The computer says no v2
- 1. The computer says no! Software quality in the DevOps world Matteo Emili Microsoft MVP – Azure DevOps [email protected] https://mattvsts.github.io || http://twitter.com/MattVSTS
- 2. “My code is perfect fine!” Yeah… about that.
- 3. “But it works!” It might, but how?
- 4. DevOps is built on top of the concept of quality Even the best craftsmen need a helping hand.
- 5. Automation is king You need maximum automation to get the most value
- 6. Quality needs to be anywhere Every step of the way has key areas for quality improvement
- 7. ‘Quality’ or ‘Code Quality’? Two different things indeed…
- 8. Industry standards Halstead complexity measures Cyclomatic complexity Maintainability index CERT Secure Coding Standards CWE List … Team-specific choices Documentation standards Style rules Patterns re-use Code Coverage Churn rate … Let’s define code quality first
- 9. Industry standards are… …standards. They have been around for a long time.
- 10. Matteo Emili • Born in 1990 Industry standards • Cyclomatic complexity (1976) • Halstead complexity measures (1977) • Software Structure Metrics (1981) • ISO/IEC 9126 Product Quality (1991) • … Some of them, older than me!
- 11. Team choices are varied Plenty of non-technical factors to consider
- 12. How about quality? Quality is all about applying process and practices to ensure the final outcome matches the expectations
- 13. Use tools and automation Quality is all about applying process and practices to ensure the final outcome matches the expectations
- 14. Tools A modern version control system CI server Scripts or extensions for your CI server Code quality scanner Security Vulnerability analysis tools Practices Peer reviews Bug bashes, dedicated spikes Test-driven Development More testing Secure Development Lifecycle Reaching the quality bar
- 15. There is only one pre- requisite for any tool It’s the only rule of modern Software Engineering
- 16. Tools must be integrated in the CI/CD platform of choice Doing otherwise creates unnecessary friction, leading to non-adoption
- 17. Now, tools… What do you actually need to increase the quality of your code?
- 18. Measure (with context) What are you dealing with?
- 19. Metric or discipline Engineering quality Direct security risk Dependency-induced risk Pre-emptive infrastructure analysis Recommended tools SonarQube, Kiuwan, … Checkmarx, BinSkim, Fortify, … WhiteSource AzSK, Azure Scanner, … What and how to measure?
- 20. Let’s take a look! Our guinea pig: PartsUnlimited https://github.com/microsoft/PartsUnlimited
- 21. Each tool should be applied at different stages You don’t want a 30 seconds build to become an hour long…
- 22. What? Engineering quality Direct security risk Dependency-induced risk Pre-emptive infrastructure analysis When? CI build (main branches and PRs) Ad-hoc for master, develop branches All builds After DTL, before UAT Examples of When to do what?
- 23. Is it DevSecOps? It might be (definitions vary), but it is just common sense
- 24. Thanks!