SonarQube + OpenAI: Agentic Development — Killian Carlsen-Phelan, Sonar

AI Engineer · 41 min · 445 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

00:13Cool.
00:14Uh so I'm here from uh Codex's deployment engineering team and I want to quickly say a few things to introduce the amazing folks at Sonar as well as Killian.
00:23Uh, so I'm gonna skip some of the agent basics I typically talk about because I get the feeling that this audience knows what they're doing when it comes into that.
00:30We're gonna dive right into the harder questions like what does it mean for an agent to have completed a task?
00:36What are trust boundaries?
00:38And we have three kind of spicy claims that we want to present as well.
00:42Uh, one is done means a task is completed with evidence.
00:46two is that containment is not correctness and three is that the feedback contract belongs inside the loop.
00:53So when we have an agent loop that tends to follow a few predictable patterns.
00:57We tend to have this model action uh we have the execution that is governed by the model.
01:03We observe the changes whether that be logs, results, output or otherwise and we continue updating the plan.
01:09That's sort of like the overarching agent loop that we follow.
01:12And then with each individual task, we have uh an outcome, we have invariance, we have a generally defined scope for what we're working on.
01:21And of course, we also have acceptance criteria as well.
01:25Uh so the definition of done for us typically it's a reviewable diff, some tool evidence, that type of thing.
01:31It doesn't mean just saying fixed.
01:33It actually means saying fixed and providing the evidence supporting this fact.
01:38Uh so cheaper implementations tend to shift the bottleneck to specification and verification and that's really not what we're wanting to do.
01:47Um there's this idea of correlated failure as well and there's typically a couple of common failure modes that coding agents uh tend to fall into.
01:56it tends to fall back to incomplete context.
02:00Uh where or maybe there's a local fix that violates some global invariance that we have.
02:05Uh or better yet the the generated test that we actually do to verify results in the same issues just being propagated through.
02:13Uh so selfcritique is useful but it's not an independent oracle and we often tend to find that some of the results of the agent and the verifier tend to be orthogonal
02:24to each other.
02:25You can't uh determine whether a task is done without looking at both parts of it.
02:29Uh so you you typically want to almost seek out disconfirming evidence of a task being completed uh according to the compiler is it done according to the tests analysis
02:40so on and so forth is it done and it's you can't really replace human review in the entire cycle as well.
02:47Um the the next point I wanted to quickly hit on is uh containment doesn't equal correctness.
02:53Uh we have the execution layer which typically defines what an agent can do right what tools does it have access to uh what scope does it have uh per view over what approvals does it need to act and then we have the uh
03:07with this execution layer we have the artifact layer uh and this is really where the results are evaluated uh is the result acceptable uh what tests were produced what analyses
03:18what policy even what intent is there Uh so a sandbox can contain a right but it can't prove that a query is safe.
03:29Uh so what I'm trying to get at is that no oracle is proof and that you want to layer controls with different boundaries.
03:37Sort of this defense and depth uh these multi-layers of guardrails.
03:41That's sort of the overall idea.
03:44And the great part about that is that you as a
03:46[snorts]
03:46human, you own the intent, you own the exceptions, and of course you own the decision whether to ship it or not.
03:54Uh so this is one last thing.
03:55Uh there's a feedback contract that we tend to advise as well.
04:00Uh typically those come with skills um which of course are procedures as to how to accomplish a particular task.
04:07uh MCPs contain structured tools and context and of course we are able to provide life cycle checks with hooks really good for finding out if you have hard-coded secrets or that kind of thing as well.
04:19Uh so with this you want to create this full CI and human review process that should ultimately be the core of what the human's role is within this.
04:29Uh and that sort of so anyways um what you want to evaluate when you are creating this sort of agentic process is a few things.
04:38Uh what's the boundary for example uh are you able to uh intercept secrets before model input for example?
04:45Uh how is the project grounded?
04:49Uh do you have any concrete rules or locations or vulnerability paths that you are able to provide?
04:55Uh what is the scope?
04:56Are parameters binding while preserving behavior.
05:00These are things to check for and of course you have to constantly run your rechecks.
