How startups can manage code efficiently

Challenges for startups

For a startup, self-hosting code requires purchasing physical or cloud servers and hiring skilled personnel for setup and maintenance, increasing both hardware and labor costs.

After setup, you might still face issues like downtime, a lack of disaster recovery backups, and occasional attacks, meaning your code's stability is not guaranteed.

With high developer turnover, it is difficult to establish and maintain unified coding standards, so code quality stagnates.

Code is the lifeblood of a small business. How do you ensure its security?

Alibaba Cloud DevOps Codeup

• Alibaba Cloud DevOps Codeup is a stable, free, and user-friendly enterprise-grade code management platform. The platform automatically provides high availability with multiple replicas, Alibaba Cloud Anti-DDoS protection, and high-speed access, ensuring the security and stability of your code.

• When you commit code, you can configure automatic checks, such as the Alibaba Java Coding Guidelines, sensitive information detection, and dependency vulnerability scanning. By incorporating various code review mechanisms into merge requests, you can improve your company's code security and quality.

• To ensure enterprise code security, the platform provides proactive prevention through features like IP whitelists, automatic permission removal for departing employees, and three-level permission control. It offers real-time warnings by monitoring sensitive behavior and sending high-risk notifications. For post-incident tracing, it continuously records operation logs for repositories, groups, administrators, and code activities.

How developers can get started

1. Initialize a code repository

To collaborate on code, you first need a code repository. You can either import an existing repository or create a new one.

• Import a code repository:

You can bulk import code from various sources, including GitHub, self-hosted GitLab, Alibaba Cloud Code, Gitee, or by using a URL. Depending on the platform, you can authorize access with an access token or OAuth. Learn more. In the Import Code Repository dialog box, select a code source (supported sources include GitHub, self-hosted GitLab, Gitee, CODING, Alibaba Cloud Code, URL Import, and Local Import), enter the corresponding access token, and click OK to complete the import.

• Create a new code repository

To learn how to create a new code repository, see Quick Start.

2. Develop code in the repository

Recommended best practices:

1. When you receive a development task, create a feature branch from the master branch. For more information, see Branching model overview.

2. Clone the feature branch to your local machine and begin development. Commit your code when a task is complete or before you sign off for the day. We recommend committing at least twice per day. Learn more.

3. After you commit your code, a code scan runs automatically. Learn more.

4. After you fix critical issues found by the scan, submit a merge request. Learn more. For more advanced code scanning, use Alibaba Cloud DevOps Flow.

5. Three code review mechanisms are available: a lightweight Merge Request, a formal Code Review, and an automated-assisted Code Review. Learn more.

6. After the code review passes, the code is merged automatically.

How administrators can ensure code security

Code is a critical software asset and the foundation on which many businesses rely. Ensuring its security and preventing leaks is a top priority. Code security is a key concern for administrators, and Alibaba Cloud DevOps Codeup helps administrators protect code with a three-pronged approach: proactive prevention, real-time alerts, and post-incident tracing. In Codeup, go to the Global Settings > Security Center > IP Whitelist page. Toggle the Enable Whitelist Verification switch and select a scope: All (including web access, deploy key access, cloning, downloading, pushing, and merging) or Deploy Key Access only. In the Accessible IPs input field, enter the allowed IP addresses, each on a new line. This field supports CIDR notation (for example, 10.10.10.0/24). To allow access from all IPs, set the value to 0.0.0.0/0. When using integrated third-party services such as Alibaba Cloud DevOps Flow, you must also add their server IPs to the whitelist.

Proactive prevention

• IP whitelist: Define an IP whitelist to restrict repository access to allowed IPs. Denying all other requests significantly enhances security. Learn more.

• Three-level permission control: Use permissions at the enterprise, code group, and repository levels to protect code privacy. Permission configuration details.

• Automatic permission removal for departing employees: When an employee is marked as departed in the Alibaba Cloud DevOps admin console, all their code-related permissions are automatically revoked.

Real-time alerts

• Security risk control: Sensitive information reports and sensitive behavior monitoring help administrators quickly identify and manage risks. Learn more.

• High-risk notifications: For high-risk actions such as deleting a repository or making it public, administrators are immediately notified via in-site messages, email, and other channels. These security alerts are logged and can be exported for more detailed data analysis. Learn more.

Post-incident tracing

Operation logs for repositories, groups, administrators, and code activities are continuously recorded to help administrators trace and troubleshoot issues after an incident. Learn more.

Additional configuration

• Personal settings

• Enterprise settings

Tips

• Large File Storage (LFS) is supported. For more information, see the guide to improving large repository performance.

• Git tutorial.