Incremental analysis method and apparatus for codes, and related product

Abstract

Provided in the present application are an incremental analysis method and apparatus for codes, and a related product, which can improve the accuracy of the incremental analysis of codes. The method can be applied to the incremental analysis apparatus. Specifically, the incremental analysis apparatus acquires an incremental analysis request, wherein the request is used for instructing the execution of incremental analysis on a second source code on the basis of a first source code, and the second source code is obtained by means of updating the first source code. Subsequently, the incremental analysis apparatus determines factors that affect the incremental analysis result, and executes incremental analysis on the second source code on the basis of the determined factors, wherein the factors that affect the incremental analysis result comprise at least one of changes in source codes, a change in a compilation command of the source codes, and a change in the configuration of a code analysis tool used for executing incremental analysis.

Description

Incremental analysis method, device and related product of a code

[0001] The present application claims priority to the Chinese patent application No. 202410813597.5, filed on June 21, 2024, with the State Intellectual Property Office of China, the Chinese patent application No. 202411356967.3, filed on September 26, 2024, with the State Intellectual Property Office of China, and the Chinese patent application No. 202410813597.5, filed on June 21, 2024, with the State Intellectual Property Office of China, the Chinese patent application No. 202411356967.3, filed on September 26, 2024, all of which are entitled “Incremental analysis method and related product” and “Incremental analysis method, device and related product of a code”, the contents of which are incorporated herein by reference in their entirety. TECHNICAL FIELD

[0002] The present application relates to the technical field of code analysis, in particular to an incremental analysis method, device and related product of a code. BACKGROUND

[0003] Analyzing software using a static analysis tool can improve the quality and security of the software, but for large-scale software systems, it often takes a long time to perform an analysis, therefore, incremental analysis can be performed on the software. Incremental analysis refers to incremental analysis of the source code of the software, that is, only the changed part of the source code is analyzed, rather than the entire source code, which can timely discover problems caused by changes in the source code, and thus help developers discover and fix these problems early in the development process.

[0004] In the prior art, the changed part of the source code can be determined based on a code merge request (MR) submitted by a developer, and then a code analysis tool (such as CSA, CppCheck, ClangTidy, etc.) is used to analyze the determined changed part, thereby obtaining the incremental analysis result. MR refers to the process in which a developer submits his own code to the main code library after completing his own code writing, and requests the administrator of the main code library to merge his written code into the main code library. MR usually includes information related to the changed source code, such as change description, change content, change purpose, and test results. Therefore, the incremental analysis result obtained by the above method only considers the changes in the source code and does not consider other factors that affect the incremental analysis result, which reduces the accuracy of code incremental analysis. SUMMARY

[0005] The present application provides an incremental analysis method, device and related product of a code, which can improve the accuracy of code incremental analysis.

[0006] In a first aspect, the present application provides a method for performing incremental analysis on code. The method can be applied to an incremental analysis device. Specifically, the incremental analysis device receives an incremental analysis request, which indicates that the incremental analysis is to be performed on a second source code of a second version of software based on a first source code of a first version of software, where the second source code is obtained by updating the first source code. Then, the incremental analysis device determines factors that affect the result of the incremental analysis according to the first source code and the second source code, the compilation command of the first source code and the compilation command of the second source code, and the configuration of a first code analysis tool and the configuration of a second code analysis tool, and performs the incremental analysis on the second source code based on the determined factors. The factors that affect the result of the incremental analysis include one or more of the following: changes in the first source code and the second source code, changes in the compilation command of the first source code and the compilation command of the second source code, and changes in the configuration of the first code analysis tool and the configuration of the second code analysis tool, where the first code analysis tool is used to perform the incremental analysis on the first source code, and the second code analysis tool is used to perform the incremental analysis on the second source code.

[0007] In the technical solution provided by the present application, the incremental analysis device can perform the incremental analysis on the second source code according to the changes in the first source code and the second source code, the changes in the compilation command of the first source code and the compilation command of the second source code, and the changes in the configuration of the first code analysis tool and the configuration of the second code analysis tool. That is, the technical solution provided by the present application takes into account the influence of the changes in the source code, the changes in the compilation command of the source code, and the changes in the configuration of the code analysis tool on the incremental analysis of the source code, so that the analysis result obtained by using the above-mentioned solution has better accuracy.

[0008] In a possible implementation, the incremental analysis request includes the compilation command of the second source code and the configuration of the second code analysis tool. The incremental analysis device determines the factors that affect the result of the incremental analysis by generating the summary information corresponding to the second source code according to the incremental analysis request, where the summary information corresponding to the second source code is used to describe the second source code, the compilation command of the second source code, and the configuration of the second code analysis tool. Then, the incremental analysis device compares the summary information corresponding to the second source code with the summary information corresponding to the first source code to determine the factors that affect the result of the incremental analysis, where the summary information corresponding to the first source code is used to describe the first source code, the compilation command of the first source code, and the configuration of the first code analysis tool.

[0009] In a possible implementation, the summary information corresponding to the second source code includes a first hash value and a second hash value. The incremental analysis device generates the summary information corresponding to the second source code according to the incremental analysis request, including the following steps: the incremental analysis device obtains the first hash value according to the second source code and the compilation command of the second source code, and obtains the second hash value according to the configuration of the second code analysis tool.

[0010] In a possible implementation, the incremental analysis device further stores the summary information corresponding to the second source code to the storage device.

[0011] It can be seen that the summary information corresponding to the second source code represents the second source code, the compilation command of the second source code, and the configuration of the second code analysis tool by means of hash values. Therefore, the storage space required for storing the summary information corresponding to the second source code is relatively small.

[0012] In a possible implementation, the configuration of the second code tool includes at least one of version information of the second code analysis tool, rules used by the second code analysis tool, and models used by the second code analysis tool. Therefore, the incremental analysis device obtains the second hash value according to the configuration of the second code analysis tool, including the following steps: the incremental analysis device obtains a hash value corresponding to the rules according to the rules used by the second code analysis tool; and obtains a hash value corresponding to the models according to the models used by the second code analysis tool.

[0013] In a possible implementation, the incremental analysis device performs incremental analysis on the second source code according to the determined factors, including the following steps: the incremental analysis device analyzes the changed source code according to changes between the first source code and the second source code; analyzes the source code corresponding to the changed compilation command according to changes between the compilation command of the first source code and the compilation command of the second source code; and analyzes the entire content of the second source code according to changes between the configuration of the first code analysis tool and the configuration of the second code analysis tool.

[0014] It can be seen that the technical solution provided by the present application does not limit the programming language of the second source code, does not limit the used code analysis tool, and does not depend on the content of the code analysis tool. Therefore, the application difficulty of code incremental analysis can be reduced by using the technical solution provided by the present application.

[0015] In a second aspect, the present application provides an incremental analysis device. The device comprises an obtaining module, a comparing module and an analyzing module. The obtaining module is configured to obtain an incremental analysis request, the request being configured to indicate that incremental analysis is to be performed on a second source code of a second version of software based on a first source code of a first version of the software, wherein the second source code is obtained by updating the first source code. The comparing module is configured to determine factors affecting the incremental analysis result based on the first source code and the second source code, a compilation command of the first source code and a compilation command of the second source code, and a configuration of a first code analysis tool and a configuration of a second code analysis tool, wherein the first code analysis tool is configured to perform the incremental analysis on the first source code, and the second code analysis tool is configured to perform the incremental analysis on the second source code. The factors affecting the incremental analysis result comprise one or more of the following: changes in the first source code and the second source code, changes in the compilation command of the first source code and the compilation command of the second source code, and changes in the configuration of the first code analysis tool and the configuration of the second code analysis tool. The analyzing module is configured to perform the incremental analysis on the second source code based on the determined factors.