05:04Uh assert that the agents are not the terminal state.
05:09Uh so anyways uh enough yapping from my end of things.
05:13Uh if there's a three points that you take away from me, it's that done means a task is complete with evidence.
05:19Two is that containment is not correctness.
05:23And three is that the feedback contract belongs inside the loop so you can fully take advantage of the capabilities that your agents such as codeex provide.
05:32[sighs]
05:32Uh so Killian, let's uh let's make that loop uh complete, why don't we?
05:38That's about all for mind of things.
05:39So thank you so much for uh giving me the opportunity to give this introduction.
05:46Thank you.
05:50If you can take a look at this then um and and scan it and follow through it'll be very helpful.
05:56There are a few prerequisites.
05:58Um again I am Killian.
06:00I am a developer content engineer at Sonar.
06:03Um, so thank you very much again, um, OpenAI and Tony for giving us a little intro into all of this.
06:10Um, Codeex is a very powerful tool.
06:13I use it all the time.
06:14I found it very helpful.
06:16It's has a fast CLI.
06:18It has a, uh, pretty smart sandbox system and the hook system that it has as well integrates really well with tools like Sonic Cube like I'd like to hop into today.
06:31So, wiring your team for agentic development with sonar cube and open AI.
06:39Um, the question I want to pose today is how do we make sure that the code and the output generated by agents like codeex is verified that it's safe.
06:50At Soner, we have this idea of the agent centric development cycle.
06:55We did um some some research in the past year or so and we surveyed over a thousand developers and we found that uh 42% of committed code is either AI generated or AI assisted
07:10but 96% of developers do not fully trust it.
07:15Right?
07:16So the vast majority of people do not just think hey this is safe right off the bat.
07:21Less than half of them say that they fully verify the code before they push and merge it into the codebase.
07:27There's a bit of tension there.
07:28No one trusts it.
07:30A bunch of untr untrusted code is getting into the codebase.
07:34Um the reason being is that the bottleneck used to be code generation, right?
07:40How can we create what we're what we're trying to do to achieve the desired outcome?
07:46How do we actually write the code for an application that we're trying to build?
07:50um with AI agents that has for the most part part been solved with them either doing it themselves or with the assistance of of AI agents.
07:58So the bottleneck has shifted now from just code generation to code verification.
08:04Right?
08:04We have a massive amount of code being generated but now it is up to the human limitation of hey how do I make sure that this is safe?
08:14what help and what tools can I get to verify that this is not going to nuke my codebase or nuke my customers and create all sorts of bad uh issues going on.
08:24So we have uh four steps in the AC/DC the agentcentric development cycle.
08:30One of them is not necessarily from sonar that is generate that is whatever coding tool you're using codeex anything else um that is the generate step but sonar owns guide verify and solve.
08:44What guide is is we inject the agent with proper context and that includes your project guidelines, any rules, any specific architecture to make sure that it has high quality
08:55context before it even starts building anything.
08:58We found that this reduces token cost overall and at enterprise scale that I mean saves a lot of money in the long term.
09:06verify is as soon as it's done creating uh whatever task you've assigned to a generated code, we want to make sure that no issues are being introduced.
09:15So no security issues, code quality issues, maintainability, anything like that.
09:20None of that needs to be pushed out to production code.
09:23And then solve is okay, we have detected there's an issue, right?
09:28There's some sort of injection vulnerability or whatever that's going on.
09:33we need to remediate that quickly um and as efficiently as possible so that we can kind of have this iterative coding system right there.
09:44And the last slide I'm going to show before we hop into the actual activity is uh the concept of the inner loop and the outer loop of verification.
09:52Outer loop is your traditional CI system that you have set up, right?
09:57So you write code, you push it to GitHub, GitLab, whatever you use, the pipeline runs and something may fail, right?
10:04Your test or a scan or sonar cube may fail and then you go back to the IDE and then you try and fix it and then you push it and then it fails again.
10:14This has been the bane of my existence, the bane of many developers existences.
10:20So we want to save time by shifting left to the interloop and that's the IDE.
10:25So that's as soon as we are done generating code, we want to verify that it is correct within the IDE without having to push it out.
