Code quality multi-factor inspection method and inspection system

Abstract

The invention discloses a multi-factor checking method and checking system for code quality, and belongs to the technical field of electric digital data processing, and the method comprises the following steps: obtaining a first code, code detection demand description and a knowledge base; obtaining a plurality of agents, wherein the detection factors of the plurality of agents are different; according to the code detection demand description, matching a corresponding agent; checking the corresponding demand description, the knowledge base and the first code through the intelligent agent to obtain a review result; and fusing the plurality of reviews to obtain a fusion result, and generating an inspection conclusion. A plurality of agents are used for checking a plurality of detection factors on a first code, the agents check the first code for factors which are good at the beginning, and the advantages of the agents are fully utilized; and the inspection results of the intelligent agents are fused to form an inspection conclusion, so that the inspection efficiency and the inspection effect are improved.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing technology, and specifically to a multi-factor inspection method and system for code quality. Background Technology

[0002] As software development becomes increasingly complex and large-scale, code quality and security issues have become more prominent. Modern software projects typically involve multiple programming languages ​​and complex library dependencies, making them prone to introducing various potential vulnerabilities and quality problems during development. Code inspection and review are crucial steps in ensuring the quality of software products.

[0003] Traditionally, code reviews rely on human reviewers, who use their experience and expertise to identify logical flaws and potential design problems. However, with the accelerating pace of software iteration and the introduction of agile development models, the limitations of human review have become increasingly apparent. The process is time-consuming and can easily become a bottleneck; furthermore, the effectiveness of reviews is subject to the reviewers' skill level and condition, easily introducing subjective bias and causing problems to be overlooked; moreover, human review methods struggle to systematically cover recurring issues and the continuous checking of potential risks.

[0004] One method for automated code scanning is static scanning and review based on rules. The code is scanned once after submission, but it lacks contextual relevance, the inspection process relies heavily on expert experience, and it is easy to overlook relevant points of code quality.

[0005] With the development of code review, using models or large models for code scanning and review has become an important development direction. Large models can identify code quality and provide fix suggestions, better leveraging the code scanning advantages of large language models.

[0006] The patent with publication number CN119961941A discloses a method and device for constructing a 0DAY vulnerability detection model based on an AI large model. Adversarial examples are added to the vulnerability detection dataset. The AI ​​large model can learn more diverse vulnerability features during training, but it cannot fully utilize the advantages of multiple models.

[0007] However, there are many different types of large-scale models that have been trained, and each model has its own strengths and detection results. Selecting a large-scale model is a challenge for code quality inspection, and how to use large-scale models for comprehensive and multi-factor inspection has become an important development direction. Summary of the Invention

[0008] To address the aforementioned technical problems in the existing technology, this invention provides a multi-factor code quality inspection method and system that coordinates multiple intelligent agents to perform code quality inspection, leveraging the advantages of each agent to improve the efficiency of code quality inspection.

[0009] This invention discloses a multi-factor code quality inspection method, comprising the following steps: obtaining a first code, a code inspection requirement description, and a knowledge base; obtaining multiple agents, wherein the multiple agents have different inspection factors; matching agents with corresponding inspection factors according to the code inspection requirement description; inspecting the corresponding requirement description, knowledge base, and first code through the agents to obtain review results; merging multiple reviews to obtain a fusion result and generating an inspection conclusion.

[0010] Preferably, the intelligent agent is selected from: functional intelligent agents, logically correct and concise intelligent agents, robust intelligent agents, security intelligent agents, observable intelligent agents, interface intelligent agents, and performance and resource utilization intelligent agents; An intelligent agent that detects factors is used to detect one or more detection needs.

[0011] Preferably, the first code preprocessing method includes: Vectorize the first code to obtain the first vector; Remove the noisy code from the first vector to obtain the valid code; Obtain the dependency files for the first code; Reduce the original dependency file to obtain the valid dependency file.

[0012] Preferred, noise-removed code is selected from: code with only import semantics, code that only describes class field and method renaming, formatting code, log adjustment code, and code that adds annotations; Methods to reduce the original size of dependency files include: Filter dependent files developed by the enterprise itself by using enterprise domain name rules; Determine if the number of lines in the dependent files exceeds the first threshold; If it exceeds the limit, obtain the function call for the first code; The dependent functions are obtained by matching the called functions from the dependency files; Remove some or all of the unmatched functions from the dependency file.