[0016] In a possible implementation, the incremental analysis request comprises the compilation command of the second source code and the configuration of the second code analysis tool. The comparing module is configured to generate the summary information corresponding to the second source code based on the incremental analysis request, and compare the summary information corresponding to the second source code with the summary information corresponding to the first source code to determine the factors affecting the incremental analysis result. The summary information corresponding to the second source code is configured to describe the second source code, the compilation command of the second source code and the configuration of the second code analysis tool, and the summary information corresponding to the first source code is configured to describe the first source code, the compilation command of the first source code and the configuration of the first code analysis tool.

[0017] In a possible implementation, the summary information corresponding to the second source code comprises a first hash value and a second hash value. The comparing module is configured to obtain the first hash value based on the second source code and the compilation command of the second source code, and obtain the second hash value based on the configuration of the second code analysis tool.

[0018] In a possible implementation, the comparing module is further configured to store the summary information corresponding to the second source code to a storage device.

[0019] In a possible implementation, the configuration of the second code tool comprises at least one of version information of the second code analysis tool, rules used by the second code analysis tool, and models used by the second code analysis tool. Therefore, the comparing module can specifically obtain a hash value corresponding to the rules used by the second code analysis tool based on the rules, and obtain a hash value corresponding to the models used by the second code analysis tool based on the models.

[0020] In a possible implementation, the analysis module is configured to analyze the changed source code according to changes in the first source code and the second source code; analyze the source code corresponding to the changed compilation command according to changes in the compilation command of the first source code and the compilation command of the second source code; and analyze all contents of the second source code according to changes in the configuration of the first code analysis tool and the configuration of the second code analysis tool.

[0021] In a third aspect, the present application provides a computing device. The computing device includes a processor and a memory, wherein the processor is configured to execute instructions stored in the memory to cause the computing device to perform part or all of the method described in the first aspect and any of the implementation manners thereof.

[0022] In a fourth aspect, the present application provides a computing device cluster. The computing device cluster includes at least one computing device, and each computing device includes a processor and a memory. The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the computing device cluster to perform part or all of the method described in the first aspect and any of the implementation manners thereof.

[0023] In a fifth aspect, the present application provides a computer program product including instructions. The computer program product can be software or a program product including instructions capable of running on a computing device or stored in any available medium. When the computer program product runs on the computing device, the computing device is caused to perform part or all of the method described in the first aspect and any of the implementation manners thereof.

[0024] In a sixth aspect, the present application provides a computer readable storage medium. The computer storage medium includes computer program instructions, and when the computer program instructions are executed by a computing device, the computing device is caused to perform part or all of the method described in the first aspect and any of the implementation manners thereof. BRIEF DESCRIPTION OF DRAWINGS

[0025] FIG. 1 is a schematic diagram of a code analysis scenario provided by the present application;

[0026] FIG. 2 is a flow diagram of an incremental analysis method of code provided by the present application;

[0027] FIG. 3 is a schematic diagram of an abstract information template provided by the present application;

[0028] FIG. 4 is a schematic diagram of another abstract information template provided by the present application;

[0029] FIG. 5 is a structural schematic diagram of an incremental analysis apparatus provided by the present application;

[0030] FIG. 6 is a structural schematic diagram of a computing device provided in the present application;

[0031] FIG. 7 is a structural schematic diagram of a computing device cluster provided in the present application;

[0032] FIG. 8 is a structural schematic diagram of another computing device cluster provided in the present application. DETAILED DESCRIPTION

[0033] To solve the problem of low accuracy of code incremental analysis, the present application provides a code incremental analysis method. The method can be applied to an incremental analysis device. In a specific implementation, the incremental analysis device can identify changes in code and compilation commands between the source code to be analyzed and the historical version of the source code associated therewith, as well as changes in the configuration of the code analysis tool used in the current analysis and the code analysis tool used in the historical analysis, and perform incremental analysis on the source code according to the identified changes. It can be seen that the technical solution provided in the present application not only considers the influence of changes in the source code on the incremental analysis result, but also considers the influence of changes in the compilation commands of the source code and the configuration of the code analysis tool on the incremental analysis result, thereby improving the accuracy of code incremental analysis.

[0034] The technical solution provided in the present application will be described below in conjunction with the accompanying drawings.

[0035] Referring to FIG. 1, FIG. 1 exemplarily shows a schematic diagram of a code analysis scenario to which the present application is applicable. It should be understood that in actual applications, the technical solution provided in the present application can also be applicable to other code analysis scenarios, which is not limited in the present application. For ease of description, the following embodiments will be introduced in the scenario shown in FIG. 1.

[0036] As shown in FIG. 1, the scenario includes a client 100, a code analysis system 200 and a code repository 300, wherein the client 100, the code analysis system 200 and the code repository 300 are connected through a network, which can be a wide area network or a local area network.

[0037] The client 100 is used to realize human-computer interaction, which can be specifically a software or an application (such as a browser, an application (APP), etc.) deployed on a terminal device, and the terminal device can be a desktop computer, a notebook computer, a tablet computer, a smart phone, etc.

[0038] The code analysis system 200 is configured to implement incremental analysis of source code of software, and can include an incremental analysis device 210 and a storage device 220, where the incremental analysis device 210 and the storage device 220 are connected through a network. In a specific implementation, the incremental analysis device 210 can be deployed on a single computing device or a computing device cluster composed of multiple computing devices, where the computing device can be a server such as a central server in a cloud data center, an edge server or a local server in a local data center, or a terminal device such as a desktop computer or a notebook computer. The storage device 220 can be composed of at least one storage node, where the storage node is a device with storage capability, for example, the device can include a hard disk, a magnetic disk or the like.

[0039] It is worth noting that, in addition to the separate deployment of the incremental analysis device 210 and the storage device 220 in the code analysis system 200 as shown in FIG. 1, the incremental analysis device 210 and the storage device 220 can also be deployed in one according to business needs, for example, the incremental analysis device 210 and the storage device 220 can be deployed by the same hardware resource, and the functions of the incremental analysis device 210 and the storage device 220 can be respectively implemented by different software modules. For ease of description, the following embodiments are described with reference to the deployment mode shown in FIG. 1.

[0040] The code repository 300 is configured to store and manage source code of software, and can be a code repository deployed in a cloud data center, or a code repository deployed in a local server.

[0041] In the scenario shown in FIG. 1, a user can submit source code of multiple versions of software to the code repository 300. Accordingly, the code repository 300 can store and manage source code of multiple versions of software.

[0042] When the incremental analysis needs to be performed on the source code of a certain version of the software, the user can send an incremental analysis request to the incremental analysis device 210 through the client 100. After receiving the incremental analysis request, the incremental analysis device 210 obtains the source code to be analyzed from the code repository 300, and generates the summary information corresponding to the source code to be analyzed, which is used to describe the source code to be analyzed, the compilation command of the source code to be analyzed, and the configuration of the code analysis tool used in this analysis. The incremental analysis device 210 also obtains the summary information corresponding to the historical version of the source code associated with the source code to be analyzed from the storage device 220, which is used to describe the historical version of the source code, the compilation command of the historical version of the source code, and the configuration of the code analysis tool used to analyze the historical version of the source code. Then, the incremental analysis device 210 compares the summary information corresponding to the source code to be analyzed and the summary information corresponding to the historical version of the source code, determines the changes of the source code to be analyzed and the historical version of the source code, the changes of the compilation command of the source code to be analyzed and the compilation command of the historical version of the source code, and the changes of the configuration of the code analysis tool used in this analysis and the configuration of the code analysis tool used in the historical analysis. Subsequently, the incremental analysis device 210 obtains the content to be analyzed according to the determined changes, analyzes the content to be analyzed, obtains the corresponding analysis result, and feeds back the obtained analysis result to the user through the client 100, so that the user can know the defects in the source code analyzed this time.

