 Model to reduce DevOps pipeline execution time using SASTShobhit Kumar Saurabh () and
Deepak Kumar ()
International Journal of System Assurance Engineering and Management, 2024, vol. 15, issue 5, No 29, 1999-2009 Abstract: Abstract Static code analysis (SAST is a well-known concept) to identify security flaws in the code to improve software product quality. A SAST tool called SonarQube which can scan source code of an application and identify the vulnerabilities present in software. It can also find the RCA of the vulnerabilities found in software products. it helps in rehabilitating the securities flaws found in analysis of the software products. SAST tools analyses upside-down for an application. It does not need s system to be in running state to perform analysis. The scan provides instant feedback to developers in terms of reducing security risks for an application. It helps to resolve issues which was present during development and helps developers to increase their knowledge. As a result, developers become competent about knowledge of security for software product. The sonar analysis report provides on demand access to all recommendations. The user can navigate to line-of-code which have vulnerabilities and they can do faster discovery and auditing. And hence the developers can write more code which is less vulnerable. This way they have more secure and quality product delivered. To conduct static analysis, the Authors have used SonarQube as a tool, which compile and measure the code quality for the code kept in repositories. The Authors observed SAST is important step in conductingsecurity and vulnerabilities scan for software product, it was also observed that most of the organisationconduct this SAST at later stage in DevOps/DevSecOps Phase which actually increases pipeline execution time. This motivated Authors topropose a better Model to reduce the build pipeline execution time. As Devops/DevSecOps standards, SonarQube is used to do SASTin DevSecOps pipelines which normally increases the build pipeline execution time. This increases the effort and time to complete the build pipeline and hence it also impacts overall budget of the software product. In the proposed solution, the Authors tried to reduce build pipeline execution time by conducting static analysis early in DevSecOps phases using shift left. Proposed solution uses GitHub open-source project written in C#.NET language, Azure Devops, dotnet sonar scanner tool and SonarQube to conduct static analysis and testing. The authors(s) tried to enhance the software quality in early Devops phases which will be helpful in reducing the build time and cost. Proposed Model will be helpful in increasing reliability, efficiency, and performance of software product. Keywords: Quality attributes; Source code; SonarQube; Dotnet sonar scanner; Static analysis; Technical debt; DevOps; DevSecOps (search for similar items in EconPapers) Downloads: (external link) Related works: Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text Persistent link: https://EconPapers.repec.org/RePEc:spr:ijsaem:v:15:y:2024:i:5:d:10.1007_s13198-024-02262-6 Ordering information: This journal article can be ordered from DOI: 10.1007/s13198-024-02262-6 Access Statistics for this article International Journal of System Assurance Engineering and Management is currently edited by P.K. Kapur, A.K. Verma and U. Kumar More articles in International Journal of System Assurance Engineering and Management from Springer, The Society for Reliability, Engineering Quality and Operations Management (SREQOM),India, and Division of Operation and Maintenance, Lulea University of Technology, Sweden |
Is your work missing from RePEc? Here is how to contribute.
Questions or problems? Check the EconPapers FAQ or send mail to .
EconPapers is hosted by the
School of Business at Örebro University.