Name: AI Code Assurance in Agent Centric Development Cycle (AC/DC)
Uploaded: 2026-08-26T15:16:31.393Z
Duration: 36 min 20 s
Description: AI Code Assurance in Agent Centric Development Cycle (AC/DC)

Transcript for "AI Code Assurance in Agent Centric Development Cycle (AC/DC)": Once again, thank you for joining early. Those of you who are already here, we'll just give it a few more seconds to allow everybody to experience the next presentation to the full. K. So it's one minute past Vivek. Why don't we get started? So hello, and welcome to everybody, and thank you for joining our webinar today called AI Code Assurance in Agent Centric Development Cycle or ACDC as we call it here. If you joined any of our previous webinars, hello again, and welcome back. And today, we will be exploring how AI code assurance fits into the agent centric development cycle. It's quite a mouthful, and that's why we call it ACDC. And it's the new reality where AI agents are writing and shipping code at a pace traditional quality gates perhaps weren't built for. And we'll introduce a new standard for keeping that code safe and we'll show you, inside SonoCube how to monitor guardrail adherence across pull requests and branches so that you can move fast without losing control of your code health. I'm Andrew, and I'll be your moderator today. And I'm excited to have Vivek here with us as our presenter. But before we begin, let's just quickly go over some housekeeping points. So, we'll probably take around thirty to forty minutes today, and we will include, some time at the end for q and a. So please do, not hold back on your questions. You can submit them at any time, during the webinar via the the tab the q and a tab in the panel that you should be able to see. And we'll endeavor to answer as many of those as possible as we're going along live. Because behind the scenes, we have Joffrey and Tom who are sitting there at their keyboards waiting to answer all your questions. So please don't hesitate. Please keep them busy. Okay. And you cannot vote, I think, any questions you particularly like to see answered. The session will be recorded and we'll send out a link via email in the coming days, so no need to ask. And under the poll tab, which we'll put up towards the end, we you can request that we contact you if that's something that you would like. Finally, towards the very end, we'll put a brief question survey up for you just to give us some feedback about how you think today went and to help us improve. We appreciate your feedback in advance. Now let's introduce today's speaker, Vivek, joining us today. Vivek's a product manager at Sonar, with over a decade in software quality and security under his belt. He focuses on helping developer teams move fast, but without sacrificing quality or security. Vivek, welcome. Thank you very much, Andrew. I don't look anything like that picture. Right? I don't know. I'll leave you to it. Good luck. Thank you again. I hope all of you are doing wonderfully well this afternoon, evening, morning, etcetera etcetera. I'm really happy to talk about AI code and AI code assurance today. It's a very wonderful topic, especially considering the climate now. Let's first address what is AI code. When I talk about AI code assurance, first, let's see what I mean by AI code. Right? Probably you are using AI code in some capacity. Probably you are using a little bit of chat to generate a snippet. That is the most basic we can think. Or maybe you are using full fledged autonomous agentic code generation workflows. Either way, we call them as AI code in this, session. So what is happening now is that we are generating significant amounts of AI generated card by volume, and the, number of pull requests that are waiting for human review or automated reviews are huge. And the size of those pull requests are themselves humongous. This overall volume and throughput of code generated is posing a huge challenge. The biggest challenge is that delivering a lot of features could be easy, but to make that possible, you all need to make sure that this code that is generated is verified because humanly verifying in the old school way, all of this code is going to be very challenging to put it lightly. Right? So that is exactly the the problem that SonarQube is solving for you. SonarQube with it AI called Assurance is helping you verify the quality and security of your AI generated cord with its tooling and reporting features. So that is what we mean by AI cord assurance. With AI code assurance, you can actually unlock the potential that AI brings to the table. You can generate a lot of code AI code. You can use it in various, grades of capacity and make sure that the generated code is actually, adhering to the standards you set for your your your human colleagues as well. Right? That is secure and clean AI generated code. That is the outcome we are looking to get. So this is what we mean by AI code assurance, and this is what we want to accomplish, with AI code assurance. And we will see today about how this AI code assurance is, is working, how that is practiced, and I will also tell you a little bit about how this works in the modern workflow and what is the add on there, how agents interact with this. I will talk to you about that as well. So this is our plan for today, and let's go and get started, with configuring and practicing AI code assurance. So I said configuring and practicing. So there is two stages to this. And before starting to talk about and sharing about configuring, we need to have this two step process that I want to I want to make sure that you work with me on this. So first one is that it is a simple two step process. First, you need to configure the guardrail. Right? Configuring the guardrail means in Sonar's, world, it is two things. One is quality profile