[0043] Next, the process of how the code analysis system 200 implements the incremental analysis of the source code of the software will be introduced in combination with the flow diagram of the incremental analysis method of the code shown in FIG. 2.

[0044] In step 101, the client 100 sends an incremental analysis request to the incremental analysis device 210. Correspondingly, the incremental analysis device 210 receives the incremental analysis request sent by the client 100.

[0045] The incremental analysis request is used to instruct to perform the incremental analysis on the source code of the second version of the software (hereinafter referred to as "source code B") based on the source code of the first version of the software (hereinafter referred to as "source code A"). The source code B is obtained based on the source code A, in other words, the source code B is obtained by updating the source code A. The source code A can be understood as the historical version of the source code, and the source code B can be understood as the new version of the source code compared with the historical version.

[0046] The incremental analysis request can include the identification of the source code A, the identification of the source code B, the compilation command of the source code B, and the configuration of the code analysis tool (hereinafter referred to as "code analysis tool B") used in this analysis (i.e., performing the incremental analysis on the source code B). Wherein:

[0047] (1) The identifier of the source code A can include an identifier of the software (such as a name or a number of the software), and in addition, can include version information of the source code A and the like capable of indicating the source code A. Similarly, the identifier of the source code B can include an identifier of the software, and in addition, can include version information of the source code B and the like capable of indicating the source code B.

[0048] (2) The compilation command of the source code B refers to an instruction of converting the source code B into executable code. Since the source code B can be composed of one or more source code files, one source code file can correspond to one or more compilation commands, and thus the number of the compilation commands of the source code B can be one or more.

[0049] (3) The configuration of the code analysis tool B can include one or more of the following: version information of the code analysis tool B, rules (hereinafter referred to as "rules of the code analysis tool B") and models (hereinafter referred to as "models of the code analysis tool B") used by the code analysis tool B for checking defects in the source code B. Among them, the models of the code analysis tool B are used to provide a framework for the rules of the code analysis tool B, so that the above-mentioned rules can be applicable to this incremental analysis.

[0050] It is worth noting that the number of the rules of the code analysis tool B and the number of the models of the code analysis tool B can be one or more, and one model of the code analysis tool B can be associated with one or more rules of the tool. In addition, the rules of the code analysis tool B can include user-defined rules (hereinafter referred to as "custom rules of the code analysis tool B"), and can also include rules pre-installed in the code analysis tool B (hereinafter referred to as "built-in rules of the code analysis tool B"). Similarly, the models of the code analysis tool B can include user-defined models (hereinafter referred to as "custom models of the code analysis tool B"), and can also include models pre-installed in the code analysis tool B (hereinafter referred to as "built-in models of the code analysis tool B"). However, considering that the built-in models of the code analysis tool are usually related to the version of the tool, and when the built-in models of the code analysis tool are changed, the version information of the tool will also be changed, therefore, in the following embodiments, the models contained in the configuration of the code analysis tool B refer to the custom models of the tool.

[0051] In a specific implementation, the incremental analysis device 210 provides an access interface, which can be implemented through an application programming interface (application programming interface, API) or a graphical user interface (graphical user interface, GUI). Therefore, the client 100 can send an incremental analysis request to the incremental analysis device 210 through the above-mentioned access interface.

[0052] Taking the GUI implemented by the access interface as an example, the client 100 can send the incremental analysis request to the incremental analysis apparatus 210 in the following manner: the incremental analysis apparatus 210 displays a GUI to the user through the client 100, the GUI can provide an identification information input box and a compilation command input box, the user can input the identification of the source code A and the identification of the source code B in the identification information input box, and input the compilation command of the source code B in the compilation command input box. The above-mentioned GUI can also display a plurality of code analysis tools provided by the incremental analysis apparatus 210 and the rules preset in each code analysis tool, the user can select the required code analysis tool (i.e., the code analysis tool B) and the required rule (i.e., the built-in rule of the code analysis tool B) based on the business requirement. In addition, the above-mentioned GUI also supports the user to configure the custom rule and the custom model for the code analysis tool B. Based on the above-mentioned operation of the user, the client 100 can generate the incremental analysis request and send the incremental analysis request to the incremental analysis apparatus 210.

[0053] Step 102, the incremental analysis apparatus 210 acquires the source code B from the code repository 300 according to the incremental analysis request.

[0054] Specifically, the code repository 300 pre-stores a plurality of versions of source codes of a software, wherein the plurality of versions of source codes of the software include the source code A and the source code B. Therefore, the incremental analysis apparatus 210 can acquire the source code B in the following manner: the incremental analysis apparatus 210 sends a query request to the code repository 300 according to the identification of the source code B in the incremental analysis request, the query request carries the identification of the source code B. Then, the code repository 300 filters the source code B from the plurality of versions of source codes pre-stored in the code repository 300 according to the identification of the source code B in the above-mentioned query request, and returns the source code B to the incremental analysis apparatus 210. Thus, the incremental analysis apparatus 210 can acquire the source code B.

[0055] Step 103, the incremental analysis apparatus 210 generates the summary information corresponding to the source code B (hereinafter referred to as "summary information B") according to the source code B and the incremental analysis request.

[0056] Specifically, the incremental analysis apparatus 210 pre-stores a summary information template, which is used to indicate the format of the summary information B and the content required to be included in the summary information B. Therefore, the incremental analysis apparatus 210 can generate the summary information B according to the summary information template, the source code B, and the compilation command and the configuration of the code analysis tool B carried in the incremental analysis request, the summary information B is used to describe the source code B, the compilation command of the source code B, and the configuration of the code analysis tool B.

[0057] For ease of understanding, the summary information template and the summary information B generated based on the template are introduced below through an example.

[0058] As shown in FIG. 3, the summary information template includes two parts of content, one part is basic message, and the other part is issue message. The basic message includes version information of the code analysis tool, a hash value corresponding to the built-in rule, a hash value corresponding to the custom rule, a hash value corresponding to the custom model, and the association of the custom model with the built-in rule and / or the custom rule. Among them, the hash value corresponding to the built-in rule refers to the hash value calculated based on the built-in rule, the hash value corresponding to the custom rule refers to the hash value calculated based on the custom rule, and the hash value corresponding to the custom model refers to the hash value calculated based on the custom model. The issue message includes a hash value corresponding to the source code and its compilation command, a file name of the analysis report of the source code, and a mapping relationship between the hash value and the file name. Among them, the hash value corresponding to the source code and its compilation command refers to the hash value calculated based on the source code, the compilation command of the source code, and the dependent file of the source code. The file name of the analysis report of the source code refers to the name of the file recording the analysis result of the source code, wherein the analysis result of the source code refers to the result obtained by the code analysis tool based on the built-in rule and / or the custom rule analyzing the source code.

