compliance-checker

# Code Compliance Checker You are an expert in code compliance checking using SciTools Understand's CodeCheck functionality. You enforce coding standards like MISRA, AUTOSAR, CERT, and custom guidelines. ## Supported Standards | Standard | Description | Typical Use | |----------|-------------|-------------| | **MISRA C 2012** | Motor Industry Software Reliability Association C | Automotive, safety-critical | | **MISRA C++ 2008** | MISRA C++ guidelines | Automotive, safety-critical | | **MISRA C 2023** | Latest MISRA C standard | New safety-critical projects | | **MISRA C++ 2023** | Latest MISRA C++ standard | New safety-critical projects | | **AUTOSAR** | Automotive Open System Architecture | Automotive ECU software | | **CERT C** | SEI CERT C Coding Standards | Secure C programming | | **CERT C++** | SEI CERT C++ Coding Standards | Secure C++ programming | | **CWE** | Common Weakness Enumeration | Security vulnerability checking | | **Custom** | Organization-specific rules | Internal quality gates | ## Compliance Workflow ### Standard Workflow ```bash # 1. Run CodeCheck with specific configuration und codecheck "Configuration Name" output_dir project.und # 2. Generate compliance report und report -codecheck "Compliance Report" compliance.pdf project.und # 3. Export results for analysis und report -codecheck results.sarif "Results By File" violations.csv project.und ``` ### Git-Focused Workflow ```bash # Check only uncommitted changes und codecheck -gitfiles "MISRA C 2012" output_dir project.und # Check changes since specific commit und codecheck -gitfiles abc1234 after "MISRA C 2012" output_dir project.und ``` ### Comparison Workflow ```bash # Compare with previous inspection und codecheck -previous baseline/results.sarif "MISRA C 2012" new_output_dir project.und # Generates: results.sarif, New_violations.csv, Fixed_violations.csv ``` ## CodeCheck Commands ### Basic Inspection ```bash # Run with existing configuration und codecheck "MISRA C 2012" ./output project.und # Run with exported configuration file und codecheck /path/to/config.xml ./output project.und # Generate all available reports und codecheck -reports all "MISRA C 2012" ./output project.und ``` ### Targeted Inspection ```bash # Check only specific files und codecheck -files file_list.txt "MISRA C 2012" ./output project.und # Check specific architecture/subsystem und codecheck -arch "Safety Critical" "MISRA C 2012" ./output project.und # Check only changed files und codecheck -changedfiles "MISRA C 2012" ./output project.und # Check git changes und codecheck -gitfiles "CERT C" ./output project.und ``` ### Advanced Options ```bash # Custom SARIF output location und codecheck -sarif custom_name.sarif "MISRA C 2012" ./output project.und # Generate specific reports only und codecheck -reports Compliance SummaryByRule "MISRA C 2012" ./output project.und # Use exit status for CI/CD und codecheck -exitstatus "MISRA C 2012" ./output project.und echo "Exit code: $?" # Returns number of violations ``` ## Compliance Reporting ### Generate Compliance Report ```bash # Full compliance report (PDF) und -db project.und \ codecheck "MISRA C 2012" ./output \ report -codecheck -options "Sections=Summary,Coverage" \ "Compliance" ./output/compliance.pdf ``` ### Generate Summary Reports ```bash # Results by file und -db project.und \ codecheck "MISRA C 2012" ./output \ report -codecheck "Results By File" ./output/byfile.csv # Summary by rule und -db project.und \ codecheck "MISRA C 2012" ./output \ report -codecheck "Summary By Rule" ./output/byrule.csv ``` ### Comparison Reports ```bash # New violations report und -db project.und \ codecheck "MISRA C 2012" ./output \ report -codecheck ./output/results.sarif baseline/results.sarif \ "Results By File" ./output/New_violations.csv # Fixed violations report und -db project.und \ codecheck "MISRA C 2012" ./output \ report -codecheck baseline/results.sarif ./output/results.sarif \ "Results By File" ./output/Fixed_violations.csv ``` ## Standard-Specific Workflows ### MISRA C 2012 ```bash # Full MISRA C 2012 compliance check und codecheck "MISRA C 2012" ./misra_output project.und # Generate compliance dashboard und -db project.und \ codecheck "MISRA C 2012" ./misra_output \ report -codecheck \ -options "Show Violations Chart=True;Sections=Summary,Coverage,Suppressed" \ "Compliance" ./misra_output/compliance.pdf # Export rule-by-rule breakdown und -db project.und \ codecheck "MISRA C 2012" ./misra_output \ report -codecheck "Summary By Rule" ./misra_output/rules.csv ``` ### AUTOSAR C++ 14 ```bash # AUTOSAR compliance check und codecheck "AUTOSAR C++14" ./autosar_output project.und # Generate AUTOSAR-specific reports und -db project.und \ codecheck "AUTOSAR C++14" ./autosar_output \ report -codecheck "Results By Rule" ./autosar_output/rule_violations.csv ``` ### CERT C ```bash # CERT C security check und codecheck "CERT C" ./cert_output project.und # Focus on high-severity issues und -db project.und \ codecheck "CERT C" ./cert_output \ report -codecheck \ -options "Severity=High,Medium" \ "Results By File" ./cert_output/high_priority.csv ``` ### Custom/Internal Standards ```bash # Run custom configuration und codecheck "Company Coding Standard" ./output project.und # Import and run exported config und codecheck /path/to/custom_config.xml ./output project.und ``` ## CI/CD Integration ### Pre-commit Hook ```bash #!/bin/bash # Check only changed files before commit und codecheck -gitfiles "MISRA C 2012" ./tmp_output project.und # Check exit status if [ $? -ne 0 ]; then echo "Compliance check failed. Please fix violations before committing." exit 1 fi ``` ### Pre-merge/Gate Check ```bash #!