and quality gate. Don't worry. I'm going to tell you about, quality gate and quality profile in more details in a minute, but these two forms the guardrail configuration. And after that configuration is done, for sure, we need to make sure that these guardrails are applied in your projects in real life by by your engineering colleagues. When we do these two steps, we can be sure that we end up with secure, reliable, and maintainable AI code. It is very important we have these three attributes when we generate lots and lots of code. Right? So that is these two simple steps that we will talk a lot about today. First is configuring the guardrails. Second is applying the guardrails in real life. So these are the two steps we will talk a lot about today. Now just to, as a step going to the configurations, I have a little question for you. Now this quick survey will ask you a little bit about who of you are actually involved in setting the guardrails or setting the standards for coding in your organization. And just to check, I believe you can see the polls in the tab on the left of your screen. At least, words are coming in. It's really nice to see, how this goes. Excellent. Thanks for your votes, and I appreciate it. That is wonderful. I can see a big share of you are actually involved in setting the standards for your organization on how you, configure, the calling coding standards for your organization. This is excellent. You are in the right place, and I I am sure that, it resonates with you and everybody else as well because this will be very straightforward. Now let's get back to our, conversation today. Now I want to remind you for people among you who are really used to Sonar and for everybody who's new, in a simple way, what is a quality profile and quality gate? Now quality profile when I talk about quality profile, think of it like a set of rules, set of coding rules that will be applied to your project. Right? When I talk about a coding rule, a coding rule is what determines when Sonar scans your source code, how and which issues will be triggered. Issues are coming from the roots. Now, typically, when we talk about a quality profile, we can have three types of rules in them. They are security related rules, reliability related rules, and maintainability related rules. All of these rules can be put into a container. Let's call it a quality profile. These quality profiles are reusable entity, which means if you have, like, a thousand projects, you will create maybe five quality profiles, which you can reuse across your thousand projects based on classifications of projects you may have. This way, you have a reusable definition of standard for your organization. Now now we see what a quality profile actually means. Once you define these rule sets that need to be applied to your projects, next thing is enforcing these rules. That is where quality gate comes into play. How quality gate works is quality gates have a set of conditions with their thresholds. They enforce these rules in different context. By context, I mean, in your pull request or in your branch. This quality gate can fail if there are certain issues beyond the threshold. Couple of things to note about quality gate. Quality profile rules are one part of what QualityGate is enforcing. Beyond that, QualityGate is enforcing some additional attributes like code coverage, duplication, etcetera. If you're using AI code in any capacity, you know that having good amount of coverage is very, very important to make sure that your AI generated code is actually safe to operate. And duplication is one of the difficult, problems to handle when you're actually, using AI to generate code as well. So we we retread that. It is very important to keep this, threshold, keep these conditions in your quality gate. And, additionally, you can have dependency risk related conditions in your quality gate so that you can control, entering entering your introduction of any new dependency risks into your code base as well. So now you have quality profiles with your rule set, and the rule set can have three types of rules we discussed. And then quality gate will enforce them in your pull request and in your, branches. So once you do this, you end up with secure, reliable, and maintainable card. That is how the sonar guardrails work. So now that is the that is a fundamental we need to understand when we talk about the guardrails. Now let's talk about some new quality profiles we introduced. To make things easy for you when you are using agentic development, consider you are using a significant amount of AI agents to generate code. Let's say the project is predominantly handled by agents to unlock new levels of velocity. Right? We want to ship faster now. You will be better off using a quality profile like Sonar Identity AI quality profile. This quality profile is currently available in, Serac languages like JavaScript, TypeScript, Python, and Java. Obviously, the most used, to generate with AI. Right? And there are two main characteristics of this quality profile. One thing is that we have removed some human centric maintainability rules from this. This is because if the project is predominantly maintained by agents, you will benefit with higher velocity unlocked by not having human maintainability related rules. So those goes away from this profile. Additionally, we have introduced some rules that are related to, AI defect patterns. In AI generated code, we can see some specific issues, and we have some rules added to this profile to cover for them. These two this quality profile, in the select languages is already available in SonarQube server and SonarQube cloud you can already use. And let me quickly jump to, SonarQube and show you. If you go here in, let's say, JavaScript, which is my favorite language, and you will