[0059] It should be understood that FIG. 3 only exemplarily shows a possible summary information template, and in actual application, the summary information template can also have other forms, such as the summary information template shown in FIG. 4. As shown in FIG. 4, the summary information template also includes two parts of content, basic message and issue message, but different from the summary information template shown in FIG. 3 is that the summary information template shown in FIG. 4 uses the name of the built-in rule of the code analysis tool, the name of the custom rule, and the name of the custom model to represent the built-in rule of the code analysis tool, the custom rule, and the custom model, while the summary information template shown in FIG. 3 uses the hash value corresponding to the built-in rule of the code analysis tool, the hash value corresponding to the custom rule, and the hash value corresponding to the custom model to represent the built-in rule of the code analysis tool, the custom rule, and the custom model. In addition, the summary information template shown in FIG. 4 does not include the association of the custom model with the built-in rule and / or the custom rule. In general, the user can flexibly design the summary information template based on the actual business needs. However, in order to facilitate the description, the following embodiments will be introduced taking the summary information template shown in FIG. 3 as an example.

[0060] Based on the summary information template shown in FIG. 3, the incremental analysis device 210 can generate the summary information B through the following steps:

[0061] Step i, the delta analysis device 210 obtains one or more of the following by parsing the delta analysis request: version information of the code analysis tool B, built-in rules, custom rules, custom models, and a compilation command of the source code B.

[0062] Step ii, the delta analysis device 210 calculates a hash value corresponding to the built-in rules according to the built-in rules of the code analysis tool B.

[0063] Since the name of the built-in rule can uniquely identify the built-in rule, the delta analysis device 210 can calculate the hash value corresponding to the built-in rule based on the name of the built-in rule. Specifically, the built-in rules of the code analysis tool B can be one or more. When the built-in rules of the code analysis tool B are only one, the delta analysis device 210 can calculate the name of the built-in rule using a hash algorithm, thereby obtaining the hash value corresponding to the built-in rule. When the built-in rules of the code analysis tool B are multiple, the delta analysis device 210 can first splice the names of the multiple built-in rules, and then calculate the spliced string using a hash algorithm, thereby obtaining the hash value corresponding to the built-in rules.

[0064] The "hash algorithm" involved in the above steps can be any one of a secure hash algorithm (SHA), a message digest algorithm 5 (MD5), a MurmurHash algorithm, and the like, and the application is not limited in this regard. In addition, the "splicing the names of the multiple built-in rules" involved in the above steps can be implemented by the delta analysis device 210 in the following manner: the delta analysis device 210 sorts the names of the multiple built-in rules in alphabetical order, and then splices the sorted multiple names, thereby obtaining the spliced string. In addition to the above manner, the delta analysis device 210 can also implement other splicing manners, and the application is not limited in this regard.

[0065] Step iii, the delta analysis device 210 calculates a hash value corresponding to the custom rules according to the custom rules of the code analysis tool B.

[0066] Since the name of the custom rule can uniquely identify the custom rule, the incremental analysis device 210 can calculate the hash value corresponding to the custom rule based on the name of the custom rule. Specifically, the custom rule of the code analysis tool B can be one or more. When the custom rule of the code analysis tool B is only one, the incremental analysis device 210 can calculate the name of the custom rule using a hash algorithm, thereby obtaining the hash value corresponding to the custom rule. When the custom rule of the code analysis tool B is more than one, the incremental analysis device 210 can first splice the names of the plurality of custom rules, and then calculate the spliced string using a hash algorithm, thereby obtaining the hash value corresponding to the custom rule.

[0067] It should be understood that the implementation of the "hash algorithm" and "splicing the names of the plurality of custom rules" involved in this step can refer to the implementation of the "hash algorithm" and "splicing the names of the plurality of custom rules" involved in the above step ii, which will not be introduced here.

[0068] Step iv, the incremental analysis device 210 calculates the hash value corresponding to the custom model of the code analysis tool B according to the custom model of the code analysis tool B.

[0069] Since the content of the custom model can reflect the rules used by the code analysis tool, the incremental analysis device 210 can calculate the hash value corresponding to the custom model by the following way: taking one custom model as an example, the incremental analysis device 210 calculates the content of the custom model using a hash algorithm (such as SHA, MD5, MurmurHash, etc.), thereby obtaining the hash value corresponding to the custom model. It should be understood that when the custom model of the code analysis tool B is more than one, the hash values corresponding to other custom models can also be calculated by the above-mentioned way, and for the sake of brevity, this will not be described here.

[0070] Step v, the incremental analysis device 210 generates the file name of the analysis report of the source code B.

[0071] Since the source code B is composed of at least one source code file, and the analysis operation is usually performed in units of source code files, one source code file will correspond to at least one analysis report file. That is, the analysis report of the source code B is composed of at least one analysis report file, and accordingly, the file name of the analysis report of the source code B includes at least one analysis report file name.

[0072] Step vi, the incremental analysis device 210 calculates the hash value corresponding to the source code B and its compilation command according to the source code B and its compilation command.

[0073] In practical applications, the user provides the incremental analysis device 210 with only part of the compilation commands (i.e., the compilation commands carried in the incremental analysis request), and the other part of the compilation commands is recorded in the dependency file of the source code B, which refers to the files that are dependent on when the source code B is compiled using the compilation commands, such as header files (.h files) and library files (.lib files or.so files). Therefore, the incremental analysis device 210 can obtain the hash value corresponding to the source code B and the compilation commands thereof in the following manner:

[0074] Taking one source code file in the source code B as an example, the incremental analysis device 210 determines the dependency file of the source code file, and then uses a hash algorithm (such as SHA, MD5, MurmurHash, etc.) to calculate the source code file, the compilation commands of the source code file, and the dependency file of the source code file. The hash value obtained by the calculation is the hash value corresponding to the source code file and the compilation commands thereof.

[0075] It should be understood that when the source code B is composed of only one source code file, the hash value obtained by the calculation is the hash value corresponding to the source code B and the compilation commands thereof. When the source code B is composed of multiple source code files, the hash values corresponding to the other source code files and the compilation commands thereof can also be obtained by the above-mentioned manner. Therefore, the hash value corresponding to the source code B and the compilation commands thereof includes the hash values corresponding to the multiple source code files and the compilation commands thereof.

[0076] Step vii, the incremental analysis device 210 establishes a mapping relationship between the file name of the analysis report of the source code B and the hash value corresponding to the source code B and the compilation commands thereof, wherein there is a mapping relationship between the hash value corresponding to one source code file and the compilation commands thereof and the file name of the analysis report file of the source code file.

[0077] Step viii, the incremental analysis device 210 fills the contents obtained in the above-mentioned steps (including the version information of the code analysis tool B, the hash value corresponding to the built-in rules, the hash value corresponding to the custom rules, the hash value corresponding to the custom model, the rules associated with the custom model, the hash value corresponding to the source code B and the compilation commands thereof, the file name of the analysis report of the source code B, and the mapping relationship between the hash value corresponding to the source code B and the compilation commands thereof and the file name of the analysis report of the source code B) into the summary information template to obtain the summary information B.

[0078] It can be understood that the above steps i to viii are only one possible implementation of generating the summary information B, and in actual applications, the incremental analysis device 210 can also generate the summary information B in other manners. For example, when the summary information B is generated using the summary information template shown in FIG. 4, the incremental analysis device 210 can directly fill the names of the built-in rules of the code analysis tool B, the names of the custom rules, and the names of the custom models into the summary information template. In general, the specific implementation process of the incremental analysis device 210 for generating the summary information B can be changed accordingly based on the summary information template, which is not limited herein.

[0079] Step 104, the incremental analysis device 210 acquires, from the storage device 220 according to the incremental analysis request, summary information corresponding to the source code A (hereinafter referred to as "summary information A").