[0013] Preferably, the method for checking the first code group includes: obtaining at least one first file of the first code; Compared to the previous check, filter the second file from the first file to see if it has been modified; Filter the third files related to business logic changes from the second file; Remove noise codes from the third file to obtain a valid file; Based on the second threshold, the valid files are grouped to obtain file groups; The file group is checked sequentially by the intelligent agent.

[0014] Preferably, the method for checking the first code includes: Multiple intelligent agents review the context information, detection requirements, and test cases of the first code to obtain multiple requirement review results; The results of multiple requirement reviews are merged to obtain the requirement fusion result; Multiple intelligent agents review the first code separately to obtain multiple code review results; Multiple code review results are merged to obtain a code fusion result; The results of requirement integration and code integration are organized using a large model to obtain the final review report.

[0015] Preferred methods for integrating review results include: Vectorize multiple review results to obtain a second vector; Calculate the vectorized distance between the two second vectors to obtain the vectorized matrix; Obtain vector pairs in the vectorized matrix whose vector distance is less than the third threshold; Obtain the number of times the review result appears in the vector pair; Calculate the similarity weighted value of the review results based on the number of times; If the weighted similarity value is greater than the fourth threshold, the review result will be included in the review report; If the similarity weighted value is less than or equal to the fourth threshold, the fusion result is obtained by fusing the review results through the large model and included in the review report.

[0016] The preferred formula for calculating the weighted similarity value is: score = x * (100 / n) ; in, x The number of times the review result appears in the vector pair. n This represents the number of review results.

[0017] Preferably, the methods for generating review reports include: Step 501: Determine if there are any problems with the review results; If it does not exist, proceed to step 502: Generate a review approval report; If it exists, proceed to step 503: Generate a review report for the issue, then proceed to step 504; Step 504: Generate optimization suggestions and code examples for the problem, and annotate the knowledge base reference index; Step 505: Classify the problems to obtain problem levels; Step 506: Determine whether the problem level is high-risk; If so, proceed to step 507: Generate a review failure report; If not, proceed to step 502.

[0018] The present invention also provides an inspection system for implementing the above-mentioned multi-factor inspection method, including an acquisition module, an inspection module and a fusion module; The acquisition module is used to obtain the first code, the code detection requirement description, and the knowledge base; The inspection module is used to match the corresponding intelligent agent according to the code inspection requirement description; the intelligent agent inspects the corresponding requirement description, knowledge base and first code to obtain the review result; The fusion module is used to merge multiple reviews to obtain a fusion result; based on the fusion result, an inspection conclusion is obtained.

[0019] Compared with the prior art, the beneficial effects of the present invention are as follows: multiple agents are used to check the first code for multiple detection factors, and the agents check the first code for factors they are good at, making full use of the advantages of the agents; and the inspection results of these agents are integrated to form an inspection conclusion, thereby improving the efficiency and effectiveness of the inspection. Attached Figure Description

[0020] Figure 1 This is a flowchart of the multi-factor detection method of the present invention; Figure 2 This is the flowchart of the first code grouping inspection method; Figure 3 This is a flowchart of the method for checking the first code in Example 2; Figure 4 This is a flowchart of the method for merging multiple reviews in Example 3; Figure 5 This is a flowchart of the review and fusion method in Example 4; Figure 6 This is a logic block diagram of the detection system of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] The present invention will now be described in further detail with reference to the accompanying drawings: Example 1 provides a multi-factor method for checking code quality, such as... Figure 1 As shown, it includes the following steps: Step 101: Obtain the first code, code inspection requirement description, and knowledge base.

[0023] Testing requirements can be provided by users or set by default. Specific testing requirements include: observability requirements, security requirements, performance requirements, functional requirements, test case descriptions, acceptance criteria, and coding standards. Testing requirements may also include business and technical requirements. The first code can be provided as a code file. The knowledge base includes the context information of the first code, dependencies, specification documents, code functions, code architecture, etc. The first code, requirement descriptions, and knowledge base can be submitted via git commit, but are not limited to this.

[0024] Step 102: Obtain multiple intelligent agents, each with different detection requirements and detection factors.

[0025] Based on different detection factors, intelligent agents include: functional intelligent agents, logical correctness and simplicity intelligent agents, robust intelligent agents, security intelligent agents, observability intelligent agents, interface intelligent agents, and performance and resource utilization intelligent agents. An intelligent agent for each detection factor can be used to check one or more detection requirements corresponding to that factor. Functional intelligent agents can be used to detect business functions and technical functions, etc.

[0026] Step 103: Match the corresponding detection factors to the intelligent agent based on the code detection requirement description.

[0027] Step 104: The intelligent agent checks the corresponding requirement description, knowledge base and first code to obtain the review results.

