DevOps & Quality Assurance

Learn how DDEV is making lifes of devs at Jobiqo easier.

Report on leveraging static code analysis in a large-scale Drupal project from a technical and project management perspective

As software engineers it’s our responsibility to incorporate cyber security best practices into the development cycle. In this presentation, I’ll provide a list of resources, best practices, tools and Drupal modules for designing and implementing a more secure Drupal web application and to prepare for penetration testing.

In this talk I’ll present the current state of the software supply chain, the big global recent events (SolarWinds, log4shell, codecov, packagist) and the state of the PHP and Drupal ecosystem, the threats and the mitigations that can be applied using tools like Sigstore, Syft, and Grype for digital signatures, SBOM generation, and automatic vulnerability scanning and how to use them for real-world projects to gain unprecedented levels of knowledge of your digital artifacts. There will be also a demo of the mentioned tools in action to implement a secure supply chain pipeline for your Drupal projects.

Improve your teams' peer code review process, your code maintainability, and your Drupal contributions. Learn from a Drupal core release manager—with over ten years of Drupal core experience—how to give an efficient and effective peer code review.