Code Remediate - Generic Code Analysis & Remediation Platform

A production-ready, pluggable platform for analyzing and remediating code across repositories. Built on a generic architecture that supports any type of code analysis - not limited to vulnerabilities.

🔌 Fully Extensible: Every component (sources, analyzers, remediators, outputs) uses a registry pattern. Add new functionality by implementing an interface and importing it - no core code changes needed.

Table of Contents

• Overview
• Core Architecture
• Quick Start
• Example Use Cases
• Key Features
• Documentation
• Project Structure
• Development
• License

Overview

Code Remediate is a generic platform that orchestrates code analysis and remediation workflows across repositories. It's designed to be extended for any use case:

• Vulnerability scanning and automated patching
• Database connection pooling analysis
• Code quality metrics and fixes
• License compliance checking
• Security scanning and hardening
• API migration assistance
• Custom organization policies

Core Workflow

Source → Search → Analyze → Remediate → Report
   ↓         ↓        ↓          ↓         ↓
GitHub   Find     Detect     Fix      JSON/Table
Local    Files    Issues   Problems   Format

What Makes It Generic

1. Pluggable Analyzers - Detect any code pattern, issue, or metric
2. Pluggable Remediators - Fix, refactor, or transform code in any way
3. Pluggable Sources - Access code from any repository system
4. Pluggable Outputs - Generate reports in any format

Add new capabilities without modifying core code - just implement the interface and import it!

Core Architecture

Four Generic Interfaces

// Analyzer - Analyze code for any purpose
type Analyzer interface {
    Name() string
    AnalyzeFile(ctx, searchResult, content) FileResult
    CanHandle(content) bool
    Priority() int
}

// Remediator - Fix/remediate any code issues
type Remediator interface {
    Name() string
    FixRepository(ctx, source, repo, results) FixResult
    FixFile(ctx, content, result) (string, error)
    CanHandle(result) bool
    Priority() int
}

// CodeSource - Access code from any repository
type CodeSource interface {
    Name() string
    Search(ctx, packages) []SearchResult
    FetchContent(ctx, repo, path) string
    Clone(ctx, repo, destPath) error
}

// Formatter - Output results in any format
type Formatter interface {
    FormatSearch(ctx, results) error
    FormatScan(ctx, fileResults, summary) error
    FormatFixResult(ctx, repo, fixResult) error
}

Registry Pattern

Components auto-register on import:

// In your analyzer package
func init() {
    analyzer.DefaultRegistry.Register("my-analyzer", NewMyAnalyzer)
}

// In main.go
import _ "github.com/you/code-remediate/internal/analyzer/myanalyzer"

No core code changes needed!

Quick Start

Installation

git clone https://github.com/kiran01bm/code-remediate
cd code-remediate
go mod download
go build -o code-remediate .

Basic Usage

# Search for files
./code-remediate --source=github --org=<ORG_NAME> search

# Analyze code
./code-remediate --source=github --org=<ORG_NAME> scan

# Fix issues
./code-remediate --source=github --org=<ORG_NAME> fix --auto-clone --auto-branch

# Scan local repositories
./code-remediate --source=local --path=/path/to/repos scan

Using Makefile

make help                              # Show all targets
make build                             # Build binary
make scan-github ORG=<ORG_NAME>            # Scan GitHub org
make scan-local PATH_LOCAL=/path      # Scan local path
make test                              # Run tests

Example Use Cases

The platform includes example implementations to demonstrate extensibility:

1. Vulnerability Scanner (Implemented)

Detects and fixes vulnerable package versions across Java, Kotlin, Go, JavaScript, and Python.

Features:

• Smart version selection (nearest safe version)
• Multi-language support
• Automated patching with git integration

📖 See: IMPLEMENTATION_VULNERABILITY_SCANNER.md

2. Database Pooling Analyzer (Example)

Analyzes database connection pooling usage across repositories.

Features:

• Detects pooling libraries (HikariCP, c3p0, DBCP2)
• Identifies database types (Aurora, RDS, DynamoDB)
• Flags missing pooling configurations

📖 See: IMPLEMENTATION_DB_POOLING.md

3. Your Custom Use Case

Implement your own analyzer and remediator for any purpose!

Key Features

✅ Generic & Extensible

• Pluggable architecture - extend without modifying core
• Registry pattern - auto-discovery of components
• Priority system - control execution order
• Content routing - route files to appropriate handlers

✅ Multi-Source Support

• GitHub - scan organization repositories
• Local - scan filesystem directories
• Extensible - add GitLab, Bitbucket, Azure DevOps, etc.

