Software Factory

Code Companion - Configuration

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

The configuration of Code Companion has evolved to provide more readable, maintainable, and consistent configuration files. With the transition to YAML as the preferred format, users can benefit from new configuration options while simplifying their setup. This guide will help you migrate existing config.json files to config.yaml, outline new features, and highlight deprecated options.

The transition to YAML includes enhancements that align with future updates, facilitating a smoother integration process. As such, YAML configurations now take precedence over JSON, offering a more robust framework for customization.

Members & Roles

Mon, 01 Jan 0001 00:00:00 +0000

GitLab uses a role-based access model to control what members can see and do within a group or project. Each member is assigned a role that defines their permissions.

Roles Overview

GitLab defines five base roles, from the most restricted to the most privileged:

Role	Typical permissions
Guest	View issues and epics, create issues (project members only)
Reporter	Everything Guest can do, plus manage issues, labels, and milestones
Developer	Everything Reporter can do, plus push code, create MRs, manage branches
Maintainer	Everything Developer can do, plus manage project settings and members
Owner	Full control, including group/project deletion (group level)

Note

GitLab Ultimate also supports custom roles : roles built on top of a base role with additional granular permissions (e.g., a Guest who can also read code). Custom roles are configured at the instance level by a GitLab administrator.

Code Companion - Modes

Mon, 01 Jan 0001 00:00:00 +0000

Modes in Code Companion

Code Companion offers multiple modes for working with your code and interacting with the AI and tools, each for distinct workflows and safety levels. The main modes are Plan, Chat , and Agent.

Plan Mode

Plan Mode is designed for safe, read-only exploration and analysis of your codebase. It restricts the system to non-destructive actions, allowing you to search, read, and analyze code without making changes.

Source Code Management

Mon, 01 Jan 0001 00:00:00 +0000

➡️ For detailed information about SCM Practices, refer to the section SCM Practices .

Organize your repositories

GitLab Group

Groups in GitLab are used to manage multiple projects together that share a common purpose or belong to the same team.

They act as containers that can hold projects, other groups (subgroups), and members.

Key Points:

Project Management: Groups allow you to manage permissions, settings , and access controls across multiple projects.
Collaboration: They facilitate collaboration by grouping related projects and team members together.
Subgroups: Groups can have subgroups, allowing for a nested structure to represent different departments or teams within an organization.

For example, you might have a GitLab Group called “NextGen Radar” that contains separate projects for the application frontend, backend, and content.

Getting Started with VSCode

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Subscribe to Code Companion offer (this requires MFA and a TDF Account ).

Installation

Standard installation (host)

Install and launch VSCode
- Recommended VSCode version: latest
- If you have the Continue.dev extension installed in VSCode, please uninstall or deactivate this extension.
Install Code Companion extension:
- Download the VSIX extension.
- Open VS Code.
- Open the Command Palette:
  - On Windows: Ctrl+ ⇧+ P
  - On macOS: ⌘+ ⇧+ P

Code Companion - Agentic

Mon, 01 Jan 0001 00:00:00 +0000

How Agent Mode Works

Agent mode equips the Chat model with the tools needed to handle a wide range of coding tasks, allowing the model to make decisions and save you the work of manually finding context and performing actions.

Warning

Please note that when working on unusually large projects on IntelliJ, you may experience some interruptions while launching /init command.

Getting Started with JetBrains

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Subscribe to Code Companion offer (this requires MFA and a TDF Account ).

Installation

Install and launch Intellij (or any other IDE from the JetBrains suite)
- If you have the Continue.dev extension installed, please uninstall or deactivate this extension.
Install Code Companion extension:
- Download the extension.
- Open your JetBrains IDE and open Settings using Ctrl+ alt+ S
- Select Plugins on the sidebar and search for “Install Plugin from Disk…” in the settings icon

Code Companion - Rules

Mon, 01 Jan 0001 00:00:00 +0000

How to Create and Manage Rules in Continue

Rules are used to provide system message instructions to the model for Agent mode, Chat mode, and Edit mode requests

Rules provide instructions to the model for Agent mode , Chat , and Edit requests.