[0028] Step 105: Merge multiple reviews to obtain the merged result.

[0029] Step 106: Based on the fusion result, obtain the inspection conclusion, which includes: pass or fail.

[0030] By utilizing multiple agents to examine the first code for multiple detection factors, each agent examines the first code based on its strengths, thus fully leveraging the advantages of each agent. Furthermore, the examination results of these agents are integrated to form an examination conclusion, thereby improving the efficiency and effectiveness of the examination.

[0031] In one specific embodiment, the requirement description for code inspection input includes the following: 1) Code description and its architecture description. 2) First code and its dependent code; framework code is not considered to focus on business code quality. 3) Development requirement ID, product requirement description, and acceptance criteria based on standard Git commit specifications. 4) Development requirements. 5) Observable requirements, including key steps in requirement implementation, ensuring troubleshooting in critical areas. 6) Security requirements, such as access control, password encryption, XSS vulnerabilities, SQL injection vulnerabilities, etc. 7) Performance requirements, such as query response time not exceeding 200ms. 8) Test case descriptions. 9) Code style guidelines. But not limited to these.

[0032] Step 101 also includes the following methods for preprocessing the first code: Step 111: Vectorize the first code to obtain the first vector. This can be done using SIMD instructions or a large model approach.

[0033] Step 112: Remove the noise code from the first vector to obtain the valid code.

[0034] Noisy code includes: 1) code with only import semantics; 2) code that only describes the renaming of class fields and methods; 3) formatting code, such as changing indentation, spaces, line breaks, and adding or deleting blank lines; modifying the import order of dependencies and removing unused dependencies; 4) logging adjustment code, such as adding and deleting logs; 5) minor changes such as adding annotation code.

[0035] Step 113: Obtain the dependency files for the first code.

[0036] Dependency files can be obtained using a vectorized search method based on their filenames and paths. The dependency files and the initial code can be vectorized before a vectorized search is performed. The initial code file and dependency files can be saved to the same storage device or the same server.

[0037] Step 114: Reduce the original dependency file to obtain the valid dependency file.

[0038] Specifically, the reduction method includes the following steps: Step 141: Filter the dependency files developed by the enterprise itself using enterprise domain name rules.

[0039] Most of the dependency files developed by the company itself are business code, which is rarely used as dependency files. However, due to different developer habits, there are instances where the company's own code is used as a dependency file. Therefore, step 141 is an optional step.

[0040] Step 142: Determine whether the number of lines in the dependent files exceeds the first threshold.

[0041] If the number of calls exceeds the limit, proceed to step 143: obtain the calling function of the first code.

[0042] Step 144: Match the called function from the dependency file to obtain the dependency function.

[0043] Step 145: Remove some or all of the unmatched functions from the dependency file, keeping the dependent functions.

[0044] If the first code A calls function a, and its dependent files B match dependent functions b1 and b2, then these two dependent functions are kept, while other dependent functions, such as b3 and b4, are deleted.

[0045] Step 102 also includes a method for checking the first code group, such as... Figure 2 This includes the following steps: Step 201: Obtain at least one first file of the first code.

[0046] Step 202: Compared with the previous check, filter the modified second file from the first file.

[0047] Step 203: Filter the third files related to business logic changes from the second files.

[0048] Step 204: Remove noise code from the third file to obtain a valid file.

[0049] Step 205: Based on the second threshold, group the valid files to obtain file groups.

[0050] For example, 10-30 valid files can be grouped into a file group. Valid files and their dependent files must be within the same file group. A tolerance threshold can also be set: the sum of the number of valid files and dependent files must be less than or equal to the sum of a second threshold and a tolerance threshold. If the second threshold is 10 and the tolerance threshold is 5, then the sum of the number of valid files and dependent files will not exceed 15.

[0051] Step 206: The file group is checked sequentially by the intelligent agent.

[0052] After checking one set of valid documents, check another set of valid documents; alternatively, different sets can be checked in parallel to improve efficiency.

[0053] Example 2 provides a specific method for checking the first code, such as... Figure 3 This includes the following steps: Step 401: Multiple intelligent agents review the context information, detection requirements, and test cases of the first code to obtain multiple requirement review results.

[0054] For each item in the testing requirements, determine whether the corresponding function has been implemented in the first code or test case. If it has been implemented, mark it as implemented and indicate the key steps or code locations. You can also add the following: "AI review suggestion, for reference only". If it has not been implemented, make the corresponding annotation. If it is uncertain whether it has been implemented, mark it as "Unconfirmed".