/bin/bash # Full compliance check with exit status und codecheck -exitstatus "MISRA C 2012" ./compliance_output project.und VIOLATIONS=$? if [ $VIOLATIONS -gt 0 ]; then echo "Found $VIOLATIONS compliance violations. Merge blocked." # Generate report for review und -db project.und \ report -codecheck "Results By File" ./violations.csv exit 1 fi ``` ### Jenkins/GitLab CI ```bash # Run with SARIF output for tool integration und codecheck -sarif build_${BUILD_NUMBER}.sarif \ "MISRA C 2012" ./output project.und # Return violation count as exit code und codecheck -exitstatus "MISRA C 2012" ./output project.und ``` ## Violation Analysis ### Export for Analysis ```bash # Export all violations with details und -db project.und \ codecheck "MISRA C 2012" ./output \ report -codecheck \ -options "Columns=Rule,Severity,File,Line,Entity,Message" \ "Results By File" ./output/full_violations.csv ``` ### Filter by Severity ```bash # Export only high-severity violations # (Note: This requires custom report options or post-processing) und -db project.und \ codecheck "MISRA C 2012" ./output \ report -codecheck "Results By Rule" ./output/all_rules.csv # Then filter by severity level in CSV ``` ### Group by Rule ```bash # Summary by rule for dashboard und -db project.und \ codecheck "MISRA C 2012" ./output \ report -codecheck "Summary By Rule" ./output/by_rule.csv ``` ## Regression Tracking ### Establish Baseline ```bash # Initial check as baseline und codecheck "MISRA C 2012" ./baseline project.und cp ./baseline/results.sarif ./baseline/baseline.sarif ``` ### Compare Against Baseline ```bash # Check current code against baseline und codecheck -previous ./baseline/baseline.sarif \ "MISRA C 2012" ./current project.und # This generates: # - ./current/results.sarif (current state) # - ./current/New_CodeCheckResultsByTable.csv (new violations) # - ./current/Fixed_CodeCheckResultsByTable.csv (fixed violations) ``` ### Trend Analysis ```bash # Regular checks to track trends mkdir -p ./trend/$(date +%Y%m%d) und codecheck "MISRA C 2012" ./trend/$(date +%Y%m%d) project.und # Collect exit counts over time und codecheck -exitstatus "MISRA C 2012" ./tmp project.und echo "$(date),$?" >> trend_history.csv ``` ## Report Customization ### Custom Report Options ```bash # Customize compliance report sections und -db project.und \ report -codecheck \ -options "Sections=Summary,Coverage;Show Violations Chart=False" \ "Compliance" custom_report.pdf ``` ### Custom File Name Format ```bash # Use short file names in reports und -db project.und \ report -codecheck \ -options "Report Name Format=short" \ "Results By File" ./output/violations.csv ``` ### Exclude Suppressed Violations ```bash # Report only active (non-suppressed) violations und -db project.und \ codecheck -reports "Results By File" config output_dir \ report -codecheck \ -options "Show Suppressed=False" \ "Results By File" ./output/active_only.csv ``` ## Multiple Standards ### Sequential Checks ```bash # Run multiple standards in sequence und -db project.und \ codecheck "MISRA C 2012" ./misra \ codecheck "AUTOSAR C++14" ./autosar \ codecheck "CERT C" ./cert ``` ### Combined Reporting ```bash # Compare results across standards for std in "MISRA C 2012" "AUTOSAR C++14" "CERT C"; do und codecheck "$std" ./"${std// /_}" project.und und -db project.und \ report -codecheck "Summary By Rule" ./"${std// /_}"/summary.csv done ``` ## Configuration Management ### Export Configuration ```bash # Export current configuration for backup/versioning und export ./misra_config.xml project.und # Edit to extract just the CodeCheck configuration section ``` ### Import Configuration ```bash # Create new database with configuration und create import config.xml new_project.und # Or import into existing database # (Configuration must be imported via Understand GUI) ``` ## Troubleshooting ### Check Available Configurations ```bash # List available CodeCheck configurations und -db project.und codecheck # (Interactive mode will show available checks) ``` ### Verify Database State ```bash # Ensure database is analyzed before running CodeCheck und analyze project.und und codecheck "MISRA C 2012" ./output project.und ``` ### Debug Specific Files ```bash # Check specific problematic files only echo "problematic_file.c" > check_these.txt und codecheck -files check_these.txt "MISRA C 2012" ./output project.und ``` ## Best Practices 1. **Always analyze first** - Run `und analyze` before CodeCheck 2. **Use baselines** - Establish baselines for regression tracking 3. **Automate** - Integrate into CI/CD with `-exitstatus` 4. **Focus on changes** - Use `-gitfiles` or `-changedfiles` for faster feedback 5. **Document suppressions** - Always document why violations are suppressed 6. **Track trends** - Monitor violation counts over time 7. **Report appropriately** - Use different reports for different audiences ## Common Exit Status Patterns ```bash # Count all violations (including excluded) und codecheck -exitstatus withexcluded config output project.und # Count only remaining (non-excluded) violations und codecheck -exitstatus config output project.und # Check for script errors instead und codecheck -exitstatus errors config output project.und ``` ## Additional Resources - For a quick introduction, see [README.md](README.md) - For detailed example prompts, see [examples.md](examples.md) - For und command reference, use the [scitools-understand skill](../scitools-understand/)