Streaming Code Quality and Security in Healthcare
summary
Roche moves from fragmented workflows to a standardized DevSecOps blueprint that scales across 20,000 developers and ~80 million lines of code, using SonarQube as an independent verification layer and enforcing automated quality gates in CI/CD. The program collapses ~170 bespoke gates into 8–10 standardized gates, drives a reported ~70% codebase reduction, and adds AI detection plus stricter AI quality gates to block low‑quality generated code while keeping developer velocity.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:56Rush Roles: Embedded Security and Compliance
- 1:55Rush Codebase, Tech Stack, and Global Developers
- 2:58Standardizing Quality Gates Across Thousands of Projects
- 4:15Reducing 170 Quality Gates to About 8–10
- 6:17Measuring Project Maturity with Standard Quality Levels
- 7:43Advice: Involve All Stakeholders Early
- 8:57Stricter Gates Reduce Code Duplication and Bloat
- 11:34Compliance and SonarQube as a Verification Layer
- 14:05AI Speeds Development but Raises Governance Needs
- 15:57AI Code Assurance and Stricter Gates for AI Code
- 17:57Balancing AI Productivity with Human Oversight
related talks
37mSecurity as Code: A DevSecOps Approach
11mLove Your Security Engineer as Yourself
42mSecure or Insecure Code, That Is the Question
41mWhat Is Devsecops? Key Steps to Do It Well
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
14mHow Security as Code Transforms Platform Engineering at Scale
57mQuantifiable Quality: The New Standard of Secure Code
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast