A code quality control effectiveness evaluation method based on software development process

Abstract

The present invention relates to the field of software R&D management, and specifically to a code quality control efficiency evaluation method based on the software development process. The evaluation method includes static code scanning control evaluation and Code Review control efficiency evaluation. The beneficial effects are: by quantitatively measuring the code quality control process, the Code Review and static scanning processes are quantified, and objective data is used to represent and measure the code quality control situation, providing data support for the execution of the code control process, urging R&D personnel to standardize the code development process, and improving code quality.

Description

Technical Field

[0001] The present invention relates to the field of software development management, and in particular to a method for evaluating the effectiveness of code quality control based on a software development process. Background Art

[0002] Ensuring the quality of software development code requires standardized code development processes to be managed and controlled, which generally includes the Code Review stage and the code static scanning stage.

[0003] During the Code Review phase, manual review is performed to assess the code's standardization, completeness, correctness, robustness, reusability, security, and scalability to ensure code quality. During the static scanning phase, specific scanning tools such as SonarQube, VeraCode, and Fortify Scan are used to detect code quality attributes such as unit test coverage, code duplication, and security vulnerabilities.

[0004] The execution process of the code development process control will directly affect the subsequent code quality. A reasonable and effective control process will effectively prevent the spread of code problems and reduce the maintenance cost of subsequent code problems. However, there is currently no good measurement method for the code quality control process. Summary of the Invention

[0005] The purpose of the present invention is to provide a method for evaluating the effectiveness of code quality control based on the software development process to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A method for evaluating the effectiveness of code quality control based on a software development process, the method comprising:

[0008] Static code scanning control and assessment, which includes:

[0009] Static scanning of code quality is expected to be performed once or twice each time a MergeRequest is submitted. If a vulnerability or security risk newly discovered during the static scanning fails the static test according to the specified evaluation criteria, the developer will be required to modify their own code to meet the static scanning requirements.

[0010] CodeReview management and control effectiveness evaluation, the CodeReview management and control effectiveness evaluation includes:

[0011] Statistics on the participation of personnel in the manual code review process, statistics on the activity of the proposed discussions, and derive evaluation scores based on the evaluation system;

[0012] For the effective parameters in the scoring calculation formula, it is necessary to use Matlab tools to fit the curve fitting form. According to the actual environment, specific empowerment is carried out. The empowerment process is as follows:

[0013] S1: Collect the calculation elements that need to be included in the statistics of the current code management process;

[0014] S2: Select the basic function equation as the basis for generating the expected distribution;

[0015] S3: Randomly extract 30% of the calculation elements as sample data and perform curve fitting according to the basic formula to find the k value that meets the environmental expectations of the current sample. Repeat this operation 10 times.

[0016] S4: Import the overall calculated element data into the curve. If the coefficient k can make the data distribution error within 5% of the expected value, then use the current coefficient k. If not, remove some noise points and repeat S3.

[0017] Preferably, the static code scanning control and assessment includes a data collection system and a scoring system.

[0018] Preferably, the data acquisition system for the static code scanning control evaluation is a static code scanning control, and the static code scanning control process includes:

[0019] Through SonarQube, the unit test coverage of the code is obtained by scanning the number of times within the specified time as N1, and the number of MergeRequests within this time period is counted as H1;

[0020] The number of code dependency security vulnerability scans obtained through Dependency Check within a specified time period is N2, and the number of MergeRequests within this time period is H2.

[0021] The number of times BugCleaner is used to collect defect statistics for a project within a specified time period is N3, and the number of MergeRequests within this time period is H3.

[0022] The number of code security scans obtained through Fortify Scan within a specified time period is N4, and the number of MergeRequests within this time period is H4.

[0023] Preferably, the scoring system in the static code scanning control evaluation calculates the static code scanning control evaluation score using the following formula:

[0024]

[0025]

[0026] Preferably, the CodeReview management and control effectiveness evaluation includes a data collection system and a scoring system, and the scoring system is a code management metric of the CodeReview process.

[0027] Preferably, the CodeReview data collection comprises the following steps:

[0028] Get the MergeRequest details in the specified time project through the openAPI interface project;

[0029] Get the Discussion and Comment in the MergeRequest according to the MergeRequest details;

[0030] Select the key attributes in Discussion and Comment and store them in the database;

[0031] Obtain commit details of the project within a specified time through the openAPI interface;

[0032] Store the key information of the Discussion into the database.

[0033] Preferably, the code management and measurement process of the CodeReview process is as follows:

[0034] Step 1: Obtain the average daily number of code commits within a specified period and calculate the code commit frequency score;

[0035] Step 2: Get the average number of discussions per day within the specified time period, as well as the number of people who discussed the project within the specified time period, and calculate the code review frequency score.

[0036] Step 3: Get the number of replies to the discussion within the specified time and calculate the code review reply frequency score;

[0037] Step 4: Get the ratio of MergeRequests that have been discussed to the MergeRequests that have been merged, and calculate the frequency score;

[0038] Step 5: Calculate the overall score of the Code Review stage.

[0039] Preferably, the calculation formula for obtaining the code submission frequency score in step 1 is:

[0040]

[0041]

[0042] A represents the daily frequency of code submissions within a specified time period, and M refers to the number of code contributors;

[0043] The formula for calculating the code review frequency score in step 2 is:

[0044]

[0045]

[0046] Y represents the average number of review discussions per person per day, Ad represents the average number of daily reviews, and Md represents the number of people participating in the review;

[0047] The formula for calculating the code review response frequency score in step 3 is:

[0048]

[0049]

[0050] Among them: Am represents the number of replies to the discussion within a specified time, and Mm represents the total number of people who participated in the reply;

[0051] The frequency score calculation formula in step 4 is:

[0052]

[0053] S e =100×R

[0054] Where: Nh represents the number of MRs with discussion in the merged MergeRequest, and Nl represents the total number of merged MergeRequests;

[0055] The overall score calculation formula for the Code Review stage described in step 5 is:

[0056] S=0.2×S i +0.24×S j +0.24×S k +0.32×S e .

[0057] Preferably, the final code performance management and control evaluation score calculation formula is:

[0058] Score = 0.5 × S + 0.5 × P.

[0059] Compared with the prior art, the present invention has the following beneficial effects:

[0060] This invention builds a scoring system for code quality control. This method allows for observation of the overall statistical information of code quality control, from macroscopic to detailed observation, and for observing the entire process of code control. By setting up a scoring system, the effectiveness of demand code quality control can be measured, which can standardize the development behavior of developers and encourage them to form good R&D habits.

[0061] By quantitatively measuring the code quality control process, quantifying the CodeReview and static scanning processes, using objective data to represent and measure the code quality control situation, providing data support for the execution of the code control process, and urging R&D personnel to standardize the code development process and improve code quality. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 Develop a quality assessment flow chart for the code of the present invention;

[0063] Figure 2 This is a flowchart of the code quality performance control and evaluation process of the present invention. DETAILED DESCRIPTION

[0064] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0065] See also Figures 1 to 2 , the present invention provides a technical solution:

[0066] Example 1:

[0067] A code quality control effectiveness evaluation method based on the software development process, the evaluation method includes:

[0068] Static code scanning control assessment includes: static scanning of code quality. It is expected that one or two static code scans will be performed every time a MergeRequest is submitted. If vulnerabilities or security risks that have just appeared in the static code scan fail the static detection according to the specified evaluation criteria, the developer will be required to modify their own code to meet the static scanning requirements.

[0069] Static code scanning control assessment includes a data collection system and a scoring system.

[0070] The data collection system for static code scanning control assessment is the static code scanning control. The static code scanning control process includes:

[0071] Through SonarQube, the unit test coverage of the code is obtained by scanning the number of times within the specified time as N1, and the number of MergeRequests within this time period is counted as H1;

[0072] The number of code dependency security vulnerability scans obtained through Dependency Check within a specified time period is N2, and the number of MergeRequests within this time period is H2.

[0073] The number of times BugCleaner is used to collect defect statistics for a project within a specified time period is N3, and the number of MergeRequests within this time period is H3.

[0074] The number of code security scans obtained through Fortify Scan within a specified time period is N4, and the number of MergeRequests within this time period is H4.

[0075] The scoring system in the static code scanning control assessment calculates the score of the static code scanning control assessment using the following formula:

[0076]

[0077]

[0078] Code Review management effectiveness evaluation includes: statistics on personnel participation in the manual code review process, statistics on the activity of proposed discussions, and evaluation scores based on the evaluation system.

[0079] The CodeReview management effectiveness evaluation includes a data collection system and a scoring system. The scoring system is a code management metric for the CodeReview process.

[0080] CodeReview data collection includes the following steps:

[0081] Get the MergeRequest details in the specified time project through the openAPI interface project;

[0082] Get the Discussion and Comment in the MergeRequest according to the MergeRequest details;

[0083] Select the key attributes in Discussion and Comment and store them in the database;

[0084] Obtain commit details of the project within a specified time through the openAPI interface;

[0085] Store the key information of the Discussion into the database.

[0086] The code control and measurement process of the CodeReview process is as follows:

[0087] Step 1: Get the average daily number of code commits within the specified time period and calculate the code submission frequency score. The formula for calculating the code submission frequency score is:

[0088]

[0089]

[0090] A represents the daily frequency of code submissions within a specified time period, and M refers to the number of code contributors;

[0091] Step 2: Get the average number of discussions per day within the specified time period, as well as the number of people who discussed the project within the specified time period, and calculate the code review frequency score:

[0092] The code review frequency score is calculated as follows:

[0093]

[0094]

[0095] Y represents the average number of review discussions per person per day, Ad represents the average number of daily reviews, and Md represents the number of people participating in the review;

[0096] Step 3: Get the number of replies to the discussion within the specified time and calculate the code review reply frequency score:

[0097] The code review response frequency score is calculated as:

[0098]

[0099]

[0100] Among them: Am represents the number of replies to the discussion within a specified time, and Mm represents the total number of people who participated in the reply;

[0101] Step 4: Get the ratio of MergeRequests that have been discussed in the merged MergeRequests and calculate the frequency score of the ratio. The frequency score calculation formula is:

[0102]

[0103] S e =100×R

[0104] Where: Nh represents the number of MRs with discussion in the merged MergeRequest; Nl represents the number of merged MergeRequests;

[0105] Step 5: Calculate the overall score of the Code Review stage. The formula for calculating the overall score of the Code Review stage is:

[0106] S=0.2×S i +0.24×S j +0.24×S k +0.32×S e .

[0107] The final code performance management and control evaluation score calculation formula is:

[0108] Score = 0.5 × S + 0.5 × P.

[0109] The quantitative scores obtained using this method should conform to current objective laws, that is, the scores should conform to a normal distribution. To ensure that the final scores conform to this characteristic, the valid parameters in the score calculation formula need to be fitted using Matlab tools according to the curve fitting method.

[0110] Carry out specific empowerment according to the actual environment. The empowerment process is as follows:

[0111] S1: Collect the calculation elements that need to be included in the statistics of the current code management process;

[0112] S2: Select the basic function equation as the basis for generating the expected distribution;

[0113] S3: Randomly extract 30% of the calculation elements as sample data and perform curve fitting according to the basic formula to find the k value that meets the environmental expectations of the current sample. Repeat this operation 10 times.

[0114] S4: Import the overall calculated element data into the curve. If the coefficient k can make the data distribution error within 5% of the expected value, then use the current coefficient k. If not, remove some noise points and repeat S3.

[0115] Example 2:

[0116] Based on Example 1, after the code is written, the specific scoring control process is as follows:

[0117] First, the developer conducts self-checks, and then uses static code scanning to detect vulnerabilities or security risks. The code must contain at least one set of errors.

[0118] When an error is detected, the static code scan will show that it has failed. The developer will then recheck the code, make changes, and then perform the static code scan again. This cycle will be repeated multiple times until the static code scan passes.

[0119] The static code scanning control and evaluation system obtains the detection data for the code during the detection process through the data acquisition system.

[0120] During the detection process, SonarQube is used to obtain the unit test coverage of the code written this time. The number of scans within the specified time period is N1, and the number of MergeRequests within this time period is counted as H1.

[0121] The number of code dependency security vulnerability scans obtained through Dependency Check within a specified time period is N2, and the number of MergeRequests within this time period is H2.

[0122] The number of times BugCleaner is used to collect defect statistics for a project within a specified time period is N3, and the number of MergeRequests within this time period is H3.

[0123] The number of code security scans obtained by Fortify Scan within a specified time period is N4, and the number of MergeRequests within this time period is H4.

[0124] The scoring system in the static code scanning control assessment calculates the score of the static code scanning control assessment using the following formula:

[0125]

[0126]

[0127] Substitute the data collected during the detection process into the calculation formula in sequence, and calculate the score of the code written this time in the static code scanning control assessment as P.

[0128] The code that has passed the static code scanning test is put into the CodeReview test system. When an error is detected, the CodeReview test system will show that it has failed. The developer needs to modify it again and then perform the CodeReview test again. This cycle is repeated multiple times until the CodeReview test system passes.

[0129] The data collection system for CodeReview management and control effectiveness evaluation collects data during the detection process. The collected data includes: statistics on personnel participation in the manual code review process, statistics on the activity of the proposed discussions, and evaluation scores derived from the evaluation system.

[0130] During the detection process, the data collection process is as follows:

[0131] Get the MergeRequest details in the specified time project through the openAPI interface project;

[0132] Get the Discussion and Comment in the MergeRequest according to the MergeRequest details;

[0133] Select the key attributes in Discussion and Comment and store them in the database;

[0134] Obtain commit details of the project within a specified time through the openAPI interface;

[0135] Store the key information of the Discussion into the database.

[0136] Thus, data collection is completed, and the collected data are substituted into the calculation formula respectively, where:

[0137] S1: The code submission frequency score calculation formula is:

[0138]

[0139]

[0140] A represents the daily frequency of code submissions within a specified time period, and M refers to the number of code contributors;

[0141] S2: The code review frequency score is calculated as follows:

[0142]

[0143]

[0144] Y represents the average number of review discussions per person per day, Ad represents the average number of daily reviews, and Md represents the number of people participating in the review;

[0145] S3: The code review response frequency score is calculated as follows:

[0146]

[0147]

[0148] Am represents the number of responses to the discussion within a specified time period, and Mm represents the total number of people who participated in the response;

[0149] S4: The frequency score of the ratio is calculated as follows:

[0150]

[0151] S e =100×R

[0152] Nh represents the number of MRs with discussion in the merged MergeRequests. Nl represents the number of merged MergeRequests.

[0153] S5: The overall score calculation formula for the Code Review stage is:

[0154] S=0.2×S i +0.24×S j +0.24×S k +0.32×S e .

[0155] The overall score in the CodeReview management efficiency evaluation phase is S.

[0156] Finally, the final scores of the two-step evaluation phase are summarized to obtain the final code performance control evaluation score:

[0157] Score = 0.5 × S + 0.5 × P.

[0158] Example 3:

[0159] On the basis of Example 2, considering the perfect situation, after the code is written, for a code with zero errors, the calculation formula in the above embodiment will produce a situation where the data is zero.

[0160] During the static code scanning process, the static code scanning is displayed as passed;

[0161] During the detection process, SonarQube is used to obtain the unit test coverage of the code written this time. The number of scans within the specified time period is N1, and the number of MergeRequests within this time period is counted as H1.

[0162] The number of code dependency security vulnerability scans obtained through Dependency Check within a specified time period is N2, and the number of MergeRequests within this time period is H2.

[0163] The number of times BugCleaner is used to collect defect statistics for a project within a specified time period is N3, and the number of MergeRequests within this time period is H3.