see that SonarAgent DKI quality profiles sits here. You can go in and you can, you can start using it. You just like any other built in quality profiles, you can inherit from this, or you can make a copy of it, start from this, etcetera. So this is available already. Now that is a brand new quality profile we have introduced, and keep in mind that, quality profiles will keep changing. We will keep it updated, rather, based on the fact that the industry is moving really fast, and we will adopt, adopt our, new new changes into this profile. So you always have something that is fitting to, agentic workflow. That is where it is going. Now from there, we talked about quality gate. Right? Once you have the quality profile down, you need to have the quality gate, and we have something for you there, which is the SonarWave for agentic AI quality gate. And, this one, I will explain how this is different from the Sonar way, the classic quality gate a lot of you are using, very popular. Now this one maintains the security and reliability at the security rating a or it it prevents any security and reliability issues from entering your code base. This is non negotiable for a lot of you. It is important, so it is that way. However, on the maintainability side, this will prevent any, maintainability issue with a greater than or equal to major severity. That means lower severity maintainability issues will not be breaking this quality gate, which will make or it will unlock more pace, in in when when you use this quality gate. Now you can see that I have crossed out one condition, which is related to hot spots. I just wanted to remind you that hotspots as a concept is duplicated in SonarQube. It is going away, and we are replacing it with, actual security issues, which consolidates the workflow for security issues, makes life easy for you. That is why you don't see this condition in this quality gate. And there are couple of things more to talk about it, and I will talk to you with the product actually. If you go there, you'll see Sonarway agent k I. Sonarway for agent decay eye quality gate. And, Just it's a quick one. Are you able to zoom in at all? We had a comment saying it's quite difficult to see inside the product. Not sure if that's possible. thank you very much for that feedback, Andrew. That is really helpful. So in this profile, I guess this is better now, Andrew. I will try to go a little bit bigger even. Maybe that is too much. This is, this is a good balance. Thank you. Alright. So I want to, invite your attention to a new condition that you probably have not seen before in Sonarwe, which is no, new dependency risk with severity greater than or equal to toe. Why? Now we don't want agents to introduce any dependency risks as we go. Right? That is why we have introduced this, default condition. One thing to notice, you might see this condition in your in your, quality gate, and it is probably grayed out. If it is grayed out, this is because you don't have the SonarQube advanced security pack. And this package will enable when when you purchase, this package, it will automatically enable this condition and it will start working. You don't have to do anything more. And if you have it already, it will be visible like this. And for coverage and duplication, we maintain the same conditions you have seen before in sonar ray. Now let's go back to our presentation. So we talked about agent equality gate and quality profile, both, unlocking data pace when you're using agentic development. Now let's quickly recap what we have covered so far. Right? We have talked about the guardrail configuration, both parts, how to configure quality profile, how to enforce them with quality gate. Now that is the first half, half battle one. We need to see how to actually, apply this in real life that is verifying that the guardrails are applied, in the real world. So this is the this is the most important, aspect of air con Assurance to make sure that guardrail configuration, flexibility, the tooling is very capable. You can tailor it to your needs. I strongly recommend you, based on the context of your project, configure your quality profile so that you get the right balance, have the quality gate in place so you, fail it, etcetera. But now let's see how we make sure that this is applied. Now a lot of you are already practicing it. A lot of you can improve as well that probably how we enforce this in two levels. In pull request, you want to make sure that the SONAR quality gate SONAR quality gate is always passing while you're merging the quality gate. You can actually do this with, your your GitHub, GitLab, etcetera. You make sure that, the quality gate is passing while you merge, and this should be a really nonnegotiable so that anything that is merged to your branches are actually clean. So this is ensuring that the standard you already set while conferring the guardrail is actually respected in pull request. Similarly, for branches, branches is where we are making releases from. Right? So in branches, you want to make sure that those releases we talk about, they are actually going with a green quality gate, with a passing quality gate, because you have set up some conditions to make sure that all your releases are safe. That is where I have something for you, which is brand new in SonarQube, and that is a quality gate history. You can directly in the product UI, in SonarQube, you can monitor which of your releases were, actually risky. Let me show you that in product. You can go to SonarQube cloud or server. It is available in both products. You can go to your navigation, and you will see quality gate history. Let me again zoom this probably a little bit so it is a little bit better. You can change your period of time, and you can see that, oh, there is a release that was risky. So