Static source code scanner

A computer system for scanning source code files included in an application, the computer system comprising:

• a code scan system comprising a hardware processor and memory to perform the steps of:
• compiling a set of source code files to generate an assembly, wherein the assembly further contains assembly code and assembly metadata;
• deploying the assembly and a second set of source code files directly to a production environment, wherein the second set of source code files are direct-deploy files that are not compiled;
• building the application, by the production environment, from the assembly and the second set of source code files;
• subsequent to the building, identify potential code vulnerabilities within the application build that could affect the functionality of the production environment by:
• identifying assembly for the application build within the production environment;
• identifying a file path for each source code file of a plurality of source code files identified from the assembly metadata of the assembly;
• responsive to identifying the file paths from the assembly metadata, identifying the set of source code files within a code repository based on their respective file path identified from the assembly metadata, wherein the code repository comprises the set of source code files that contribute to assembly output of the compiler and direct-deploy files that are not compiled;
• and
• scanning the set of source code files to identify potential code vulnerabilities in the set of source code files, wherein a functionality of the production environment is improved by omitting others of the second set of source code files that were deployed directly outside of compiling process to provide functionality for the application.

A computer program product for scanning source code files included in an application, the computer program product comprising:

• a computer-readable storage media having program code stored thereon;
• program code, stored on the computer-readable storage media, for compiling a set of source code files to generate an assembly, wherein the assembly further contains assembly code and assembly metadata;
• program code, stored on the computer-readable storage media, for deploying the assembly and a second set of source code files directly to a production environment, wherein the second set of source code files are direct-deploy files that are not compiled;
• program code, stored on the computer-readable storage media, for building the application, by the production environment, from the assembly and the second set of source code files;
• program code, stored on the computer-readable storage media, for subsequent to the building, identifying potential code vulnerabilities within the application build that could affect the functionality of the production environment by:
• identifying assembly for the application build within the production environment;
• identifying a file path for each source code file of a plurality of source code files identified from the assembly metadata of the assembly;
• responsive to identifying the file paths from the assembly metadata, identifying the set of source code files within a code repository based on their respective file path identified from the assembly metadata, wherein the code repository comprises the set of source code files that contribute to the assembly output of the compiler and direct-deploy files that are not compiled;
• and
• scanning the set of source code files to identify potential code vulnerabilities in the set of source files, wherein a functionality of the production environment is improved by omitting others of the second set of source code files that were deployed directly outside of compiling process to provide functionality for the application.