Automating Static Code Analysis Through CI/CD Pipeline Integration

2026-08-31

AI Summary

本文针对软件开发过程中早期识别和修复安全漏洞的问题，提出了一种将静态应用安全测试工具输出集成到CI/CD流水线及问题跟踪软件中的自动化方法。

Abstract

In the contemporary landscape of software devel-opment, securing sensitive data is paramount to safeguarding organizational reputation, preventing financial losses, and pro-tecting individuals from identity theft. This paper addresses the pervasive challenge of identifying and rectifying security vulnerabilities early in the development process, emphasizing the role of Static Application Security Testing (SAST) tools. While SAST tools play a crucial role in detecting vulnerabilities, widespread adoption has been hindered by usability issues, including high false positive rates and a lack of native pipeline support. This paper proposes a novel, generalized, and automated process for aggregating SAST tool outputs and integrating them into developers' familiar issue-tracking software. The process streamlines the identification and communication of security vulnerabilities during the development lifecycle, facilitating more efficient remediation efforts. We demonstrate the successful implementation of the proposed process with the SonarQube SAST tool in a GitLab-based development environment. Developers were positive about the structured implementation, real-time feedback, and proactive vulnerability management. However, despite some challenges such as a potential learning curve and tradeoffs between secure coding and workflow disruption, the overall positive impact on security awareness and responsiveness suggests that the proposed process holds promise in enhancing the security posture of software development practices

Problem

• Static Code Analysis
• CI/CD Pipeline
• Security Vulnerabilities
• SAST Tools

Innovation

• Static Application Security Testing
• CI/CD Pipeline Integration
• Automated Process
• Vulnerability Management
• Real-time Feedback