[0164] The number of code security scans obtained through Fortify Scan within a specified time period is N4, and the number of MergeRequests within this time period is H4.

[0165] The number of times N1 and H1 are collected is 1, and the rest of the values ​​are 0. Therefore, when the scoring system detects that the value of N1 and H1 is 1, no scoring calculation is performed.

[0166] The data collection system for CodeReview management and control effectiveness evaluation collects data during the detection process. The collected data includes: statistics on personnel participation in the manual code review process, statistics on the activity of the proposed discussions, and evaluation scores derived from the evaluation system.

[0167] During the detection process, the data collection process is as follows:

[0168] Get the MergeRequest details in the specified time project through the openAPI interface project;

[0169] Get the Discussion and Comment in the MergeRequest according to the MergeRequest details;

[0170] Select the key attributes in Discussion and Comment and store them in the database;

[0171] Obtain commit details of the project within a specified time through the openAPI interface;

[0172] Store the key information of the Discussion into the database.

[0173] Thus, data collection is completed, and the collected data are substituted into the calculation formula respectively, where:

[0174] S1: The code submission frequency score calculation formula is:

[0175]

[0176]

[0177] A represents the daily frequency of code submissions within a specified time period, and M refers to the number of code contributors;

[0178] S2: The code review frequency score is calculated as follows:

[0179]

[0180]

[0181] Y represents the average number of review discussions per person per day, Ad represents the average number of daily reviews, and Md represents the number of people participating in the review;

[0182] S3: The code review response frequency score is calculated as follows:

[0183]

[0184]

[0185] Am represents the number of responses to the discussion within a specified time period, and Mm represents the total number of people who participated in the response;

[0186] S4: The frequency score of the ratio is calculated as follows:

[0187]

[0188] S e =100×R

[0189] Nh represents the number of MRs with discussion in the merged MergeRequests. Nl represents the number of merged MergeRequests.

[0190] S5: The overall score calculation formula for the Code Review stage is:

[0191] S=0.2×S i +0.24×S j +0.24×S k +0.32×S e .

[0192] The overall score in the CodeReview management efficiency evaluation phase is S.

[0193] A indicates that the daily code submission frequency within the specified time is 1, and the number of reviews and replies collected is zero. Therefore, when the scoring system detects that the A value is 1, no score calculation is performed.

[0194] Finally, the final code performance management and control evaluation is concluded without scoring. The quantitative score obtained by this method should conform to the current actual objective laws, that is, the score value obtained conforms to the normal distribution. In order to ensure that the final score value conforms to this characteristic, the valid parameters in the score calculation formula need to be fitted using Matlab tools according to the curve fitting form. Specific empowerment is carried out according to the actual environment conditions. The empowerment process is as follows:

[0195] S1: Collect the calculation elements that need to be included in the statistics of the current code management process;

[0196] S2: Select the basic function equation as the basis for generating the expected distribution;

[0197] S3: Randomly extract 30% of the calculation elements as sample data and perform curve fitting according to the basic formula to find the k value that meets the environmental expectations of the current sample. Repeat this operation 10 times.

[0198] S4: Import the overall calculated element data into the curve. If the coefficient k can make the data distribution error within 5% of the expected value, then use the current coefficient k. If not, remove some noise points and repeat S3.