[0055] The review method for test cases is the same as that for the first code, and will not be repeated here.

[0056] Step 402: Merge the results of multiple requirement reviews to obtain the requirement fusion result.

[0057] Step 403: The first code is reviewed by multiple agents to obtain multiple code review results.

[0058] Step 404: Merge multiple code review results to obtain the code fusion result.

[0059] Step 405: Organize the requirements fusion results and code fusion results through the large model to obtain the final review report.

[0060] Specifically, the system uses prompts to input the results of requirement reviews and code reviews into the large model, and then receives the output from the large model. However, the processing methods are not limited to this.

[0061] Example 3 provides a method for merging multiple reviews, such as... Figure 4 This includes the following steps: Step 501: Determine if there are any problems with the review results.

[0062] If it does not exist, proceed to step 502: Generate a review approval report.

[0063] If it exists, proceed to step 503: Generate a review report for the issue, and then proceed to step 504.

[0064] Step 504: Generate optimization suggestions and code examples for the problem, and annotate the knowledge base reference index. The knowledge base reference index can index the specific content of the knowledge base.

[0065] Step 505: Classify the problem to obtain the problem level.

[0066] Step 506: Determine whether the problem level is high-risk.

[0067] If so, proceed to step 507: Generate a review failure report.

[0068] If not, proceed to step 502.

[0069] The report can be in JSON Schema format, but is not limited to this. A specific report should include the following items: First code directory, detection requirements, issue name, issue level, issue description, source code, suggested code, relevant lines of code, knowledge base reference index, review results, and high-risk issues.

[0070] Example 4 provides another method for fusing review results, such as Figure 5 This includes the following steps: Step 511: Vectorize multiple review results to obtain a second vector.

[0071] If the review results L1 and L2 are vectorized, the second vectors E1 and E2 are obtained. The review results include the requirements review results and the code review results.

[0072] Step 512: Calculate the vectorized distance between the two second vectors to obtain the vectorized matrix.

[0073] The vectorized distance is calculated as follows: ; in, Sim(Ei,Ej) Represents the second vector Ei and Ej Vectorized distance between them i and j They are not the same. Table 1 shows an example of a vectorized matrix.

[0074] Table 1

[0075] Step 513: Obtain vector pairs in the vectorized matrix whose vector distance is less than the third threshold. For example, if the distance between the second vectors E1 and E2 is 0.12, which is less than the third threshold of 0.2, then E1 and E2 constitute a vector pair, and the corresponding review results L1 and L2 also constitute a review pair.

[0076] Step 514: Obtain the number of times the second vector of the review result appears in the vector pair.

[0077] Table 2 shows the specific number of matches.

[0078] Table 2

[0079] Step 515: Based on the number of times x Calculate the weighted similarity value of the review results. score .

[0080] The formula for calculating the weighted similarity value is: score = x * (100 / n) ; in,x The number of times the review result appears in the vector pair. n This represents the number of review results.

[0081] If the weighted similarity value is greater than the fourth threshold, such as greater than 60 points, proceed to step 516: include the review results in the review report. The portion of the review results that is consistently output has high confidence.

[0082] If the weighted similarity value is less than or equal to the fourth threshold, proceed to step 517: fuse the review results using the large model to obtain the fusion result, and include the fusion result in the review report. If the conclusions are inconsistent, explore potential associations using the large model.

[0083] Example 5 provides a detection system for implementing the above-described multi-factor code quality detection method, such as... Figure 6 It includes: acquisition module 1, inspection module 2, and fusion module 3; The acquisition module 1 is used to obtain the first code, the code detection requirement description, and the knowledge base; Inspection module 2 is used to match the corresponding detection factors to the intelligent agent according to the code detection requirement description; the intelligent agent checks the corresponding requirement description, knowledge base and first code to obtain the review result; The fusion module 3 is used to merge multiple reviews to obtain a fusion result; and based on the fusion result, an inspection conclusion is obtained.

[0084] This invention uses a large model to identify code quality and provide repair suggestions. Based on the above-mentioned multi-factor context scanning and inspection, the advantages of intelligent code scanning based on a large language model can be better utilized. Although intelligent code scanning can provide analysis and reasoning about the problems in the code after inputting the code, if the complete context of the code is provided in the knowledge base, the reasoning and analysis of the large language model can be more comprehensive and accurate.

[0085] This invention allows scanning tasks to be defined using natural language. The method is not limited to a specific code language and can be applied to scanning code in languages ​​such as Java, Go, Python, and JavaScript, demonstrating its universality across languages.