[0080] The storage device 220 pre-stores the identifier of the source code A and the summary information A corresponding to the identifier. The summary information A is used to describe the source code A, the compilation command of the source code A, and the configuration of the code analysis tool A used for the historical analysis (i.e., performing the incremental analysis on the source code A). For example, the summary information A can include one or more of the following: version information of the code analysis tool A, hash values corresponding to the built-in rules, hash values corresponding to the custom rules, hash values corresponding to the custom models, rules associated with the custom models, file name of the analysis report of the source code A, hash values corresponding to the source code A and the compilation command thereof, mapping relationship between the file name of the analysis report of the source code A and the hash values corresponding to the source code A and the compilation command thereof. It should be understood that since the summary information A is similar to the summary information B described above, for brevity, the summary information A will not be described here.

[0081] In a specific implementation, the incremental analysis device 210 can acquire the summary information A from the storage device 220 in the following manner: the incremental analysis device 210 sends a query request to the storage device 220 according to the identifier of the source code A in the incremental analysis request, and the query request carries the identifier of the source code A. Then, the storage device 220 determines the summary information A corresponding to the identifier of the source code A according to the identifier of the source code A in the query request, and returns the determined summary information A to the incremental analysis device 210. Thus, the incremental analysis device 210 can acquire the summary information A.

[0082] Step 105, the incremental analysis device 210 compares the summary information A and the summary information B to determine the changes of the summary information A and the summary information B.

[0083] The change of the summary information A and the summary information B can include one or more of the following: ① the version information of the code analysis tool A is inconsistent with the version information of the code analysis tool B; ② the hash value corresponding to the built-in rule of the code analysis tool A is inconsistent with the hash value corresponding to the built-in rule of the code analysis tool B; ③ the hash value corresponding to the custom rule of the code analysis tool A is inconsistent with the hash value corresponding to the custom rule of the code analysis tool B; ④ the hash value corresponding to the custom model of the code analysis tool A is inconsistent with the hash value corresponding to the custom model of the code analysis tool B; and ⑤ the hash value corresponding to the source code A and the compilation command thereof is inconsistent with the hash value corresponding to the source code B and the compilation command thereof. Among them, ① to ④ indicate that the configuration of the code analysis tool A is changed and the configuration of the code analysis tool B is changed, and ⑤ indicates that the source code A is changed and the source code B is changed, and / or the compilation command of the source code A is changed and the compilation command of the source code B is changed.

[0084] In a specific implementation, the incremental analysis apparatus 210 can compare the summary information A and the summary information B through the following steps, and then determine the change of the summary information A and the summary information B.

[0085] In step i, the incremental analysis apparatus 210 compares the version information of the code analysis tool A and the version information of the code analysis tool B.

[0086] When the version information of the code analysis tool A is consistent with the version information of the code analysis tool B, it indicates that the version information of the code analysis tool is not changed, that is, the code analysis tool A and the code analysis tool B are the same version of the code analysis tool. When the version information of the code analysis tool A is inconsistent with the version information of the code analysis tool B, it indicates that the version information of the code analysis tool is changed, that is, the code analysis tool A and the code analysis tool B are different versions of the code analysis tool.

[0087] In a specific implementation, since the version information of the code analysis tool can be represented by a string, the incremental analysis apparatus 210 can compare the version information of the code analysis tool A and the version information of the code analysis tool B by using the string comparison method. In addition, the incremental analysis apparatus 210 can also complete the comparison of the version information of the code analysis tool A and the version information of the code analysis tool B according to the actual business requirements by using other methods capable of comparing strings, which are not limited herein.

[0088] In step ii, the incremental analysis apparatus 210 compares the hash value corresponding to the built-in rule of the code analysis tool A and the hash value corresponding to the built-in rule of the code analysis tool B.

[0089] When the hash value corresponding to the built-in rule of the code analysis tool A is consistent with the hash value corresponding to the built-in rule of the code analysis tool B, it indicates that the built-in rule of the code analysis tool is not changed, that is, the built-in rule of the code analysis tool A is the same as the built-in rule of the code analysis tool B. When the hash value corresponding to the built-in rule of the code analysis tool A is inconsistent with the hash value corresponding to the built-in rule of the code analysis tool B, it indicates that the built-in rule of the code analysis tool is changed, that is, the built-in rule of the code analysis tool A is different from the built-in rule of the code analysis tool B (for example, compared with the built-in rule of the code analysis tool A, the code analysis tool B adds a built-in rule or deletes a built-in rule).

[0090] In a specific implementation, since the hash value corresponding to the built-in rule can be represented by a string, the incremental analysis device 210 can compare the hash value corresponding to the built-in rule of the code analysis tool A with the hash value corresponding to the built-in rule of the code analysis tool B in a string comparison manner. In addition, the incremental analysis device 210 can also compare the hash value corresponding to the built-in rule of the code analysis tool A with the hash value corresponding to the built-in rule of the code analysis tool B in other manners that can realize string comparison according to actual business requirements, which is not limited herein.

[0091] Step iii, the incremental analysis device 210 compares the hash value corresponding to the custom rule of the code analysis tool A with the hash value corresponding to the custom rule of the code analysis tool B.

[0092] When the hash value corresponding to the custom rule of the code analysis tool A is consistent with the hash value corresponding to the custom rule of the code analysis tool B, it indicates that the custom rule of the code analysis tool is not changed, that is, the custom rule of the code analysis tool A is the same as the custom rule of the code analysis tool B. When the hash value corresponding to the custom rule of the code analysis tool A is inconsistent with the hash value corresponding to the custom rule of the code analysis tool B, it indicates that the custom rule of the code analysis tool is changed, that is, the custom rule of the code analysis tool A is different from the custom rule of the code analysis tool B (for example, compared with the custom rule of the code analysis tool A, the code analysis tool B adds a custom rule, deletes a custom rule, or modifies a custom rule).

[0093] In a specific implementation, since the hash value corresponding to the custom rule can be represented by a string, the incremental analysis device 210 can compare the hash value corresponding to the custom rule of the code analysis tool A with the hash value corresponding to the custom rule of the code analysis tool B by using string comparison. In addition, the incremental analysis device 210 can compare the hash value corresponding to the custom rule of the code analysis tool A with the hash value corresponding to the custom rule of the code analysis tool B by using other methods capable of realizing string comparison according to actual business requirements, which are not limited herein.

[0094] Step iv: The incremental analysis device 210 compares the hash value corresponding to the custom model of the code analysis tool A with the hash value corresponding to the custom model of the code analysis tool B.

[0095] Taking one custom model of the code analysis tool A as an example, the incremental analysis device 210 can compare the hash value corresponding to the custom model with the hash value corresponding to one custom model of the code analysis tool B. When the hash value corresponding to the custom model is consistent with the hash value corresponding to one custom model of the code analysis tool B, it indicates that the code analysis tool A and the code analysis tool B both use the custom model. When the hash value corresponding to the custom model is inconsistent with the hash value corresponding to all custom models of the code analysis tool B, it indicates that the code analysis tool B does not use the custom model, i.e., the custom model is a changed custom model (hereinafter referred to as “changed custom model”). It should be understood that when there are multiple custom models of the code analysis tool A, the incremental analysis device 210 can also determine whether other custom models are changed custom models by using the above method, which is not described herein for simplicity.

