Code scanning for quality and security

1. Common challenges

• Inconsistent coding standards: Limited developer expertise, especially when relying on outsourced teams, can lead to poorly designed business logic. This code often lacks compatibility and scalability, introducing hidden defects that create a risk of failure.

• Sensitive data leaks: A lack of security awareness can lead developers to hardcode sensitive company information into the code. This can result in data exfiltration, creating opportunities for malicious actors and causing business losses.

• Vulnerable dependencies: Code inevitably relies on internal or third-party packages. When using open-source dependencies, your own code may be secure, but a vulnerability in a dependency can be exploited by attackers.

• Code optimization: Developers seek professional recommendations to optimize their code.

2. Enable code scanning services

Alibaba Cloud DevOps Code Management includes multiple scanning services. To ensure you get scan results for every commit, create a scan task in the code scanning section as soon as you create a repository.

In the New scan task dialog, under Detection Parameters, set build environment to JDK 1.8, build tool to maven 3.6.3, and runner cluster/machine to Alibaba Cloud DevOps Default Build Cluster. Keep the default mvn build command. Select I have read and agree to the scan service agreement, then click Create and Run.

Select the recommended Java scan scheme (compilation required), configure the parameters as described above, and choose a trigger: a commit trigger or a merge request trigger.

• A commit trigger automatically starts a full scan of the entire branch every time new code is pushed.

• A merge request trigger automatically starts an incremental scan of the source and target branches when a merge request is created or updated. An incremental scan analyzes only the changed content (the diff).

The scheme includes the following scanning services:

(1) Code Quality — Java development specification scan

The Alibaba Java Development Manual defines the development standards followed by Java engineers at Alibaba. It covers programming rules, unit testing, exception and logging guidelines, MySQL specifications, project structure, and security rules. This manual distills the collective experience of tens of thousands of Alibaba Java experts, refined through extensive, large-scale, real-world application.

[Mandatory]: You must follow these rules. Violating them can lead to serious consequences.

[Recommended]: You should follow these rules. Adhering to them helps improve system stability and team efficiency.

[Reference]: Understand these guidelines fully. They provide direction for individual learning, team communication, and project collaboration.

The Java development specification scan uses a plugin to check your code against the rules in the Alibaba Java Development Manual.

(2) Code Security — sensitive information detection

The sensitive information detection feature finds credentials and secrets, such as API keys, in your repository. By integrating it into the merge request review stage, you can effectively prevent accidentally committing sensitive information.

Sensitive information issues are classified into the following severity levels: BLOCKER, CRITICAL, and MAJOR.

BLOCKER: These are plaintext secrets with a high probability of being genuine, as identified by rule-based scanning.

CRITICAL: These are potential secrets with a high probability, as identified by an information entropy model.

MAJOR: These are sensitive information fields likely used for testing.

(3) Code Security — dependency vulnerability scan

To eliminate security risks, companies need to:

1. Know which dependencies are used in their projects.

2. Remove unnecessary dependencies.

3. Detect and fix known vulnerabilities in current dependencies.

The dependency vulnerability scan service lets companies easily check the security of their project dependencies.

Dependency vulnerabilities are classified as BLOCKER, CRITICAL, or MAJOR. The classification is based on the National Vulnerability Database (NVD) CVSS.

BLOCKER: This is a high-risk vulnerability that we recommend fixing immediately.

CRITICAL: This is a medium-risk vulnerability that we recommend fixing as soon as possible.

MAJOR: Low-risk vulnerability.

3. Run scans on code commits

To prevent issues from reaching production, the earlier you perform checks, the lower the risk. We recommend running code scans on every commit. This allows you to find and fix problems at the source, ensuring the stability of your development workflow.

When you enable the scan service with a commit trigger, automated checks run on the newly committed files with every push. You can view the scan results on the source file or commit page. After pushing code, a check status overlay appears on the repository page indicating that Some checks failed, and the my_yunxiao_project-scan task is marked as failed. A red failed icon also appears next to the commit record. Clicking the icon reveals a pop-up with the same message: Some checks failed, and the my_yunxiao_project-scan task is marked as failed.

You can click the scan task to view the issue details. We recommend resolving Serious issues immediately, as they are likely to cause failures or security vulnerabilities. The scan result pop-up shows Scan not passed. This full scan of 9 files found 9 issues: 2 Serious, 4 Warning, and 3 Suggestion. The issues are in pom.xml, DemoApplication.java, and DemoApplicationTests.java. Click View details to locate the specific problems.

4. Run scans on merge requests

When you enable the service with a merge request trigger, an automated check runs on the changed files every time a merge request is created or its source branch is updated. This ensures the quality and security of the new code being merged into the target branch.

You can view scan results on the merge request list and details pages. When a scan is complete, its result appears in the merge request list. If all checks pass, a green checkmark icon is displayed. Click the icon to expand a status window that shows All checks passed and lists the successful scan tasks, such as my_yunxiao_project-scan task. On the merge request details page, click the automated checks tab to view the results. This tab provides a summary (passed, not passed, running exception, running) and detailed results for each task. It includes the number of Serious, Warning, and Suggestion issues, and a list of unresolved issues with details like the rule name, file name, severity level, and the author.

Click an unresolved issue to view its details and jump to the specific line of code. On the merge request details page, select the File Changes tab to view the code differences. The Scan Issues panel on the right displays the problems found by the automated checks, categorized by severity (Serious, Warning, and Suggestion), along with recommended fixes. The Unresolved button in the upper-right corner shows the total count of outstanding issues.

5. Scan history

For security issues, it is often necessary to track statistics and review historical data. Alibaba Cloud DevOps Code Management provides a dedicated dashboard that aggregates all detected issues and maintains a record of resolved ones.

In the left navigation pane of the repository, click code scanning to open the scan dashboard, and then select the issue list tab. The dashboard divides issues into Unresolved and Resolved. Each issue entry displays its type (security/specification), file name, severity level (Serious/Warning/Suggestion), the author, and the time it was introduced. At the top, you can filter issues by severity, type, rule package, author, and introduction time.

Similarly, you can click an issue name to view its details and recommended solution. The issue list on the scan task page categorizes issues as security or specification and shows counts for unresolved and resolved items. When you click a specific issue (for example, ClassMustHaveAuthorRule), the details panel on the right displays the issue status, the commit that introduced the issue, the file path, a code snippet, and remediation guidance.

TIP: For sensitive information detection, if you want to skip scanning certain files, you can use the file whitelist feature. The scanner skips files in the whitelist. You can add files to the whitelist in the scan scheme settings for your repository. On the Code scanning > Scan schemes page, find your target scheme (for example, Java Recommended Scan Scheme (Compilation required)) and click the Settings tab. Here, you can configure the Scheme Name, Scheme Description, and the file whitelist (which supports ?, *, and ** wildcards). A Delete Scheme button is available at the bottom of the page (this action cannot be undone).

Summary

Shifting testing to the left by running automated scans on every commit and merge request ensures the quality and security of both existing and new code. This practice effectively improves development efficiency and helps your business deliver more value.