[0086] It should also be noted that, without conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0087] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A multi-factor method for checking code quality, characterized in that, Includes the following steps: Obtain the first code, code inspection requirements description, and knowledge base; Multiple intelligent agents are obtained, and the detection factors of the multiple intelligent agents are different; Based on the code detection requirement description, match the corresponding detection factors to the intelligent agent; The intelligent agent checks the corresponding requirement description, knowledge base, and first code to obtain the review results; Multiple reviews are merged to obtain a merged result, and an inspection conclusion is generated. The intelligent agents are selected from: functional intelligent agents, logically correct and concise intelligent agents, robust intelligent agents, security intelligent agents, observable intelligent agents, interface intelligent agents, and performance and resource utilization intelligent agents.

2. The multi-factor detection method according to claim 1, characterized in that, An intelligent agent that detects factors is used to examine one or more detection requirements.

3. The multi-factor detection method according to claim 1, characterized in that, The first code preprocessing methods include: Vectorize the first code to obtain the first vector; Remove the noisy code from the first vector to obtain the valid code; Obtain the dependency files for the first code; Reduce the original dependency file to obtain the valid dependency file.

4. The multi-factor detection method according to claim 3, characterized in that, The noise-removed code is selected from: code with only import semantics, code that only describes the renaming of class fields and methods, formatting code, log adjustment code, and code that adds annotations; Methods to reduce the original size of dependency files include: Filter dependent files developed by the enterprise itself by using enterprise domain name rules; Determine if the number of lines in the dependent files exceeds the first threshold; If it exceeds the limit, obtain the function call for the first code; The dependent functions are obtained by matching the called functions from the dependency files; Remove some or all of the unmatched functions from the dependency file.

5. The multi-factor detection method according to claim 1, characterized in that, It also includes methods for checking the first code group: Obtain at least one first file of the first code; Compared to the previous check, filter the second file from the first file to see if it has been modified; Filter the third files related to business logic changes from the second file; Remove noise codes from the third file to obtain a valid file; Based on the second threshold, the valid files are grouped to obtain file groups; The file group is checked sequentially by the intelligent agent.

6. The multi-factor detection method according to claim 1, characterized in that, Methods for checking the first code include: Multiple intelligent agents review the context information, detection requirements, and test cases of the first code to obtain multiple requirement review results; The results of multiple requirement reviews are merged to obtain the requirement fusion result; Multiple intelligent agents review the first code separately to obtain multiple code review results; Multiple code review results are merged to obtain a code fusion result; The results of requirement integration and code integration are organized using a large model to obtain the final review report.

7. The multi-factor testing method according to claim 1, characterized in that, Methods for integrating review results include: Vectorize multiple review results to obtain a second vector; Calculate the vectorized distance between the two second vectors to obtain the vectorized matrix; Obtain vector pairs in the vectorized matrix whose vector distance is less than the third threshold; The number of times the second vector that yields the review result appears in the vector pair; Calculate the similarity weighted value of the review results based on the number of times; If the weighted similarity value is greater than the fourth threshold, the review result will be included in the review report; If the similarity weighted value is less than or equal to the fourth threshold, the fusion result is obtained by fusing the review results through the large model and included in the review report.

8. The multi-factor detection method according to claim 7, characterized in that, The formula for calculating the weighted similarity value is: score = x * (100 / n) ； in, x The number of times the review result appears in the vector pair. n This represents the number of review results.

9. The multi-factor detection method according to claim 1, 6, or 7, characterized in that, Methods for generating review reports include: Step 501: Determine if there are any problems with the review results; If it does not exist, proceed to step 502: Generate a review approval report; If it exists, proceed to step 503: Generate a review report for the issue, then proceed to step 504; Step 504: Generate optimization suggestions and code examples for the problem, and annotate the knowledge base reference index; Step 505: Classify the problems to obtain problem levels; Step 506: Determine whether the problem level is high-risk; If so, proceed to step 507: Generate a review failure report; If not, proceed to step 502.

10. An inspection system, characterized in that, For implementing the multi-factor inspection method as described in any one of claims 1-9, the inspection system includes an acquisition module, an inspection module, and a fusion module; The acquisition module is used to obtain the first code, the code detection requirement description, and the knowledge base; The inspection module is used to match the corresponding detection factors to the intelligent agent based on the code detection requirement description; The intelligent agent checks the corresponding requirement description, knowledge base, and first code to obtain the review results; The fusion module is used to merge multiple reviews to obtain a fusion result; Based on the fusion results, an inspection conclusion is obtained.

Images