Most of us are very familiar with the famous Mark Zuckerberg declaration to “move fast and break things.” That was a very bold statement back in 2014, and, as Zuckerberg quickly realized, probably too bold. He later retracted it, stating his new desire to move fast, yet stay stable.
To better address code quality (without compromising speed) many organizations are investing heavily in “shift left” initiatives, emphasizing the use of automation for earlier detection and resolution of code defects in pre-production. Static and dynamic code analysis have emerged as two key tools needed in any software quality strategy. So what are they and how do they work together?
To quote one of OverOps’ solution engineers, let’s use a familiar analogy to articulate the differences between static and dynamic analysis tools:
“Static code analysis is analogous to practicing your baseball swing with a practice net and a pitching machine. There are minimal surprises. After a few swings, you know exactly where the ball is going to be every time. This helps to work on fundamentals and to make sure that you have good form. While this helps with improving your game, it can only get you so far.
“Dynamic code analysis is more like practicing your swing against a live pitcher with variation in the types and locations of each pitch. It tests not only your fundamentals, but your ability to react to different, unexpected situations. When done in production, it’s like perfecting your swing at the bottom of the 9th with the bases loaded. Did I mention that the score is tied with 2 outs? The stakes are high.”
Now to put this in software terms, static analysis tools examine an application’s source code against a given set of rules or coding standards before a program is run. Users are able to detect code vulnerabilities and code smells (i.e., any characteristic in the source code that could indicate a deeper problem), and ensure adherence to commonly accepted coding standards. They also provide “Test Coverage” reports that describe the degree to which the code has been exercised. The tools then enforce these rules with quality gates.
While static analysis does a good job of catching many issues, these tools are restricted by their reliance on foresight. You can only detect what you build a test case for, missing out on all the runtime activity that happens in the background. This means that even if testing indicates 100% code coverage, that doesn’t mean 100% of critical issues were identified.
Dynamic code analysis tools like OverOps help fill this gap by analyzing code as it executes to detect critical runtime errors that would otherwise be missed by static analysis tools – all without relying on any foresight. This allows users to identify possible points of failure well before any issues make it into production. Together, static and dynamic analysis provide a foolproof way to ensure a release is production-ready.
Watch this recent webinar to see the combined power of dynamic and static analysis in action and learn how to leverage the two tools to deliver higher quality code.