you can investigate what went wrong with that release, and you can prevent it from happening again in near future releases. You can continuously monitor that your your releases are, passing quality gate. So I strongly recommend you monitor your quality gate stream, your status as you go, and always make sure that, your quality gate was passing when you make a release. This way, you have AI code generation happening. Maybe you generate 10 times more code now, but still, Sonar AI code assurance will make sure that it is all passing. It is all good for you. Cool. So now we have covered both two aspects. We have seen how to configure the guardrails. We have also seen how to actually enforce them in your real life with, development practices. Both steps covered. Now it is time to talk about air cord assurance in ACDC. ACDC is in long agent centric development cycle, which is what Andrew was talking about in the beginning of the session. I only talked so far about pull request and branches. Right? Yes. In CI CD, you have to make sure branches are clean. You have to make sure that PR is clean. This is absolutely essential. But with modern workflow, you have to make sure that they have something to do in the inner loop where agent is generating code, etcetera. Right? And it is time for another quick question, to understand a little bit about how are you using agentic development today? How much of agentic development you're using? Let's see that. Great. Please participate in this. Please go to the left side and see the poll panel getting your words. It's going to help us greatly. Excellent. I see that the biggest part is we are using agents, but adoption is, still improving. Adoption is coming up. And quite a bit of people say that we are fully agentic. That is really interesting to see actually. Yeah. We know this is happening, and some of you are actually still, thinking about bringing AI into your, coding. So that is a that is a good, set of people in the actual usage of AI already, which is perfect. And that is where I'm going to tell you about how a code is shown spans across this workflow of yours. I will simplify this ACDC situation for you. I'm going to flatten it a little bit. So on the left hand side, we have the agents generating code, agents fixing code, etcetera, etcetera before agents are pushing it into PR, and then you have the branches on the right. Don't worry about complicated, block diagram, etcetera. Right here, I'm going to simplify it for you. Now let's first talk about air collisions with sonar vertex guide. Sonar Vertex is a product that is designed to help you save tokens, go fast, make sure that your code is written right from the beginning so that you save rework. Right? That is what the the value that vertex brings. One part of vertex is about guiding. Sonar vertex guide, what it is doing is that it is guiding the agent to generate the code within the right constraints with, the right context, we call it also context augmentation. How is AI code assurance helping here? AI code assurance through its quality profile is influencing Vertex in guiding which coding rules should be applied to the code it is about to generate. So before the code is even generated, the coding standard you defined through your AI Coder Assurance quality profile is influencing how code is generated upfront. This will reduce the number of potential issues that you care about being generated. So that is Vertex guide for you. It is guiding the agents to produce a code without the issues that you don't want to see in the first place. That saves you rework. Now what happens from there? You have agentic analysis through Vertex verify. Once agents generates its code, a full bodied sonar scan can be leveraged through SonarVertex, and this time it is Sonar Vertex verify. Again, Sonar's, quality profile through its AI code assurance is going to use that rules that you have defined as your standard, common standard for humans and AI probably. And that standard is going to tell agent that, hey. These are the rules applied. These are the issues found. So that rules are again going to play here when agent is fixing issues. So agent are instructed to fix those issues based on the standard you defined using your AI questions quality profile. Now that is how agents can use or leverage sonar AI questions through Sonar Vertex. From there, you have the pull request, which we have talked about before. Now you have one more thing, which is the air cushions quality gate. You as we discussed before, we'll have to make sure that quality gate is passing, which would be really nice, and I would be very happy if you do. And you will be as well because the cord will be actually safe and secure. And from the pull request, you have to also make sure that the quality gate is passing for your branches because, as you probably remember, Sonar prioritizes speed towards left and a deeper analysis towards right in the branch so that it is optimized for your developers workflow. So the quality gate in the branches will make sure that your releases are actually clean. So we have seen that. Now we have seen across the board how we will use this. As I said, we'll use this screen to make sure that your release is circling. Please don't forget to do that. With that, we have covered the whole stages of your, ACDC and how in the agentic environment, in the pull request, and also in the branches, how AI core assurance helps you to keep your code safe and secure without any security issues, reliability issues, and also, dependency risks and maintainable issues. All of them are out of your court when you practice air cushions, and that is how you can keep your court clean. Let's recap quickly. Guardrails configured. We said that guardrails need to be configured with quality gate, quality profile, and quality