SOAP - Keynote: Beyond Code: New Signals for Static Analysis
summary
Google builds Tricorder, a microservice static-analysis platform that runs on code review and scales to analyze more than 50,000 reviews daily, with 200+ analyzers covering 30+ languages and about 3,000 automated fixes applied each workday. It emphasizes developer happiness: integration into review, one-click fixes, and a measured notion of effective false positives. Results include RPC-connected checks (e.g., translation, protobuf, Finch experiment validations) and UX feedback via please fix / not useful buttons that rapidly iterate analyzer messages or disable noisy checks.
AI-written summary · about
chapters (12)
- 0:00Start
- 3:37Static Analysis: my confession
- 11:37Nightly runs
- 12:40Code review integration
- 16:53Make static analysis a part of the core developer word
- 20:01Tricorder: (mostly) static analysis in code review
- 26:32Per-project customization
- 36:33Antipatterns: Error Prone
- 37:43Antipatterns, not just for code
- 41:57Analyzers can make RPCs
- 43:48Code outputs
- 47:50Finch Analyzer
related talks
44mUsing Static Analysis Tools to Become A Superhero Programmer
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
40mEnterprise-scale static analysis: A Pinpoint experience
54mA Shock to the System Static Analysis for Real AppSec
42mSWAMP & Partners Panel Discussion
34mKeep your code safe during the development path using OS tools
33mBattle Tested Application Security
22mCode Security in the AI Era | SAST, SCA & Secrets Detection