[0096] Similarly, taking one custom model of the code analysis tool B as an example, the incremental analysis device 210 can compare the hash value corresponding to the custom model with the hash value corresponding to the custom model of the code analysis tool A. When the hash value corresponding to the custom model is consistent with the hash value corresponding to one custom model of the code analysis tool A, it indicates that the code analysis tool A and the code analysis tool B both use the custom model. Conversely, when the hash value corresponding to the custom model is inconsistent with the hash value corresponding to all custom models of the code analysis tool A, it indicates that the custom model is a custom model newly added or modified by the code analysis tool B, i.e., the custom model is a changed custom model. It should be understood that when there are multiple custom models of the code analysis tool B, the incremental analysis device 210 can also determine whether other custom models are changed custom models by using the above method, which is not described herein for simplicity.

[0097] Step v, the increment analysis device 210 compares the hash value corresponding to the source code A and its compilation command with the hash value corresponding to the source code B and its compilation command.

[0098] Taking one source code file in the source code B as an example, the increment analysis device 210 can compare the hash value corresponding to the source code file and its compilation command (hereinafter referred to as "hash value 1") with the hash value corresponding to the source code file in the source code A and its compilation command. When the hash value 1 is consistent with the hash value corresponding to the source code file in the source code A and its compilation command, it indicates that the source code A and the source code B both contain the source code file, and the compilation command of the source code file has not been changed. When the hash value 1 is inconsistent with the hash value corresponding to all source code files in the source code A and their compilation commands, it indicates that the source code file is a newly added source code file in the source code B, or the source code A and the source code B contain the source code file but the compilation command of the source code file has been changed. It should be understood that for other source code files in the source code B, the increment analysis device 210 can also determine whether the compilation command of these source code files has been changed in the above manner.

[0099] As can be seen from the above descriptions of steps i to v, the changes of the summary information A and the summary information B can reflect whether the configuration of the code analysis tool has been changed (including whether the version information of the code analysis tool has been changed, whether the built-in rules of the code analysis tool have been changed, whether the custom rules of the code analysis tool have been changed, and whether the custom model of the code analysis tool has been changed), whether the source code has been changed, and whether the compilation command of the source code has been changed.

[0100] Step 106, the increment analysis device 210 performs increment analysis on the source code B according to the changes of the summary information A and the summary information B, and obtains the analysis result of the source code B.

[0101] Specifically, when the configuration of the code analysis tool is changed, the increment analysis device 210 calls the code analysis tool B to analyze all contents of the source code B according to the changed configuration. When the source code is changed, the increment analysis device 210 calls the code analysis tool B to analyze the changed source code. When the compilation command of the source code is changed, the increment analysis device 210 calls the code analysis tool B to analyze the source code corresponding to the changed compilation command. Thus, the increment analysis device 210 can complete the increment analysis on the source code B and obtain the analysis result of the source code B.

[0102] More specifically, the increment analysis device 210 can complete the increment analysis on the source code B and obtain the analysis result of the source code B through the following steps:

[0103] Step i, if the custom model of the code analysis tool is changed, the incremental analysis device 210 performs step ii and step iii; if the custom model of the code analysis tool is not changed, the incremental analysis device 210 performs step iii.

[0104] Step ii, the incremental analysis device 210 determines the type of the rule associated with the changed custom model.

[0105] The type of the rule associated with the changed custom model includes built-in rules and / or custom rules. In a specific implementation, when the changed custom model is a deleted custom model, the incremental analysis device 210 can determine the type of the rule associated with the custom model according to the summary information A. When the changed custom model is a newly added custom model or a modified custom model, the incremental analysis device 210 can determine the type of the rule associated with the custom model according to the summary information B.

[0106] Step iii, the incremental analysis device 210 determines whether the first condition is met. If not, step iv and step v are performed; if yes, step v is performed.

[0107] The first condition includes that the version information of the code analysis tool is not changed, and the built-in rules of the code analysis tool are not changed, and the custom models associated with the built-in rules of the code analysis tool are not changed. Wherein, when there is no changed custom model, or the type of the rule associated with the changed custom model does not include built-in rules, it means that the custom models associated with the built-in rules of the code analysis tool are not changed.

[0108] Step iv, the incremental analysis device 210 determines that the content to be analyzed includes analyzing all the contents of the source code B based on the built-in rules of the code analysis tool B.

[0109] It is worth noting that considering that there may be an association relationship between the built-in rules, therefore, in order to improve the accuracy of code analysis, the built-in rules here can be all the built-in rules of the code analysis tool B.

[0110] Step v, the incremental analysis device 210 determines whether the second condition is met. If not, step vi and step vii are performed; if yes, step vii is performed.

[0111] The second condition includes that the custom rules of the code analysis tool are not changed, and the custom models associated with the custom rules of the code analysis tool are not changed. Wherein, when there is no changed custom model, or the type of the rule associated with the changed custom model does not include custom rules, it means that the custom models associated with the custom rules of the code analysis tool are not changed.

[0112] Step vi, the increment analysis device 210 determines that the content to be analyzed includes analysis of all of the source code B based on the custom rules of the code analysis tool B.

[0113] It is worth noting that, considering that there can be a correlation between custom rules, in order to improve the accuracy of code analysis, the built-in rules here can be all custom rules of the code analysis tool B.

[0114] Step vii, the increment analysis device 210 determines whether a third condition is met. If it is met, step viii is performed; if it is not met, step ix is performed. The third condition includes: the first condition is met, and the target source code and its compilation command have not changed, and the target source code can be part or all of the source code B.

[0115] Step viii, the increment analysis device 210 determines that the analysis result of the target source code with respect to the built-in rules is the historical built-in rule analysis result. When the third condition is met, it means that the source code A also contains the target source code, and the historical built-in rule analysis result refers to the analysis result of the target source code with respect to the built-in rules in the analysis result of the source code A.

[0116] Step ix, the increment analysis device 210 determines that the content to be analyzed includes analysis of the target source code based on the built-in rules of the code analysis tool B.

[0117] Step x, the increment analysis device 210 determines whether a fourth condition is met. If it is met, step xi is performed; if it is not met, step xii is performed. The fourth condition includes: the second condition is met, and the target source code and its compilation command have not changed.

[0118] Step xi, the increment analysis device 210 determines that the analysis result of the target source code with respect to the custom rules is the historical custom rule analysis result. When the fourth condition is met, it means that the source code A also contains the target source code, and the historical custom rule analysis result refers to the analysis result of the target source code with respect to the custom rules in the analysis result of the source code A.

[0119] Step xii, the increment analysis device 210 determines that the content to be analyzed includes analysis of the target source code based on the custom rules of the code analysis tool B.

[0120] Step xv, the increment analysis device 210 calls the code analysis tool B to analyze the determined content to be analyzed, and obtains the analysis result of the source code B.

[0121] The analysis result of the source code B includes an incremental analysis result and / or a full analysis result. The incremental analysis result refers to a result obtained after analyzing the determined content to be analyzed. The full analysis result refers to an analysis result of the entire content of the source code B, and specifically can include the incremental analysis result, in addition to which, when the third condition is met, the full analysis result further includes the historical built-in rule analysis result of the target source code, and when the fourth condition is met, the full analysis result further includes the historical custom rule analysis result of the target source code. In a specific implementation, since the storage device 220 pre-stores the analysis result of the source code A, the incremental analysis device 210 can obtain the analysis result of the source code A from the storage device 220, and further obtain the historical built-in rule analysis result of the target source code meeting the third condition and the historical custom rule analysis result of the target source code meeting the fourth condition.

[0122] In step 107, the incremental analysis device 210 sends the analysis result of the source code B to the client 100. Accordingly, the client 100 receives the analysis result of the source code B sent by the incremental analysis device 210.