10:35Um, this saves a lot of time.
10:38Uh, I mean, especially, you know, being able to automatically verify all this stuff.
10:44Time is money at at enterprises and your engineers save a lot of money on therapy bills as well without that frustration.
10:52Um all right that is the last slide I really want to focus on uh before hopping into the terminal.
11:00[snorts]
11:00Uh a few quick things I want to touch base on before that you're going to see two uh two tools that I'm going to talk about our tool for context
11:09our tool called context augmentation is what we're going to use for the guide stage and our tool for agentic analysis you're going to see in the verify stage.
11:19We'll come back to those later.
11:20[snorts]
11:21Um, and the the big takeaway as well that I want everyone to keep focusing on is this bottleneck has shifted from code generation to code verification.
11:31Um, before we hop in as well, everyone should have Docker running if you're able to on your computer.
11:38And just quick show of thumbs just so I have an idea of people who have been able to follow along with the prerequisites so far.
11:44Thumbs up if you got Docker running and are kind of primed, ready to go.
11:49hop into the terminal and follow along.
11:52Awesome.
11:52A few.
11:53Perfect.
11:54Thank you.
11:55Um if not, again, this repo is available.
11:58You can follow through with this on your own time.
12:01Um you will have all of this information.
12:04So, let me pop out of this real quick.
12:07I only have limited view.
12:09Cutting the top part of my screen off, but should be good to go.
12:13All right.
12:14So the first thing that we are going to do is we are going to run this script called apply sonar.
12:19Um this is just the the repo that I clone locally.
12:22[snorts]
12:23This is going to require a bash terminal.
12:24So if you're on Windows you can use git bash or something like that.
12:28Um so I'm going to go ahead and type that in.
12:31That is apply sonar.
12:38All right.
12:38And this is going to do a few things.
12:41This is a personal tool that I built.
12:43It is not an official Sonar product.
12:45Um, it is just a shortcut.
12:48So, we're not spending 10 minutes clicking through a UI or anything like that.
12:53Make sure my Wi-Fi is doing all right.
12:56Okay.
13:00Running through a little bit of computer slowness up here.
13:03Um, but it'll this will create a Sonar Cube cloud project for you.
13:07Um, runs the first scan for you.
13:12Okay, EU and it will off me in.
13:16So, we'll just pop open the browser.
13:19Um, this will install a few related Sonar Cube tools for you like our CLI and anything else that we're going to need to run our plugin with Codeex on top of.
13:36All right, bear with me as it looks like I'm bumping into just a little bit of Wi-Fi slowness in here, but shouldn't be a big issue.
13:44So, that has been successful.
13:51Um, you're going to want to put in um the org that you want.
13:55So, the org that you were created that was uh created for you when you made an account.
14:01[snorts]
14:06and that'll run.
14:07Um, this right here, just to talk about the project, this is a tiny Python project.
14:13Nothing complicated.
14:14There's like four files, less than 200 lines total.
14:18And I have planted four vulnerabilities in there.
14:21Three of them are security vulnerabilities and one of them is a code smell.
14:27And um when this script gets done running, then we're going to hop into the dashboard and make sure that uh we can see stuff up there.
14:37All right.
14:39Normally, uh I think there's a lot of people trying to access this Wi-Fi.
14:43Uh I've not seen this take longer than a minute on my own personal Wi-Fi.
14:47So, if you're following along at home, don't think you'll have to be sitting around like this um for a little while.
14:53Whoops.
15:01So, I am You know what?
15:03I may have actually forgot to export my token, which is a step in the repo real quick.
15:08So, um this should be in your shell.
15:12I'm going to pull out my disconnect real quick just for a second so I don't expose my sonar token to a room full of a bunch of people.
15:19And then I'll pop right back in.
15:27Uh so there should be some steps in the the repository.
15:31You will navigate through the dashboard.
15:33I think it's under administration within sonarcube cloud.
15:48All right.
15:48re mirror.
15:55All right.
15:56So, this will run.
15:58Um, a few things I want to talk about as well.
16:01So, we are going to see a uh SQL injection issue that pops in.
16:06Okay, awesome.
