The compliance lifecycle¶
Bringing a codebase into conformance with a coding standard is a repeatable loop, not a one-time scan. This page is the map: each step below routes to the page that shows you how. Work through them in order the first time; after that you mostly live in the gate and document steps.
The five steps¶
| Step | What you do | Where |
|---|---|---|
| 1. Choose a standard | Pick the published standard (or subset) your project is obligated to and start from its built-in configuration — the full shipped list is in the standards catalog. | Which standard should I check against? |
| 2. Gate new violations | Run the standard continuously so new violations are caught before they merge — locally in the background and in CI. | Run in the background, Run in CI |
| 3. Baseline existing violations | Accept the current backlog as a baseline so the report focuses on new issues while you burn down the old ones. | Baseline existing violations |
| 4. Document deviations | For violations you accept, record an in-code deviation with rationale so the acceptance is traceable. | Suppress a violation / document a deviation |
| 5. Report for auditors | Generate the per-rule Compliance Report — the deliverable that shows Compliant / Not Compliant / Not Supported for every rule. | Produce a compliance report |
How the steps fit together¶
Gate vs. baseline — they solve different problems
Gating (step 2) stops the backlog from growing: every new commit is checked, and CI fails on fresh violations. Baselining (step 3) hides the pre-existing backlog from the pass/fail signal so the team isn't blocked while it's paid down. Use both together — gate on new, baseline the old.
Deviations are part of the report, not a way around it
A documented deviation doesn't erase a violation; it turns it into an accepted, justified exception. The compliance report pairs the automated Not Compliant and Not Supported rows with your recorded deviations so an auditor sees the full picture — what passed, what needs manual review, and what was consciously accepted and why.
Automate the loop¶
Steps 2 and 5 should run without anyone remembering to click. Wire the standard's configuration into your pipeline so every build re-checks the code and can emit fresh reports:
- End-to-end CI setup: Run Understand in a CI pipeline
- CodeCheck specifically in CI: Run in CI (Jenkins)
- Headless report generation:
und codecheck -reports
If your standard is a safety standard¶
Functional-safety and avionics programs add a tool-qualification obligation on top of the conformance loop above:
- Certification status and the safety manual: Is Understand certified?
- DO-178C / DO-178B tool qualification: DO-178C tool qualification
- Automotive functional safety: ISO 26262 with Understand
- Medical-device software: IEC 62304 with Understand