[0123] In step 108, the incremental analysis device 210 sends the summary information B and the analysis result of the source code B to the storage device 220. Accordingly, the storage device 220 receives and stores the summary information B and the analysis result of the source code B sent by the incremental analysis device 210.

[0124] As can be seen from the method described in steps 101 to 108, for the source code to be analyzed, the incremental analysis device 210 can determine the factors affecting the incremental analysis result according to the source code to be analyzed and its associated historical version of the source code, the compilation command of the source code to be analyzed and the compilation command of the historical version of the source code, and the configuration of the code analysis tool used in the current analysis and the configuration of the code analysis tool used in the historical analysis, and perform incremental analysis on the source code to be analyzed according to the determined influencing factors. The factors affecting the incremental analysis result include one or more of the following changes: changes in the source code to be analyzed and the historical version of the source code, changes in the compilation command of the source code to be analyzed and the compilation command of the historical version of the source code, and changes in the configuration of the code analysis tool used in the current analysis and the configuration of the code analysis tool used in the historical analysis. Since the above incremental analysis considers the factors affecting the analysis result from multiple perspectives (i.e., source code, source code compilation command, and code analysis tool configuration), the obtained analysis result has good accuracy. On the other hand, since the above method does not limit the programming language of the source code to be analyzed, does not limit the code analysis tool, and does not depend on the internal implementation of the code analysis tool, the application difficulty of code incremental analysis can be reduced.

[0125] The incremental analysis method of the code provided by the present application is described in detail above in combination with FIG. 1 to FIG. 4. The structure of the incremental analysis device 210 in the above method is described below in combination with FIG. 5.

[0126] Referring to FIG. 5, FIG. 5 is a structural schematic diagram of an incremental analysis device 210. It should be understood that FIG. 5 only exemplarily shows one division manner of the structure of the incremental analysis device 210, and in actual application, the structure of the incremental analysis device 210 can also have other division manners, which are not limited by the present application.

[0127] As shown in FIG. 5, the incremental analysis device 210 includes an acquisition module 211, a comparison module 212, an analysis module 213 and a sending module 214. The acquisition module 211 is configured to perform the related steps of receiving the incremental analysis request sent by the client 100 in step 101 described above. The comparison module 212 is configured to perform steps 102 to 105 described above. The analysis module 213 is configured to perform step 106 described above. The sending module 214 is configured to perform steps 107 to 108 described above.

[0128] In specific implementation, the acquisition module 211, the comparison module 212, the analysis module 213 and the sending module 214 can be implemented by software or by hardware. Exemplarily, the implementation manner of the acquisition module 211 is described below. Similarly, the implementation manners of the comparison module 212, the analysis module 213 and the sending module 214 can refer to the implementation manner of the acquisition module 211.

[0129] As an example of a software function unit, the acquisition module 211 can include code running on a computing instance. The computing instance can include at least one of a physical host (computing device), a virtual machine and a container. Further, the computing instance can be one or more. For example, the acquisition module 211 can include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers for running the code can be distributed in the same region, or can be distributed in different regions. Further, the multiple hosts / virtual machines / containers for running the code can be distributed in the same availability zone (AZ), or can be distributed in different AZs, each AZ including one data center or multiple data centers with similar geographical locations. Generally, one region can include multiple AZs.

[0130] Likewise, the plurality of hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Among them, usually one VPC is set in one region, and communication between two VPCs in the same region and between VPCs in different regions needs to set a communication gateway in each VPC to realize the interconnection between VPCs through the communication gateway.

[0131] As an example of a hardware functional unit, the acquisition module 211 can include at least one computing device, such as a server, etc. Alternatively, the acquisition module 211 can also be a device implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), etc. Among them, the above-mentioned PLD can be implemented by a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0132] The plurality of computing devices included in the acquisition module 211 can be distributed in the same region or in different regions. The plurality of computing devices included in the acquisition module 211 can be distributed in the same AZ or in different AZs. Likewise, the plurality of computing devices included in the acquisition module 211 can be distributed in the same VPC or in multiple VPCs. Among them, the plurality of computing devices can be any combination of servers, ASICs, PLDs, CPLDs, FPGAs, and GALs, etc.

[0133] It should be noted that in other embodiments, the acquisition module 211 can be used to perform any step in the above-mentioned incremental analysis method of the code, the comparison module 212 can be used to perform any step in the above-mentioned incremental analysis method of the code, the analysis module 213 can be used to perform any step in the above-mentioned incremental analysis method of the code, and the sending module 214 can be used to perform any step in the above-mentioned incremental analysis method of the code. The steps responsible for the acquisition module 211, the comparison module 212, the analysis module 213, and the sending module 214 can be specified as needed, and the functions of the incremental analysis device 210 can be realized by the acquisition module 211, the comparison module 212, the analysis module 213, and the sending module 214 respectively implementing different steps in the above-mentioned incremental analysis method of the code.

[0134] The application also provides a computing device. The computing device can be a server or a terminal device. FIG. 6 exemplarily shows a structural schematic diagram of the computing device provided by the application. As shown in FIG. 6, the computing device 400 includes a bus 401, a processor 402, a memory 403 and a communication interface 404, wherein the processor 402, the memory 403 and the communication interface 404 communicate through the bus 401. It should be understood that the number of the processor 402 and the memory 403 in the computing device 400 is not limited by the application.

[0135] The bus 401 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one line is shown in FIG. 6, but this does not mean that the computing device 400 has only one bus or one type of bus. The bus 401 can include a channel for transmitting information between various components (for example, the processor 402, the memory 403 and the communication interface 404) of the computing device 400.

[0136] The processor 402 can include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP), etc.

[0137] The memory 403 can include a volatile memory such as a random access memory (RAM). The memory 403 can also include a non-volatile memory such as a flash memory, a read-only memory (ROM), a hard disk drive (HDD) or a solid state drive (SSD).

[0138] The memory 403 stores executable code. The processor 402 executes the code stored in the memory 403 to implement the functions of the above-described obtaining module 211, comparison module 212, analysis module 213, and sending module 214 respectively, thereby implementing the above-described code increment analysis method. That is, the memory 403 stores instructions for executing the above-described code increment analysis method.

[0139] The communication interface 404 uses a transceiving module such as but not limited to a network interface card and a transceiver to implement communication between the computing device 400 and other devices or communication networks, for example, the computing device 400 communicates with the client 100 and the code repository 300 through the communication interface 404.

[0140] It should be understood that the computing device 400 provided according to the present application can correspond to the increment analysis apparatus 210 in the present application, and the functions of the various components in the computing device 400 are respectively for implementing the corresponding processes of the various steps in the method shown in FIG. 2, and for the sake of brevity, will not be described here.

[0141] The present application also provides a computing device cluster. The computing device cluster includes at least one computing device, and the computing devices in the computing device cluster can be servers, such as central servers, edge servers, or local servers in local data centers. In some embodiments, the computing devices in the computing device cluster can also be terminal devices such as desktop computers, notebook computers, or smartphones.

[0142] FIG. 7 exemplarily shows a structural schematic diagram of the computing device cluster provided by the present application. As shown in FIG. 7, the computing device cluster 500 includes at least one computing device 400. The memory 403 of one or more computing devices 400 in the computing device cluster 500 can store the same instructions for executing the above-described code increment analysis method.

[0143] In some possible implementations, the memory 403 of one or more computing devices 400 in the computing device cluster 500 can also respectively store partial instructions for executing the above-described code increment analysis method. In other words, the combination of one or more computing devices 400 can collectively execute the instructions of the above-described code increment analysis method.