Info

Rules are not included in autocomplete

Secrets

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by a non-administrator user in GitLab.

For each item, a concise explanation of its usage and a link to the official documentation are provided.

Quick Selection Guide

Choose the appropriate credential type based on your needs:

Your Need	Recommended Credential
Tokens
Personal development via HTTPS	Personal Access Tokens
Automated access to one project	Project Access Tokens
Automated access across a group/subgroup	Group Access Tokens
Deploy/pull code in production	Deploy Tokens
Access GitLab within pipeline jobs	CI/CD Job Tokens
Keys
Personal development via SSH	SSH Keys
SSH access from external servers	Deploy Keys
CI/CD Variables
Store credentials in pipelines	CI/CD Variables (masked)

Important

Use descriptive names and/or descriptions
Create a new key/token for each use case—don’t reuse tokens across multiple places
Preserve auditability: Individual secret with clear purposes allows you to track usage and quickly identify which secret can be revoked or rotated if needed.

Tokens

Software Factory Recommendations

Define an expiration date according to your operational needs
Select only necessary permissions (use read_repository instead of api when possible)
Use the rotation feature (self_rotate) if available

Personal Access Tokens (PATs)

Personal access tokens serve as authentication credentials that function as password substitutes.

CI/CD

Mon, 01 Jan 0001 00:00:00 +0000

GitLab CI/CD is a robust suite of DevOps tools embedded within GitLab, facilitating the automation of the entire software development lifecycle.

It integrates seamlessly with GitLab repositories, offering a complete pipeline framework to automate the processes of building, testing and deploying code.

Key Concepts and Components

Pipelines: Series of steps that execute in a defined order. Each step performs a specific actions, such as building the code, running tests, or deploying to an environment.
Pipelines could be triggered by various events, such as pushes to the repository, merge requests, or scheduled intervals. You can find a detailed explanation of pipelines .

Code Companion - Plan

Mon, 01 Jan 0001 00:00:00 +0000

Plan Mode in Continue – Safe, Read-Only Code Exploration

Learn how to use Plan Mode in Continue to explore and understand codebases safely with read-only tools, search, and analysis before making changes

What is Plan mode?

Plan mode is a restricted environment that provides read-only access to your codebase. It’s designed for safe exploration, understanding code, and planning changes without making any modifications.

What Are the Key Features of Plan Mode?

Read-only tools: Access files, search, and analyze without risk
Safe exploration: Perfect for understanding unfamiliar codebases
Planning focus: Develop implementation strategies before execution
MCP support: Works with all MCP tools alongside built-in read-only tools

How Plan Mode Works

Plan mode filters the available tools to only include read-only operations. This means you can:

Code Companion - Prompts

Mon, 01 Jan 0001 00:00:00 +0000

How to Create and Manage Prompts

Prompts are used to kick off tasks for Agent mode, Plan mode, and Chat mode

Prompts are included as user messages and are especially useful as instructions for repetitive and/or complex tasks.

Creating Prompts

You can create prompts in two ways:

1. Through the UI

Open the Code Companion sidebar in your IDE.
Go to the Rules section by selecting on the pen icon above the chat.

Code Companion - Chat

Mon, 01 Jan 0001 00:00:00 +0000

Quick Start

Chat makes it easy to ask for help from an AI without leaving your IDE. Get explanations, generate code, and iterate on solutions conversationally.

Basic Usage

1. Start a Conversation

Type your question or request in the chat input and press Enter.

Examples:

“Explain this function”
“How do I handle errors in this code?”
“Generate a test for this component”

2. Include Code Context

Select code in your editor, then use the keyboard shortcut to include it in your chat:

Code Companion - Context Providers

Mon, 01 Jan 0001 00:00:00 +0000

Context Providers

Context Providers allow you to type ‘@’ and see a dropdown of content that can all be fed to the LLM as context. Every context provider is a plugin, which means if you want to reference some source of information that you don’t see here, you can request (or build!) a new context provider.