16:07This looks like it's working now.
16:09Um, so it'll go through and it'll automatically create um everything for me in the dashboard.
16:16The security rating that it will come up with is going to be E. This is the very lowest.
16:21We have uh baked in some security issues and uh Sonar Cube immediately detects these and says, "Hey, this is no good."
16:31The next thing that I'm going to dig into as soon as this gets loaded is just walk through a couple issues.
16:37One of them is going to be an open AP uh open AI API key.
16:41Very relevant if people are using codecs.
16:44I have done this.
16:45It's actually right here in the codebase.
16:48Oops, someone forgot to use an env file or pass this in as a variable.
16:53Um, this happens all the time.
16:56And what a lot of times what happens is people accidentally push these into production code.
17:00Um, and the average remediation time for a secret in a public repository is 90 days right now.
17:09That is crazy.
17:10that is your your token is just sitting out there for all the world to see, all the bots to scrape for 90 days.
17:17We want to prevent this as much as possible and we have a couple tools for that here.
17:22Um, another issue that I'm going to highlight for y'all here in a second is there is a SQL injection vulnerability.
17:31Um, and if anyone who was just perusing through this code is a security wiz, you may have noticed it, but um, right here in this database.py file, I am passing in
17:46um, a query from here directly into an fstring that is being uh, cursor executed.
17:53So the argument is going straight into the string.
17:57That is bad news bears especially because this um function search task is being uh given an argument from cy.orgv that means that anybody who controls cy.orgv RV gets to control your database,
18:14right?
18:15This is really bad.
18:16Sonar Cube is able to detect this and will let you know, hey, here is the data flow that we're detecting.
18:22It's using symbolic execution and taint analysis to identify the data flow and and trace it as it moves through your application.
18:33Um, there's going to be a few things that we do as soon as this is set up.
18:38One of them is um installing the the sonar cube codeex marketplace.
18:46Another one is wiring that to your project.
18:48And then another one is um making sure that everything is is connected in the plugin.
18:56So this is almost done here.
18:59Apologize for that short wait, folks.
19:01Um, and if you are running this yourself, hopefully it is um either finished so far or or almost done.
19:12This will be done momentarily.
19:14But the three tools that I'm going to focus on today are
19:17[snorts]
19:17the um the secrets detection hook that we offer.
19:22We also have a uh list issues tool through codecs and that allows you to see any of the issues from sonar cube within the terminal.
19:31And then the third one is being able to find and fix issues from those listed issues that we pull in in in the plugin itself.
19:40[snorts]
19:42Any questions so far from anyone?
19:44If you have questions, by the way, if your setup's not working, we have our lovely team from Sonar over there.
19:50They're going to wave hi real quick.
19:51Um, if you raise your hand and bump into anything, they are more than happy to come over and talk to you and and help you through everything.
20:04All right, analysis complete and I can go ahead and click into my dashboard.
20:16Open that up.
20:20Like I said, this is going to be our Sonar Cube cloud dashboard that shows you all of the issues that it's detected um within your project.
20:31And if you've had any issues with Wi-Fi or or being able to install any of the prerequisites, um again, no problem.
20:38This repo that you scanned uh the QR code for, just reload that.
20:47That repo is going to be up for you.
21:00All right.
21:01So, here's the dashboard and I'm not going to spend too much time here.
21:05Um, but we can see here that this security rating is E. There are those three security issues.
21:12There are four total.
21:13If I click on this, we can see here is that OpenAI API key that was able to detect uh that that's here.
21:22Um just plain text in the source code.
21:25And if I go back, the other one I want to focus on is this SQL injection vulnerability right here.
21:32This is the one I talked to uh y'all with the the CIS.orgv issue.
21:36And this is taint analysis tracing the data flow from the source here all the way through different files and functions into the sync right here.
21:46Very very helpful.
21:49All right, popping back over to the terminal.
21:54Um, let me hop over to my handy dandy uh command clipboard that I have here.
22:00I'm going to do codeex uh plugin marketplace add.
22:05And what that's going to do is that's just going to add the Sonar Cube Marketplace here.
