Dive into the core concept of "Shift Left" within the DevOps landscape. While this guide zeroes in on Java, Python, and Go configurations, the insights shared are valuable for developers across the board. Ready to explore? Let's jump in! 🚀
Pro Tip! 🌟
Before we dive deeper, here's a suggestion: Think about setting up a global pre-commit hook. This way, a bash script will run for every upcoming commit, ensuring your code undergoes all the essential checks and tests before it's locked in.
#!/bin/bash
mkdir -p ~/.git-hooks && git config --global core.hooksPath ~/.git-hooks
cat > ~/.git-hooks/pre-commit << 'EOF'
if [ -f "build.gradle" ]; then
echo "Running pre-commit checks for Java project..."
elif [ -f "setup.py" ] || [ -f "pyproject.toml" ]; then
echo "Running pre-commit checks for Python project..."
elif [ -f "go.mod" ]; then
echo "Running pre-commit checks for GoLang project..."
else
echo "Unknown project type. Skipping pre-commit checks."
fi
if [ $? -ne 0 ]; then
echo "\nTests failed! Commit aborted.\n"
exit 1
fi
exit 0
EOF
chmod +x ~/.git-hooks/pre-commit
echo "Global git hooks setup complete!"
1. Local Build! 🛠️
Before pushing your code, always ensure it builds locally. Have you considered using a build tool? I'd recommend Bazel, a fast and reliable build tool.
#!/bin/sh
if [ -f "build.gradle" ]; then
./gradlew build
elif [ -f "setup.py" ] || [ -f "pyproject.toml" ]; then
python setup.py build
elif [ -f "go.mod" ]; then
go build ./...
elif [ -f "WORKSPACE" ] || [ -f "WORKSPACE.bazel" ]; then
echo "Building Bazel project..."
bazel build //...
else
echo "Unknown project type. Skipping."
fi
2. Static Code Analysis 🔍
There are many ways and different schools of thought on the specifics of code checks for a pre-commit. However, all will agree that static code analysis is a great way to catch those vulnerabilities and coding errors early on.
Java: Use SonarLint with Gradle.
Python: Utilize Flake8 for linting and Black for code formatting.
GoLang: Use golint for linting.
#!/bin/bash
if [ -f "build.gradle" ]; then
./gradlew sonarqube
elif [ -f "setup.py" ] || [ -f "pyproject.toml" ]; then
flake8 . && black --check .
elif [ -f "go.mod" ]; then
golint ./...
else
echo "Unknown project type. Skipping."
fi
3. Unit Tests 🧪
Testing is the backbone of reliable software. Ensure you have unit tests in place:
4. Vulnerable Dependencies Check 🔐
More often than not, vulnerabilities creep into your codebase due to third-party code injected as dependencies. It's crucial to ensure that these dependencies are not only up-to-date but also secure.
#!/bin/bash
if [ -f "build.gralde" ]; then
./gradlew dependencyCheckAnalyze
elif [ -f "setup.py" ] || [ -f "pyproject.toml" ]; then
safety check
elif [ -f "go.mod" ]; then
gosec ./...
else
echo "Unknown project type. Skipping."
fi
🚨 Disclaimer: Remember, every team and project is unique. It's essential to tailor your pre-commit hooks and other practices to best fit your team's needs and the nature of your project. Always strive for a balance between thorough checks and developer productivity.
I hope this guide helps you in your DevOps journey. Feel free to share, comment, and let me know if you have any questions or suggestions! 🙌
🌐 alkhatib.tech