[0199] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A code quality control effectiveness evaluation method based on the software development process, characterized by: The evaluation method includes: Static code scanning control and assessment, which includes: Static scanning of code quality is expected to be performed once or twice each time a MergeRequest is submitted. If a vulnerability or security risk newly discovered during the static scanning fails the static test according to the specified evaluation criteria, the developer will be required to modify their own code to meet the static scanning requirements. CodeReview management and control effectiveness evaluation, the CodeReview management and control effectiveness evaluation includes: Statistics on the participation of personnel in the manual code review process, statistics on the activity of the proposed discussions, and derive evaluation scores based on the evaluation system; For the effective parameters in the scoring calculation formula, it is necessary to fit them using Matlab tools according to the curve fitting form and perform specific empowerment according to the actual environment. The empowerment process is as follows: S1: Collect the calculation elements that need to be included in the statistics of the current code management process; S2: Select the basic functional equation as the basis for generating the expected distribution; S3: Randomly extract 30% of the calculation elements as sample data and perform curve fitting according to the basic formula to find the k value that meets the environmental expectations of the current sample. Repeat this operation 10 times. S4: Import the overall calculated element data into the curve. If the coefficient k can make the data distribution error within 5% of the expected value, then use the current coefficient k. If not, remove some noise points and repeat S3. The static code scanning control and assessment includes a data collection system and a scoring system; The data acquisition system for static code scanning control and assessment is for static code scanning control. The static code scanning control process includes: Through SonarQube, the unit test coverage of the code is obtained by scanning the number of times within the specified time as N1, and the number of MergeRequests within this time period is counted as H1; The number of code dependency security vulnerability scans obtained through Dependency Check within a specified time period is N2, and the number of MergeRequests within this time period is H2. The number of times BugCleaner is used to collect defect statistics for a project within a specified time period is N3, and the number of MergeRequests within this time period is H3. The number of code security scans obtained through Fortify Scan within a specified time period is N4, and the number of MergeRequests within this time period is H4.

2. The method for evaluating the effectiveness of code quality control based on the software development process according to claim 1, characterized in that: The scoring system in the static code scanning control assessment calculates the score of the static code scanning control assessment using the following formula:

3. The method for evaluating the effectiveness of code quality control based on the software development process according to claim 1, characterized in that: The CodeReview management and control effectiveness evaluation includes a data collection system and a scoring system, and the scoring system is a code management metric for the CodeReview process.

4. The method for evaluating the effectiveness of code quality control based on the software development process according to claim 3, characterized in that: The method used by the data collection system in the CodeReview control effectiveness evaluation includes the following steps: Get the MergeRequest details in the specified time project through the openAPI interface project; Get the Discussion and Comment in the MergeRequest according to the MergeRequest details; Select the key attributes in Discussion and Comment and store them in the database; Obtain commit details of the project within a specified time through the openAPI interface; Store the key information of the Discussion into the database.

5. The method for evaluating the effectiveness of code quality control based on the software development process according to claim 4, characterized in that: The code control and measurement process of the CodeReview process is as follows: Step 1: Obtain the average daily number of code commits within a specified period and calculate the code commit frequency score; Step 2: Get the average number of discussions per day within the specified time period, as well as the number of people who discussed the project within the specified time period, and calculate the code review frequency score. Step 3: Get the number of replies to the discussion within the specified time and calculate the code review reply frequency score; Step 4: Get the ratio of MergeRequests that have been discussed to the MergeRequests that have been merged, and calculate the frequency score; Step 5: Calculate the overall score of the CodeReview stage.

6. The method for evaluating the effectiveness of code quality control based on the software development process according to claim 5, characterized in that: The calculation formula for obtaining the code submission frequency score in step 1 is: A represents the daily frequency of code submissions within a specified time period, and M refers to the number of code contributors; The formula for calculating the code review frequency score in step 2 is: Y represents the average number of review discussions per person per day, Ad represents the average number of daily reviews, and Md represents the number of people participating in the review. The formula for calculating the code review response frequency score in step 3 is: Among them: Am represents the number of replies to the discussion within a specified time, and Mm represents the total number of people who participated in the reply; The frequency score calculation formula in step 4 is: S e =100×R Where: Nh represents the number of MRs with discussion in the merged MergeRequest, and Nl represents the total number of merged MergeRequests; The overall score calculation formula for the Code Review stage described in step 5 is: S=0.2×S i +0.24×S j +0.24×S k +0.32×S e 。 7. The method for evaluating code quality control effectiveness based on a software development process according to any one of claims 1 to 6, characterized in that: The final code performance management and control evaluation score calculation formula is: Score = 0.5 × S + 0.5 × P.

Images