Session 2.6 – Code Verification Techniques

Module 2: Verification & Validation | Duration: 1 hour

Learning Objectives
  • Evaluate code walkthroughs and peer reviews using structured checklists.
  • Configure static-analysis pipelines and interpret findings.
  • Set up CI/CD quality gates and metrics dashboards to guard against regressions.

Code Walkthroughs & Peer Reviews

Walkthroughs and peer reviews provide human insight into code correctness, maintainability, and readability.

Preparation
  • Ensure code compiles/tests locally.
  • Attach design notes, screenshots, or logs.
  • Share checklist (security, performance, style) ahead of time.
Review Meeting
  • Author narrates intent & edge cases.
  • Reviewers walk through logic branch-by-branch; use sample inputs.
  • Recorder logs findings, severity, owners.
Follow-up
  • Fixes tracked via pull request or defect IDs.
  • Verify before merge; update metrics (defects per LOC/hour).

Static Analysis & Automation

Static tools catch issues without executing the program.

  • Linters & Formatters: ESLint, Prettier, clang-tidy for style and best practices.
  • Type & null checking: TypeScript compiler, mypy, Kotlin/Swift static checks.
  • Security scanners: Bandit, Snyk, Trivy for secrets, dependency vulnerabilities.
  • Complexity & duplication: SonarQube metrics (cyclomatic complexity, code smells).
Automation tips
  • Fail build on new high-severity issues, allow waivers with expiry dates.
  • Export reports (JSON/HTML) and attach to pull requests.

CI/CD Gates & Dashboards

CI ensures code verification happens continuously.

  • Mandatory checks before merge (unit tests, lint, static security analysis).
  • Quality gate thresholds (e.g., no new blocker issues, coverage ≥ 80%).
  • Dashboards (GitHub Actions, Jenkins, GitLab) to monitor flake rate and build health.
Flake monitoring
Track flaky tests separately. When a job fails, log whether failure is flaky; use data to prioritize stabilization.

Scenario & Metrics

Scenario: A payment gateway module went through peer review + static analysis.

Walkthrough Findings
Uncaught exception on network retry; added exponential backoff logic.
Static Analysis
SonarQube flagged high cognitive complexity in buildChargeRequest(); refactored into helper functions.
Metrics Snapshot
DRE (verification) = 15 / (15 + 2 escaped) = 88%; review density = 3 defects / 120 LOC ≈ 0.025 defects/LOC.

Summary & Assignment

Code verification is a blend of human expertise and automation. Walkthroughs uncover intent gaps, static analysis enforces broad rules, and CI gates keep quality consistent.

Assignment: Choose a pull request or module, run a peer review using a checklist, execute static analysis (SonarQube/linters), and capture metrics (defects found, severity, complexity changes). Present findings to your team.
Course Home