gate in that order. Quality profile defines the rule set. Quality gate enforces the rule set. Then guardrails are applied. I have added one more word here if you noticed. Earlier, I said guardrails are applied in the pull request and in the branches. But now I'm saying one more thing. In pull request, branches and through vortex in your agentic environment. So that is how Sonar AI cord assurance will help you across, your SPLC. And what are you going with? I'm sure you are telling with me. Secure, reliable, and maintainable AI code. That is what the outcome we all want. Right? So we have now gone through all that, what I had to tell you about AI questions today. I will leave this at this point to Andrew, to share a little bit about, some of the upcoming webinars. Thanks, Vivek. Excellent. There's a lot to unpack there, so thank you very much. Just a quick note. If you are putting questions in the chat and you want them answered, cut and paste them into the q and a. That's where we can actually respond to them. Okay. So what you can see on your screen is just a bit of information about some upcoming webinars, and we've put some links to those in the chat as well. And I am, as I'm saying this, just going some of the questions that I want to ask Vivek live, test him, like his mastermind. But if you do want to learn more about the subject we've been discussing today and and Vivek's been taking us through or even just about Sonar on our solution solutions in general. Shortly and reach out. Okay. So let's take a quick question and, like, if you're ready. Okay. First one, how can we ensure guardrails applied in pull requests? We use GitHub. Fantastic. So, there are two ways. One is depends on are you using a legacy setup in GitHub. In that case, you have to enable branch protection and then make sure that a SonarQube asset checker is enforced for that branch so that it is a necessary check before, a pull request can be merged. And if you are using the modern setup, you have to add a rule for the branch. You can select which branch based on pattern or a specific branch may be the main. How you do is up to your team's configuration, and then you will add SonarQube as a rule, a checker for there, and we'll make sure that it's a mandatory one, for, your mergers. This way you can make sure that you don't merge pull requests just without checking the quality gate status. You will make sure through this workflow that you will always merge pull request with passing quality gate. Okay. Hopefully, you can hear me okay. I will speak slowly and clearly just to make sure. Second question, can we still tag projects as containing AI code? Absolutely. This feature is still existing. We are not taking it away or anything. It is still there. If you want to generate some statistics, some dashboards, etcetera, for your projects that are using AI, you can absolutely tag your projects as containing AI code. Great. How we doing for time? We're okay. So a couple more questions. Can agents this is a great one, Vivek. Can agents access quality gate status, or is it just a quality profile? Oh, yeah. I I see why this question. Because, when I talked about the vertex, I was primarily talking about quality profile. But, yes, it can can access quality gate status through the MCP, and there is in fact there is a get quality gate status, and you can pass the project key or the pull request key, etcetera. So for a given context that is a pull request or a branch for a given project, you can indeed get the quality gate status. And our MCP is super popular. Right? So you can absolutely the agents can absolutely get the quality gate status through MCP. Great. We spotted a few questions, on languages. You mentioned a few key languages that are supported, Vivek. What plans are there for additional ones? Like, there were a few examples in the chat, but in general, what's, what what's coming next? We are looking for response from customers on this. And if you if you would like to see it for a specific language, please share that feedback. We will absolutely look into it, and I am going to pass that to the right team. Okay. Yeah. We had a few in the chat, so we'll record those. Thank you. Why do I have to pass the quality gate on any branch? So, let me revisit this a little bit. So, typically, when SonarQube runs a scan, let's assume you scan a pull request and then you run a branch. Why am I insisting that when PR was already passing quality gate, why do you need it in the branch? This is because Sonar prioritizes speed of analysis in the pull request. And when you merge the pull request, you may get some brand new issues in the branch. And this is because we have a deeper analysis on the branch. For example, anything that is beyond the context of change in the PR, those issues will be detected in the branch. So this is why it is very important, that you scan the branch and make sure that the quality gate is passing on the branch. Excellent. Okay. Thank you. Vivek, listen. Thank you so much. That was great. I feel that was very educational. Thank you to everybody who submitted questions. It's great when you participate as well in the poll, so thank you again for that. Just a shout out to our community because that's a great place if you haven't discovered it. Our community forum is also a great place to ask questions and not just people from SONAR, but everybody jumps in and helps. So, do go to community.sonarsource.com if if anything pops into your mind after this webinar or if you're watching a recording, of course. And finally, thank you for completing the survey that will pop up on your screen that will help us improve for next time. Vivek, thank you so much. That was great. And we will head backstage now and thank everybody for attending. Thank you very much, Andrew. Thank you, everybody. Yes. Bye bye.