22:13And um this as soon as that's in, we're going to hop into a codeex itself, we will see the Sonar Cube uh plugin available and we'll be able to select that.
22:27So give that a few seconds.
22:29Uh, appreciate all of you all folks being able to bear with me as I bump into just minor connectivity slowness.
22:38Again, in your normal agentic workflows, I'm sure things will be moving much faster for you.
22:45Perfect.
22:46I'm going to pop open codeex.
22:49Sweet.
22:50And I'm going to do slashplugins and then just search for sonar cube and install it.
22:57So that is get the marketplace run it slashplugins uh invocation and then type in sonar cube and that is installed.
23:12Right.
23:12I'm going to exit out of this so that it can reload and so I can just run a couple more commands.
23:17Um, I'm going to uh say sonar off login.
23:27That's just going to authenticate the CLI um which uh will allow us to use a lot of the capabilities that the plug-in is built off of.
23:41After that, uh, we're going to get to finally the the final wiring step, which is just Sonar integrate codecs as soon as this gets off for us.
23:52Yep.
23:53Allow that.
23:54Perfect.
24:01So, that will take hopefully not too too much longer.
24:05Uh, a couple seconds.
24:06get that updated and then we'll write um do this integrate codeex command here.
24:26Oh, looks like it's running into some more.
24:29Um try that.
24:34Look like for some reason the the Sonor token which is exported is getting lost.
24:50Pop back in for youall real quick.
25:01See if you can't see my screen again.
25:07Perfect.
25:11I'm going to go to the clipboard and pull this back over.
25:21All right.
25:22So, uh, what this is going to do is a few different things.
25:25This is going to get you your secrets detection hook.
25:28This is going to get you your agents uh MD directive to use all the solder cube skills and this is going to give you um other skills and uh the MCP config as well.
25:45It's perfect.
25:46This is just going to go on a little bit longer and then everything will be fully wired up to use the Sonar Cube codeex plugin.
25:56Quick time check.
25:57Okay, we should be good.
26:02So for me, this is going to install uh two extra things that some of you who are using the free account may not see.
26:09That is context augmentation and that is agentic analysis.
26:14Uh agentic analysis is a hook that fires instantly after any edit that the agent does.
26:22So if you tell it to write a file or modify any file, it will automatically execute and that runs serverside analysis on the code that was just written.
26:33What context augmentation does is it detects hey when it's about to do something when Codex is about to perform a task then it will feed it with the the guidelines
26:44and uh relevant architecture and other information like that.
26:47Okay, we are we are finally rocking and rolling here folks.
26:51We have a few things that were added.
26:53Um, specifically some hooks in here.
26:56There are some skills under the hood as well.
26:58And I'm going to copy this real quick.
27:03So, I'm going to pop open codeex.
27:06Trust all of these hooks.
27:08Thank you, sandbox.
27:09And the uh the MCP server is getting booted up with sonar cube.
27:15I'm going to do is I'm going to say, hey, can you push a commit using my token?
27:20This is a a fake secret that um the the plug-in suggests that you try with immediately.
27:28Say sure.
27:32So you can see instantly this was blocked.
27:35No secrets were leaked into the L1 context.
27:39Nothing is being stored in any logs or anything like that.
27:42As well if you ask it to read a file with a secret in it, it will not do it.
27:48It will be blocked.
27:48Codex never gets to look at any of your uh secrets or anything like that that are that are being leaked into your context.
27:57This is super important.
27:58People do it all the time.
28:00We all know what to do.
28:01Yes.
28:08Write a script to read the file.
28:10So,
28:13that's possible.
28:15Um, this mainly works on the tool use, right?
28:19It's it's a hook that's invoked on on the the user prompt submit tool.
28:24So, if that is bypassed, then it is possible that that hook may not be invoked.
28:29But for basic usage of um codecs and its tools and and and prompting it and things like that, if you leak any um secrets into the prompt or if there's anything, it will detect that.
28:42Uh, looks like we're having a little bit of internet connectivity right here.
28:46Uh, I'm going to reaunch up that MCP server real quick.
29:00And so what the MCP server is going to allow us to do is to use the skills that allow us to interact uh with between codecs and and the Sonar Cube cloud
29:11uh dashboard that we saw earlier.
