Module 2 – Static Analysis & Code Quality

Topics

C/C++

• Cppcheck: memory leaks, buffer overruns and null pointer dereferences
• Clang-tidy: bugprone, performance, readability and modernize checks
• Clang Static Analyzer and symbolic execution
• MISRA C/C++ rule categories and deviation records

Python

• Pylint: convention, refactor, warning and error messages
• Mypy: static typing, type hints, strict mode, third-party stubs
• Docstring and import-sorting tooling (pydocstyle, isort)

Rust

• The borrow checker as a static analysis mechanism
• Clippy: correctness, style, complexity and performance lints
• Unsafe Rust auditing

Strategy, Security & Tooling Integration

• SARIF as a unified findings interchange format
• Bandit (Python security), Semgrep (multi-language rules), cargo-audit (Rust dependency scanning)
• Static analysis maturity model, quality gates and severity thresholds
• Static analysis in code review workflows

Lab 1: C/C++ Static Analysis Sweep

Learning Objectives: cppcheck, clang-tidy, Clang Static Analyzer, MISRA C/C++

Description: Run and triage findings from three C/C++ static analysis tools against a small sample codebase.

Tasks

• Run cppcheck against sample code and classify memory-leak and buffer-overrun findings.
• Run clang-tidy and apply at least one auto-fix.
• Run the Clang Static Analyzer and interpret a symbolic-execution finding.
• Map two MISRA C/C++ rule violations to specific tool findings.
• Suppress one confirmed false positive using inline suppression syntax.
• Record findings in a triage log with severity classification.

Extension Tasks

• Wire cppcheck into a CMake build target.
• Draft a MISRA deviation record for a justified exception.

Topics Covered

Cppcheck, clang-tidy, Clang Static Analyzer, MISRA C/C++

Open Source Recommendation

Cppcheck, clang-tidy and the Clang Static Analyzer: all part of the open-source LLVM/Clang toolchain.

Lab 2: Python Type & Quality Enforcement

Learning Objectives: pylint, mypy, type hints, static typing

Description: Apply pylint and mypy to a sample Python module and resolve the findings.

Tasks

• Run pylint against sample code and resolve convention and warning findings.
• Add PEP 484 type hints to at least three functions.
• Run mypy and resolve reported type errors, including one Optional-handling case.
• Configure a .pylintrc to disable one project-specific check.
• Run mypy in strict mode and note the additional findings raised.
• Combine pylint and mypy in a single local workflow.

Extension Tasks

• Add a third-party stub (.pyi) for an untyped dependency.
• Apply an incremental typing strategy to one legacy-style function.

Topics Covered

Pylint, mypy, Type Hints, Static Typing

Open Source Recommendation

Pylint and mypy: the two standard open-source Python static analysis tools.

Lab 3: Rust Compiler & clippy Audit

Learning Objectives: Borrow checker, clippy, unsafe Rust

Description: Resolve borrow-checker errors and clippy lint findings in a sample Rust crate.

Tasks

• Trigger and resolve a moved-value borrow-checker error.
• Trigger and resolve a mutable/immutable borrow conflict.
• Run clippy and resolve one correctness and one performance lint.
• Apply cargo fix to auto-apply a suggested clippy correction.
• Review one unsafe block using a manual audit checklist.
• Configure clippy.toml to enable one pedantic lint group.

Extension Tasks

• Compare clippy’s pedantic and nursery lint groups on the sample crate.
• Document what the compiler and clippy each catch on the same function.

Topics Covered

Borrow Checker, clippy, Unsafe Rust

Open Source Recommendation

Clippy, the official open-source Rust linter, alongside the standard rustc compiler.

Lab 4: Unified Static Analysis Strategy & SAST

Learning Objectives: SARIF, bandit, Semgrep, cargo-audit, quality gates

Description: Consolidate findings from Labs 1–3 into a unified SARIF-based report and define a quality gate policy.

Tasks

• Align findings from at least two languages into a SARIF-style summary.
• Run bandit against a sample Python module and classify one security finding.
• Write one custom Semgrep rule and run it across the multi-language sample.
• Run cargo-audit against the sample Rust crate and resolve one advisory.
• Define a severity threshold for a blocking quality gate.
• Draft a short executive summary of the consolidated findings.

Extension Tasks

• Propose a static analysis rollout timeline for a hypothetical team.
• Add a warning-only gate for advisory-level findings.

Topics Covered

SARIF, bandit, Semgrep, cargo-audit, Quality Gates

Open Source Recommendation

Bandit, Semgrep and cargo-audit: all open-source and free to run in CI without a commercial licence.

Module 2 Coverage Matrix

Module Project: Multi-Language Static Analysis Pipeline

Multi-language static analysis pipeline: run cppcheck/clang-tidy, pylint/mypy and clippy across a shared polyglot sample project, consolidate findings into a unified SARIF report, and define a quality-gate policy with severity thresholds.

The project combines the individual C/C++, Python and Rust workflows developed during the module into a single cross-language verification activity.

Participants move beyond simply running static-analysis tools and practise organising findings into evidence that can support technical review and a repeatable software quality process.

Why Static Analysis Matters Within the Programme

Dynamic testing is essential, but many software problems can be identified before executing the software.

Module 2 therefore establishes an important layer in the programme’s verification workflow:

Source code → static analysis → findings triage → quality decisions → dynamic testing

Participants learn not only how individual tools identify potential problems but also how those findings can be classified, consolidated and incorporated into engineering workflows.

This foundation leads directly into Module 3: Unit & Component Testing, where participants move from static analysis into executable tests across C/C++, Python and Rust.

How Module 2 Connects With Other Modules

Module 2 builds directly on the testing strategy and risk concepts introduced in Module 1: Foundations of Testing, V&V & Test Design.

Its static-analysis outputs also become relevant later when participants work with:

• Unit and component testing
• Structural code coverage
• Embedded software verification
• Automotive safety-critical testing
• CI/CD quality gates
• The final cross-industry verification capstone

This connection is important because the programme treats static analysis as one component of a broader verification strategy rather than as an isolated tooling exercise.

Frequently Asked Questions

What languages are covered in the Static Analysis & Code Quality module?

The module covers static analysis across C/C++, Python and Rust.

Which C/C++ static analysis tools are used?

The module works with cppcheck, clang-tidy and the Clang Static Analyzer, alongside MISRA C/C++ rule concepts and deviation records.

Which Python static analysis tools are covered?

Participants use pylint and mypy, including type hints, strict-mode checking and third-party stubs. The module also introduces pydocstyle and isort.

How is Rust static analysis covered?

The Rust section uses the compiler’s borrow checker and clippy, together with review of unsafe Rust.

Does the module include security-focused static analysis?

Yes. The programme includes bandit for Python security analysis, Semgrep for multi-language rules and cargo-audit for Rust dependency scanning.

What is SARIF used for in this module?

SARIF is introduced as a unified findings interchange format. Participants consolidate findings from multiple languages into a SARIF-style report as part of the final lab and module project.

Are quality gates covered?

Yes. Participants define severity thresholds and a quality-gate policy, including the distinction between blocking findings and warning-only findings.

Is the module practical?

Yes. The eight-hour module contains four labs covering C/C++, Python, Rust and unified static-analysis/SAST strategy.

What is the Module 2 project?

The Module 2 project is a multi-language static-analysis pipeline combining cppcheck/clang-tidy, pylint/mypy and clippy across a shared polyglot sample project. Findings are consolidated into a unified SARIF report and used to define a severity-based quality-gate policy.