Code review with machine learning Amazon Code Guru now supports Python so I tried it
Introduction
This article is the 22nd day article of Hands Lab Advent Calendar 2020.
Hello, it's @ sr-mtmt. It's the end of the year. Among the items I bought in 2020, my favorite was Pasta in the excellent range. Those who like to see the washing machine spinning around will also like to stare at Volcano in the stove with this product.
By the way, this year's Advent Calendar, let's do it
I want to try something that interests me with re: Invent's Keynote
At re: Invent, Andy Jassy's Keynote said "Python is supported by Amazon Code Guru, which reviews code with machine learning", so I would like to try it.
I've been worried about it for a long time, but until now it only supported Java, so we couldn't try it with our team that doesn't use Java. It seems that it is difficult to analyze Python compared to Java, but what is it like?
What is Amazon Code Guru?
Code Guru has a Reviewer and a Profiler. The Profiler checks the cost, and the Reviewer checks for bugs.
This time I will try Reviewer.
Amazon CodeGuru Reviewer is a service that uses machine learning to detect problems in your code and suggest recommended fixes. It seems that code quality issues are identified in nine broad categories:
--AWS Best Practices: Fixed usage of AWS APIs (polling, pagination, etc.) --Concurrent execution: Detects poor synchronization that is causing a functional failure, or excessive synchronization that is degrading performance. --Deadlock: Check allocation between concurrently running threads --Resource leak: Fixed resource handling method (such as releasing database connection) --Confidential Information Leakage: Detects leaks of personally identifiable information (such as logged-in credit card details) --General code bugs: Detect hard-to-find issues such as not creating a client when reading a Lambda function --Clone code: Identify duplicate code that may improve code maintainability by consolidating --Input validation: Check for improperly shaped or malicious data from untrusted sources
I tried it
0. Premise
--I have an AWS account --I have a repository on Github that contains the source code I want to review, but I don't have it on CodeCommit --Select a repository that has no problem by default for settings such as IAM
1. Repository association
Select Reviewer.
It turns out that you can completely forget the information from the previous release and associate it even if it is not from CodeCommit. \ I'm happy /
You can choose from GitHub, GitHub Enterprise, Bitbucket, and AWS CodeCommit.
Please note that access to the repository associated with the organization is not permitted unless you press the arrow "Grant".
This time it's a trial, so I'm doing it with my personal account, but it's nice that if you prepare this area carefully, you can set the authority in detail.
Now that you've connected to your Github account, the candidate repositories will pop up in the "Repository Location" that was grayed out earlier. Select the appropriate repository and associate it.
2. Try to analyze
There are two types of analysis methods.
| Code review type | Will it be reviewed automatically | Where can I see the review results? | Review target |
|---|---|---|---|
| Repository analysis | No You must perform the analysis using the CodeGuru Reviewer management console, or the AWS CLI or AWS SDK |
Check using the CodeGuru Reviewer management console, or the AWS CLI or AWS SDK | All code in the branch |
| Pull request | Yes After associating the repository, a code review will be done automatically every time you make a pull request. |
In addition to checking using the CodeGuru Reviewer management console, AWS CLI or AWS SDK, you can also check from the PR comment of the repository source provider (Github, etc.) | Scope of pull request. Only the code changed this time |
If there is a pull request, it will be added here.
I don't have the right PR right now, so I'll try to analyze the whole code in "Analysis of repository".
Press "Create Repository Analysis".
The "Code and Security Recommendations" is a different story from the repository we just associated.
I will upload the zipped code to S3 separately, associate it with it, and analyze it, so this time I would like to try "Code Recommendations".
Analyzing ...
It's a small repository, so it only takes a few minutes!
Well, what's coming up ...?
Nothing: joy :: joy:: joy:
No, that's good.
I'm lonely so I tried a larger repository, but I still couldn't find anything ...
I wonder how much performance is degraded ...
By the way, if CodeGuru points out something to the pull request, it seems that you can send feedback as to whether the recommendation was useful as it is in the pull request comment like this.
(Borrow the image of the official document)
The recommendations pointed out here are
"This code might not produce accurate results if the operation returns paginated results instead of all results. Consider adding another call to check for additional results."
→ This code may not give accurate results if the operation returns paginated results instead of all results. Consider adding another call to check the additional results. (deepl translation)
It has become. Is it an indication about how to use the AWS API?
Bonus) Disassociate the repository
If you leave the repository linked, it will cost you money when you exceed the free limit, so let's cancel it if necessary.
Once released, it cannot be restored, so it is necessary to associate it with a new one.
The released repository disappears from the initial display screen, but it does not disappear completely as shown in "Repository (3)" on the upper left. You can check it from the disassociated repository. (why)
Rate plan
You can try it for free for 90 days in an AWS Region that supports Amazon CodeGuru. The following is for the Tokyo region.
About free tier
Analysis of the entire repository is free up to 30,000 lines of code analysis for each payer account each month. A 90-day free trial is available for pull request analysis.
Analysis of the entire repository
$ 0.50 for every 100 lines of code up to 1,500,000 lines of code analysis each month for free tiers and above. Analyzing more than 1,500,000 lines of code $ 0.40 for every 100 lines of code. You can analyze the source code for the entire repository or for selected code branches. Every line of code in the selected repository or source code branch is analyzed with each repository analysis run.
Pull request
$ 0.75 for every 100 lines of code after a 90-day free trial.
Afterword
It was easier to set up than I expected. I was wondering if it would get stuck in something, but it was too easy. It's especially nice to be associated with something other than CodeCommit. It was a pity that there was no indication in the code, but I was a little relieved that there was no big problem.
Tomorrow is the 23rd day! @fasahina!
FYI -[[Breaking news] Code Guru supports Python for code review by machine learning and added Security Detector function #reinvent](https://dev.classmethod.jp/articles/codeguru-support-python-and- security-detector /)
Recommended Posts