29:13For instance, if we were to say, hey, list all of the issues in my project, it's able to fetch that and uh and return information to us.
29:22I'm just going to go ahead and exit out of this real quick and open it back up and get that Sonar Cube MCP server booted right back up.
29:45Yes.
30:02I am very sorry it's hard for me to hear.
30:04Would you mind walking up or speaking a little louder?
30:06Louder.
30:15Yes.
30:30running this on my own.
30:31The apply sonar script that get gets us all provisioned for me never takes longer than a minute if I'm running it on my own.
30:38Um everything else the MCP is is about as long as any other MCP that it takes assuming normal connectivity.
30:45Um, I'm doing my best to work with the connectivity here, but um, outside of that, I would say there's no extra, uh, overhead that any of these really apply
30:56for or any of these add to a normal, um, developer workflow.
31:04So, I'm going to double check that that MCP is uh, up and running real quick.
31:14And um like I said, what what the MCP does is allows you to have access to all of the tools to where anytime you ask it to do something related
31:23to uh Sonar, like the issues in your project, it automatically detects what's going on um and and will invoke any of those relevant skills.
31:32One of those skills is context augmentation, which is knowing that okay, we have the sonar cube tools, but our network does not seem to be populating uh the MCP
31:44with any of that.
31:48Let me see.
31:49Let me see if it'll work with us regardless.
31:51Let me say list the issues in my project.
32:00Um, any other questions so far?
32:03Figure I might as well take a few while we're waiting.
32:05Yes.
32:10Yes.
32:10So, the the the CLI um actually only sets up the configuration.
32:15The MCP runs within Docker.
32:18So, it will sometimes go through the MCP if it's using any of the skills um that it has there.
32:26But for the most part, this plugin and everything just sets up the configuration and then invokes um skills through there.
32:37The the the CLI helps you provision and set up the MCP and everything like that.
32:41And then there are commands that you're able to to invoke through the MCP with the CLI.
32:47And I want to clarify the difference.
32:48There's a CLI that this plug-in lives on top of.
32:51So there are certain things where you can say hey execute um you know this this task for me and it may route through route it through an MCP skill
33:02or through a CLI command.
33:06Okay so looks like we have the MCP it's just running very slow because of network because it was able to detect that for us.
33:14So in our list issue skill as well as this context augmentation skill we can also see that hey even when it's looking at its skills we are running the secret scan and making sure that there are no uh API keys
33:30nothing like that uh leaked in uh when it when it takes a look at at any of its files including its own skill files.
33:40Okay, we're valid.
33:44It's looking through all of these and again um running into network connectivity here.
33:49This should all happen in a normal uh agentic workflow.
33:53Uh much quicker than that.
33:55[snorts]
33:56Any other questions I can take while we wait for this to to to boot up a little bit?
34:06Uh enterprise server.
34:10Yeah, absolutely.
34:11This is available across any levels of of Sonar Cube use.
34:16Be that cloud, be that server, be that enterprise, be that the free tier.
34:20Um, everybody should have access to this.
34:22Now, uh, the limitation there is uh, context augmentation and agentic analysis are two tools that we do not offer on the free tier.
34:33Um, but if you have those entitlements in your org, then you'll be able to use those tools.
34:41All right.
34:45So, we were able to see that we can get those same issues that we saw in the dashboard now available in the CLI.
34:53Imagine that this took 15 seconds and that the uh that the engineer has a fully connected Wi-Fi connection.
35:01Um they will have this available very quickly within their IDE.
35:06Here is the uh uh secret blocked uh blocker severity that I mentioned earlier.
35:13But the one that I want to highlight and get fixed today is this S8702.
35:19This is a rule that we wrote specifically for AI agentic workflows.
35:23We do not want AI coding agents to write code that other agents are able to exploit.
35:30That is the cy.orgv flow that I described a little bit earlier.
35:34Again, anybody who has access to cy.orgv will be able to have control over your database.
35:43We want to prevent this.
35:44So, I'm just going to tell uh codeex say, hey, fix s2.
35:53That's going to run.
