Unified Language User Guides
iCR User Guide 6.0
iCR User Guide 6.0
  • Table of contents
    • Introduction
    • Overview
    • Authorizing Access to Your Source Code
      • Authenticating GitHub Cloud Access Using OAuth
      • Authenticating GitHub Cloud Access Using PAT
      • Authenticating GitHub Enterprise Access Using OAuth
      • Authenticating GitHub Enterprise Access Using PAT
      • Authenticating GitLab Cloud Access Using OAuth
      • Authenticating GitLab Cloud Access Using PAT
      • Authenticating GitLab Enterprise Access Using OAuth
      • Authenticating GitLab Enterprise Access Using PAT
      • Authenticating Bitbucket Cloud Access using OAuth
    • Using the Navigator
      • Connecting to the Navigator
      • Setting your User Password
      • Updating your User Information
      • The Navigator top banner
      • The Analysis Engine status
      • Selecting Your Source Code
        • Using a cloud-based VCS
        • Selecting your branch
        • Using a private VCS
        • Using a local project
        • Limiting the files to be analyzed
      • Integrating with your bug tracking system
        • Integrating with Jira - Define Your Project
        • Integrating with Jira - Authorizing Access for iCR
        • Integrating with Jira - Connecting with iCR
    • Using the Analysis Engine
      • Initiating an analysis
      • Monitoring the analysis
      • Interrupting the analysis
    • Reviewing your results
      • Reviewer summary and filters
        • Filter by Severity
        • Filter by Category
        • Filter by CWE
        • Filter by OWASP
        • Filter by Directory
      • Reviewing a fix
      • Accepting a fix
        • Accepting a fix when integrated with your bug system
      • Rejecting a fix
        • Rejecting a fix when integrated with your bug system
      • Undoing a fix
        • Undoing a fix when integrated with your bug system
      • Rejected fix history
      • Providing feedback
      • Applying the fixes
      • Cases needing manual attention
      • Comparing Analyses
      • Capturing results for printing or sharing
      • Ending a reviewer session
    • When you are complete
    • Integrating iCR Into Your CI/CD Workflows
      • Jenkins Workflow
        • Installing the plugin
        • Configuring the plugin
          • Creating a Personal Access Token
          • Copying Your Repository's URL
        • Viewing the Results
      • GitHub Actions Workflow
        • GitHub Actions Overview
        • Preparing the GitHub Workflow
          • Environment Variables
          • User Supplied Secrets
          • Setting the User Defined Secrets Values
        • Executing the Workflow
      • GitLab CI/CD Workflow
        • GitLab CI/CD OverView
        • Configuring the GitLab Script variables
          • Environment Variables
          • User Supplied Variables
          • Creating a Personal Access Token
          • Setting the User Defined Variable Values
        • Executing the Workflow
      • Multiple Workflows
    • Appendix – Language Specific Fixer Lists
    • Appendix - Sample Bug Listing
    • Appendix - Getting a BitBucket App Password for JENKINS
Powered by GitBook
On this page
  1. Table of contents

Introduction

NextOverview

Last updated 15 days ago

Thank you for choosing OpenRefactory’s Intelligent Code Repair (iCR). iCR combines source level static analysis and machine learning for examining programs to detect security, reliability, and compliance issues and combines that with behavior-enhancing code refactoring technology to create safe and reliable corrections for those flaws. This results in code free from many serious security vulnerabilities and programming errors.

iCR is offered as an on-demand service, executing on a cloud server such as Amazon‘s AWS or Microsoft's Azure, or an on-premise private platform deployment. Customers can choose to analyze and repair projects which are managed by well accepted cloud-based Version Control Systems such as GitHub, GitLab or Bitbucket, or projects which are copied onto the privately deployed platform.

You system administrator can install iCR on a standard Linux platform such as Ubuntu or RedHat Enterprise Linux (RHEL). You would use either the apt package management system for Debian-base versions of Linux, such as Ubuntu, or RPM/dnf for RHEL operating systems.

To execute iCR on your platform, your administrator will need to obtain a license from OpenRefactory. The license enables the operation of iCR for a maximum number of OpenRefactory Bundled Lines of Code (OBLoCs) for a specified time period. The number of OBLoCs in your license is negotiated with OpenRefactory at the time you purchased your subscription or initiated your Test Drive trial.

The iCR server implements 3 main components:

  • Navigator You use the Navigator to help you to select the projects that you want to make available for processing

  • Analysis Engine The Navigator launches the appropriate analysis engine for any of the offered languages of Java, Python, Go and Rust

  • Reviewer The reviewer is used to browse through the fixes that were generated and uses a “diff” window so that you can see the original code alongside the fixes that were generated. You can also use the Reviewer to browse all the source in the affected file if you wish.

iCR runs as a suite of Docker images. It is expected that your administator has properly configured your server platform with the Docker container infrastructure installed. From the Docker site: “Docker provides a way to run applications securely isolated in a container, packaged with all its dependencies and libraries.” This allows you to install iCR as part of your Development Operations infrastructure with confidence that it will not disrupt your infrastructure. The server may be dedicated hardware within your development network or could be part of a cloud-based development environment.

The iCR server software is installed by the person who will be the Administrator for the iCR service. There is a separate which describes how to install the iCR softwre and how to configure it for users.

This guide will show you how to connect to your version-control system (VCS) with support for GitHub, GitLab and Bitbucket systems. Or you may choose to process projects which are already extracted from the VCS and copied into project folders accessible by the server running iCR.

You select a project for analysis, initiate an analysis of that project, and then review the results. The review process presents to you all the flaws detected and allows you to review each correction whereby you can accept or reject the recommended fix. With the Buddy option, you have additional help with understanding the risk associated with the bug through a more thorough explanation offered by the AI companion as well as improved recommendations for fixing the problem. If you accept an offered fix, you can then incorporate them back into your project.

You may also want to consider integrating iCR into your routine CI/CD workflows. Workflow frameworks for Jenkins, GitHub Actions and GitLab CI/CD are currently supported. The section titled will describe how to prepare and configure the various elements needed to integrate the iCR server into your Jenkins, GitHub Actions or GitLab CI/CD workflows.

User Guide for the Administrator
Integrating iCR Into Your CI/CD Workflows