Asynchronous static analysis system for a collaborative software development environment
AssigneesAtlassian Pty Ltd., Atlassian Inc.
InventorsMark Adams, Chris Walz, Ming Chang, Erin Jensby, Robbie Gallagher
Life of this patent
Estimating the term…
Abstract
A collaborative software development environment includes a centralized repository security service that monitors a repository database of the collaborative software development environment for change notifications or events. When a change is noticed (e.g., pull request), the source repository is cloned and suitable images are spun up by an orchestrator, each of which is configured to perform a static analysis operation against the source code of the cloned repository. Results of each static analysis operation are stored in a database that can be accessed by client devices.
Claims20
A system for asynchronous static analysis of a source repository stored by a repository service of a collaborative software development environment, the system comprising:
- the repository service comprising a repository database that stores the source repository;
- and
- a repository security service communicably coupled to the repository service and configured to:
- clone a selected branch of the source repository from the repository database to a local directory local to the repository security service as a cloned repository;
- analyze the cloned repository to determine at least one property of at least one source file of the cloned repository;
- select at least one image from an image database, each selected image packaging a respective one static analysis tool configured to perform a static analysis operation associated with the at least one property;
- provide as input to each selected image a pointer to the local directory;
- instantiate each selected image to initiate each respective static analysis operation against the cloned repository;
- and
- store results of each respective static analysis operation in a result database.
A method for triggering static analysis of a repository, the method comprising:
- detecting a change to the repository;
- cloning the repository to a local directory local to a first service;
- accessing the local directory, with the first service;
- analyzing, with the first service, at least one respective file in the cloned repository to determine a respective code type of the at least one respective file;
- and
- assigning a tag, by the first service, to the at least one respective file based on the respective code type;
- instantiating a second service selected at least in part based on the tag;
- determining, by the second service, for each at least one respective file in the cloned repository, whether the at least one respective file contains a software issue;
- and
- storing each determined security vulnerability in a database.
A system for asynchronous static analysis of a source repository, the system comprising:
- an event queue for receiving a repository event indicating a change to the source repository;
- a data detector service for determining a computing language used by the source repository indicated by the repository event;
- an image store configured to store images, each image packaging a respective static analysis tool configured to perform a respective static analysis operation against at least one computing language;
- an orchestrator for selecting at least one image from the image store in based on the computing language used by the source repository as determined by the data detector service, the orchestrator further configured to instantiate each selected image such that each instantiated image initiates the respective static analysis operation against the source repository;
- and
- a result store for receiving and storing results of execution of each initiated respective static analysis operation.
Dependencies are inferred from the claim text.