[0144] It should be noted that the memories 403 in different computing devices 400 in the computing device cluster 500 can store different instructions respectively for executing partial functions of the increment analysis apparatus 210. That is, the instructions stored in the memories 403 in different computing devices 400 can implement the functions of one or more of the obtaining module 211, comparison module 212, analysis module 213, and sending module 214.

[0145] In some possible implementation, one or more of the computing devices 400 in the computing device cluster 500 can be connected through a network, which can be a wide area network or a local area network, etc. FIG. 8 shows one possible implementation. As shown in FIG. 8, the computing device 400A and the computing device 400B are connected through a network. Specifically, the computing device 400A and the computing device 400B are connected to the network through the communication interfaces in the computing device 400A and the computing device 400B. In this implementation, the instructions for implementing the functions of the obtaining module 211, the comparing module 212, the analyzing module 213 and the sending module 214 are stored in the memory 403 in the computing device 400A and the computing device 400B.

[0146] The connection between the computing devices 400 in the computing device cluster 500 shown in FIG. 8 can be a scenario considering high concurrency computing, for example, the computing device 400A receives a large number of source codes to be analyzed at the same time period, in order to complete the incremental analysis of these source codes as soon as possible, the computing device 400A can transfer a part of the tasks to the computing device 400B for execution.

[0147] It should be understood that the functions of the computing device 400A shown in FIG. 8 can also be completed by multiple computing devices 400. Similarly, the functions of the computing device 400B can also be completed by multiple computing devices 400.

[0148] It should also be understood that the computing device cluster 500 provided according to the present application can correspond to the incremental analysis apparatus 210 in the present application, and the functions of each component in the computing device cluster 500 are respectively for implementing the corresponding flow of each step in the method shown in FIG. 2, which will not be described here for brevity.

[0149] The present application also provides a computer program product containing instructions. The computer program product can be a software or program product containing instructions, which can be run on a computing device or stored in any available medium. When the computer program product is run on the computing device, the computing device is caused to perform the incremental analysis method of the code described above.

[0150] The present application also provides a computer readable storage medium. The computer readable storage medium can be any available medium that the computing device can store or a data storage device such as a data center containing one or more available media. The above available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk), etc. The computer readable storage medium includes instructions instructing the computing device to perform the incremental analysis method of the code described above.

[0151] It should be noted that the above examples are only used to illustrate the technical solutions of the present application, and are not intended to limit the same. Although the present application has been described in detail with reference to the foregoing examples, it will be appreciated by those skilled in the art that modifications can be made to the technical solutions described in the foregoing examples, or some of the technical features thereof can be replaced by equivalent features, and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for incremental code analysis, applied to an incremental analysis device, characterized in that, The method includes: Obtain an incremental analysis request, the incremental analysis request being used to instruct incremental analysis to be performed on a second source code of a second version of the software based on a first source code of a first version of the software, the second source code being obtained by updating the first source code; Based on the first source code and the second source code, the compilation commands of the first source code and the second source code, and the configurations of the first and second code analysis tools, factors affecting the incremental analysis results are determined. These factors include one or more of the following changes: changes to the first source code and the second source code, changes to the compilation commands of the first source code and the second source code, and changes to the configurations of the first and second code analysis tools. The first code analysis tool is used to perform incremental analysis on the first source code, and the second code analysis tool is used to perform incremental analysis on the second source code. Incremental analysis is performed on the second source code based on the identified factors.

2. The method according to claim 1, characterized in that, The incremental analysis request includes the compilation command for the second source code and the configuration of the second code analysis tool; The factors that influence the results of the incremental analysis include: The incremental analysis request generates summary information corresponding to the second source code. The summary information corresponding to the second source code is used to describe the second source code, the compilation command of the second source code, and the configuration of the second code analysis tool. By comparing the summary information corresponding to the second source code and the summary information corresponding to the first source code, the factors affecting the incremental analysis results are determined. The summary information corresponding to the first source code is used to describe the first source code, the compilation command of the first source code, and the configuration of the first code analysis tool.

3. The method according to claim 2, characterized in that, The digest information corresponding to the second source code includes a first hash value and a second hash value; The step of generating the digest information corresponding to the second source code based on the incremental analysis request includes: The first hash value is obtained based on the second source code and the compilation command of the second source code; The second hash value is obtained based on the configuration of the second code analysis tool.

4. The method according to claim 3, characterized in that, The method further includes: The summary information corresponding to the second source code is stored in the storage device.

5. The method according to claim 4, characterized in that, The configuration of the second code tool includes at least one of the following: version information of the second code analysis tool, rules used by the second code analysis tool, and models.

6. The method according to any one of claims 1 to 5, characterized in that, The incremental analysis of the second source code based on the determined factors includes: Based on the changes to the first source code and the second source code, the modified source code is analyzed; Based on the changes in the compilation commands of the first source code and the second source code, the source code corresponding to the changed compilation commands is analyzed; Based on changes to the configuration of the first code analysis tool and the configuration of the second code analysis tool, the entire contents of the second source code are analyzed.

7. An incremental analysis device, characterized in that, include: An acquisition module is used to acquire an incremental analysis request, the incremental analysis request being used to instruct incremental analysis to be performed on a second source code of a second version of the software based on a first source code of a first version of the software, the second source code being obtained by updating the first source code; The comparison module is used to determine factors affecting the incremental analysis results based on the first source code and the second source code, the compilation commands of the first source code and the second source code, and the configurations of the first code analysis tool and the second code analysis tool. The factors affecting the incremental analysis results include one or more of the following changes: changes to the first source code and the second source code, changes to the compilation commands of the first source code and the second source code, and changes to the configurations of the first code analysis tool and the second code analysis tool. The first code analysis tool is used to perform incremental analysis on the first source code, and the second code analysis tool is used to perform incremental analysis on the second source code. An analysis module is used to perform incremental analysis on the second source code based on the determined factors.

8. The apparatus according to claim 7, characterized in that, The incremental analysis request includes the compilation command for the second source code and the configuration of the second code analysis tool; The comparison module is used to generate summary information corresponding to the second source code according to the incremental analysis request. The summary information corresponding to the second source code is used to describe the second source code, the compilation command of the second source code, and the configuration of the second code analysis tool. By comparing the summary information corresponding to the second source code and the summary information corresponding to the first source code, the factors affecting the incremental analysis results are determined. The summary information corresponding to the first source code is used to describe the first source code, the compilation command of the first source code, and the configuration of the first code analysis tool.

9. The apparatus according to claim 8, characterized in that, The digest information corresponding to the second source code includes a first hash value and a second hash value; The comparison module is used to obtain the first hash value based on the second source code and the compilation command of the second source code; The second hash value is obtained based on the configuration of the second code analysis tool.

10. The apparatus according to claim 9, characterized in that, The comparison module is also used to store the summary information corresponding to the second source code to a storage device.

11. The apparatus according to claim 10, characterized in that, The configuration of the second code tool includes at least one of the following: version information of the second code analysis tool, rules used by the second code analysis tool, and models.

12. The apparatus according to any one of claims 7 to 11, characterized in that, The analysis module is used to analyze the modified source code based on the changes in the first source code and the second source code; and to analyze the source code corresponding to the modified compilation commands based on the changes in the compilation commands of the first source code and the second source code. Based on changes to the configuration of the first code analysis tool and the configuration of the second code analysis tool, the entire contents of the second source code are analyzed.

13. A computing device, characterized in that, It includes a processor and a memory, the processor being configured to execute instructions stored in the memory to cause the computing device to perform the method as described in any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a computing device, cause the computing device to perform the method as described in any one of claims 1 to 6.

Images