✅ Flexible Output

• JSON - machine-readable for automation
• Table - human-readable for terminals
• Extensible - add SARIF, CSV, HTML, etc.

✅ Production Ready

• Rate limiting - automatic backoff and retry
• Error handling - graceful degradation
• Logging - structured logging with zap
• Testing - comprehensive test coverage

✅ Configuration Driven

• JSON config files - define analysis rules
• Environment variables - runtime configuration
• CLI flags - command-line control

Documentation

Main Documentation

• README.md - This file (overview and quick start)
• DESIGN.md - Complete architecture and design patterns
• USAGE.md - Detailed usage guide with examples

Example Implementations

• EXAMPLE_VULNERABILITY_SCANNER.md - Vulnerability scanner implementation
• EXAMPLE_DB_POOLING.md - Database pooling analyzer implementation

Configuration

• input.json - Example configuration file

Project Structure

code-remediate/
├── main.go                    # CLI entry point
├── Makefile                   # Build and operations
├── go.mod                     # Go dependencies
│
├── internal/
│   ├── models/               # Domain models & config
│   ├── scanner/              # Core scanner & interfaces
│   ├── sources/              # Code sources (github, local)
│   │   ├── github/
│   │   └── local/
│   ├── analyzer/             # Analyzers (deps-vuln)
│   │   ├── registry.go       # Analyzer interface & registry
│   │   └── analyzer.go       # Example: dependency vuln analyzer
│   ├── fixer/                # Remediators
│   │   ├── registry.go       # Remediator interface & registry
│   │   └── fixer.go          # Example: dependency vuln remediator
│   ├── output/               # Output formatters
│   │   ├── registry.go       # Formatter interface & registry
│   │   ├── json/
│   │   └── table/
│   └── builder/              # Scanner builder pattern
│
├── README.md                  # This file
├── DESIGN.md                  # Architecture documentation
├── USAGE.md                   # Usage guide
├── EXAMPLE_VULNERABILITY_SCANNER.md
└── EXAMPLE_DB_POOLING.md

Development

Prerequisites

• Go 1.21+ - Required for building
• GitHub CLI - Required for GitHub source (optional)
• Git - Required for fix operations

Build

make build              # Build binary
make dev                # Format, vet, test, build
make test               # Run tests
make test-cover         # Run tests with coverage

Adding a New Analyzer

1. Create analyzer package: internal/analyzer/myanalyzer/myanalyzer.go
2. Implement interface: analyzer.Analyzer
3. Register in init(): analyzer.DefaultRegistry.Register("my-analyzer", NewMyAnalyzer)
4. Import in main.go: import _ "github.com/kiran01bm/code-remediate/internal/analyzer/myanalyzer"
5. Build and use: go build . && ./code-remediate scan

📖 See: DESIGN.md - Extending the Architecture

Adding a New Remediator

1. Create remediator package: internal/fixer/myremediator/myremediator.go
2. Implement interface: fixer.Remediator
3. Register in init(): fixer.DefaultRegistry.Register("my-remediator", NewMyRemediator)
4. Import in main.go: import _ "github.com/kiran01bm/code-remediate/internal/fixer/myremediator"
5. Build and use: go build . && ./code-remediate fix

Adding a New Source

1. Create source package: internal/sources/mysource/mysource.go
2. Implement interface: scanner.CodeSource
3. Register in init(): sources.DefaultRegistry.Register("my-source", NewMySource)
4. Import in main.go: import _ "github.com/kiran01bm/code-remediate/internal/sources/mysource"
5. Use: ./code-remediate --source=my-source scan

Testing

# Run all tests
make test

# Run with coverage
make test-cover

# Run specific package
go test ./internal/analyzer -v

# Run with race detection
go test -race ./...

CI/CD Integration

Integrate into any CI/CD pipeline:

# GitHub Actions
- run: ./code-remediate --source=local --path ${{ github.workspace }} scan

# GitLab CI
script:
  - ./code-remediate --source=local --path $CI_PROJECT_DIR scan

# Jenkins
sh './code-remediate --source=local --path $WORKSPACE scan'

📖 See: USAGE.md - CI/CD Integration

Contributing

Contributions are welcome! The pluggable architecture makes it easy to add new capabilities:

1. Fork the repository
2. Create a feature branch
3. Implement your analyzer/remediator/source
4. Add tests
5. Submit a pull request

License

[Add your license here]

---

Built with ❤️ using Go | Powered by pluggable architecture | Extend without limits