35:55And again, all of these issues, you can instantly pull them to your terminal and ask codeex to fix it.
36:03There was going to be something that is different on my machine versus anybody following along is that is you'll see as soon as code is edited and changed here.
36:14The post tool use hook for agentic analysis will run.
36:19What that does is if there were any new vulnerabilities introduced in the fix sonar cube will scan it server side.
36:28If you do not have agentic analysis that is totally fine.
36:32you can just scan your code uh during your next uh CI push or anything like that.
36:38But um regardless it will get verified using a gentic analysis just closes that loop and gives you automatic feedback to know that hey I have not introduced any more issues.
36:50Um, I don't know about y'all, but I have been in uh coding sessions sometimes where I'm like, "Hey, fix this issue."
36:58And then three more kind of pop up and I'm trying to fix those and it's like trying to conquer a hydra where these just kind of propagate out.
37:05Using this automatically verifies that you're not causing any new uh vulnerabilities to come about.
37:12Awesome.
37:13So, we were we were able to fix this.
37:15We get a parameterized query.
37:18Wonderful.
37:19Um, and this post tool use hook completes.
37:23What it lets you know is is it lets you know there is an issue in the file.
37:27However, that existed beforehand.
37:30That was one of the issues that I had already pre-baked in here.
37:34So, it's not going to try and solve everything else in your file for you.
37:38it is smart and it just realizes that hey whatever was in the code that we changed we're going to uh analyze that and make sure that there are no new issues
37:48introduced from that code.
37:51So wonderful.
37:53Um it reanalyzed that code in line and verified that it passed.
37:58Um and we no longer report uh S8702.
38:04So we are able to find and fix and automatically verify um new code uh as it comes into our workspace.
38:16All right.
38:19So I want to leave a little bit of time for questions at the end.
38:21So I'm just going to um move through to this last piece here.
38:26And this is um adding a new function, right?
38:32delete a task by ID to database.py.
38:35And this when asking it to come up with uh new code, it will use context augmentation.
38:41As I mentioned earlier, this fetches relevant context rules architecture from your project and feeds that into the agent.
38:49Now, I have no idea how long this may take to work.
38:53I imagine within less than a few uh minutes.
38:57Normally, it's seconds.
38:59Um however what I want you to realize as well is that using this is the full cycle all within the terminal as we are guiding the agent.
39:10Oh look it finishes very quickly.
39:12Very well done.
39:14um is we we um get relevant context.
39:20Um we you we get this to be fixed or implemented in this case when we're asking it to implement a new uh feature.
39:29It gets verified from the uh agentic analysis hook and if there were any issues in there uh they would be flagged and Codex would continue to iterate until it is remediated.
39:41So that's how we're getting that guide, verify, and solve uh methodology in here.
39:47All right, I'm not going to spend any more time in the terminal.
39:51Um this again is available for you to work on uh at your own leisure.
39:56Uh there's a couple more things in there that you can do like um go ahead and track down some of the remaining issues.
40:04Um if your org has entitlement for context augmentation and energetic analysis uh using that a little bit um but we are able to see that secrets get blocked right we can do find and fix on issues that exist and then new tasks that we're having it do
40:22uh have a much stricter verification layer wrapped around it and thank you very much for waiting through some of the network connectivity issues with this um I want to say that we at Sonar have a booth downstairs.
40:39I would love uh to come and talk to any of you guys.
40:42Would love to chat about either AI related coding or anything outside of that.
40:47Uh feel more than free to come out and say hi to us.
40:50We have swag, we have guitar hero, we are we are um having a party down there.
40:57Um, our uh community that we have, our sonar community, I believe it's community.
41:05Is a great resource if you get stuck working through the repo at all in your own time.
41:09Um, that is where our engineers who build the product are able to answer questions and and help people along um who who run into issues.
41:19But thank you very much for uh listening and working along with me.
41:24And if you guys have any questions, uh, feel free to come up or raise your hand and we can work through that.
41:30Well, again, thank you very much for coming.
41:33My name is Killian, uh, with Sonar and, uh, I hope to see you down at the booth.
41:38Appreciate it.
41:39[applause]
41:54[music]