlier, reducing the cost to fix
Automated tools produce false positives and negatives
Rules require continuous attention and maintenance
Does not find vulnerabilities introduced in the runtime
environment

14. Dynamic code analysis evaluation
Identifies vulnerabilities in a runtime environment
Performs analysis without access to the actual code
Identifies vulnerabilities that might have been false
negatives in the static code analysis
Can be conducted against any application
Automated tools produce false positives and negatives
Rules require continuous attention and maintenance
Difficult to trace the vulnerability back to the exact
location in the code, taking longer to fix the problem

15. Static analysis tools

17. SonarQube overview
Potential
defects
Maintenance
Debt
Code
Coverage
Leak period

19. Bring it closer to developer!

21. Configuration could also be validated

22. Control commits quality

24. Dynamic persistence config analysis

26. Do you have any secrets? ;)
https://github.com/michenriksen/gitrob
https://github.com/dxa4481/truffleHog
https://github.com/awslabs/git-secrets

27. Full repository history is scanned

29. Are your containers vulnerable?
https://github.com/docker/docker-bench-security
https://github.com/quay/clair
https://github.com/aquasecurity/trivy

30. Very hot topic in containerization era

32. Summary and take aways
Use static analysis to prevent defects
Carefully choose toolset
Shift left as much as possible
Don’t stop on code level only
Empower IDE for continuous QA
Tune tools based on usage feedback
Don’t forget about security, this is hot topic now
Enjoy your life with less defects and better quality!

33. @xpinjection
https://xpinjection.com
https://t.me/xpinjection_channel