Migrating from Deprecated Context Providers

If you were previously using the @Codebase or @Docs context providers, here’s how to migrate to the new approach:

Code Companion - Autocomplete

Mon, 01 Jan 0001 00:00:00 +0000

Quick Start

How to use

VSCode

If autocomplete is on, a checkmark will appear in the status panel at the bottom right. If it’s off, a crossed-out circle will appear.

Click the Code Companion button in the status panel at the bottom right of the screen. A drop-down list will open in the search bar at the top. Click on Disable/Enable autocomplete.

Code Companion - Docs

Mon, 01 Jan 0001 00:00:00 +0000

Make Agent Mode Aware of Relevant Documentation

Documentation provides crucial context for agent mode to understand APIs, frameworks, and best practices.

Public Documentation - Rule

To guide agent mode to relevant documentation, you can start by creating a rule , for example:

# Documentation Resources

For framework-specific questions, refer to:

- React: https://react.dev/reference/react
- Next.js: https://nextjs.org/docs
- Tailwind CSS: https://tailwindcss.com/docs

Always cite documentation when explaining concepts.

Public Documentation - Prompt template

We also suggest adding this prompt template so you can automatically generate a documentation rule from any docs URL. Consider this template only a starting point, feel free to modify or extend it to fit your own docs and workflow.

Code Companion - Codebase Awareness

Mon, 01 Jan 0001 00:00:00 +0000

Codebase Awareness

Agent mode works best when it understands the context of your project. This guide shows you how to give agent mode access to codebases, making it more helpful and accurate.

Make Agent Mode Aware of Your Open Codebase

When agent mode understands your current codebase, it can provide more relevant suggestions and answers.

Initialize Codebase Awareness with `/init`

Before agent mode can effectively use your codebase, you can explicitly initialize it with the /init command in the chat input.

Code Companion - Edit

Mon, 01 Jan 0001 00:00:00 +0000

Quick Start

How to use it

Edit is a convenient way to make quick changes to specific code and files. Select code, describe your code changes, and a diff will be streamed inline to your file which you can accept or reject.

Edit is recommended for small, targeted changes, such as

Writing comments
Generating unit tests
Refactoring functions or methods

Highlight code and activate

Highlight the block of code you would like to modify and press cmd/ctrl + i to active Edit mode. You can also enter Edit mode by pressing cmd/ctrl + i with no code highlighted, which will default to editing the current file.

Code Companion - Built-in Tools

Mon, 01 Jan 0001 00:00:00 +0000

Built-in Tools

Tools provide a flexible, powerful way for models to interface with the external world. Code Companion includes several built-in tools which provide the model access to IDE functionality.

1. read_file

Use:
Use this tool if you need to view the contents of an existing file.

Type:
Automatic

Description:
Use this tool if you need to view the contents of an existing file.

Arguments:

filepath (string): The path of the file to read, relative to the root of the workspace (NOT uri or absolute path)

2. create_new_file

Use:
Create a new file. Only use this when a file doesn’t exist and should be created

CASTLE

Mon, 01 Jan 0001 00:00:00 +0000

We’re still working on this page and adding more content. Check back soon for updates!

Platform purpose

CASTLE is a private cloud hosted in Thales, tailored for C3-BS data and data under French export control.

It offers robust protection measures specific to your operational needs.

Usage Limitation

🚧 Section Under Construction

Available services

Service	URL	Availability
GitLab	https://gitlab.tgs.cloud.thales/	GA
Artifactory	https://artifactory.tgs.cloud.thales/	GA
SonarQube	https://sonarqube.tgs.cloud.thales/	GA
Code Companion	N/A	EA

Access and Subscription

Pricing

36€ for Software License + 40€ for platform hosting.

Code Companion - MCP Server

Mon, 01 Jan 0001 00:00:00 +0000

MCP Server

The Model Context Protocol (MCP) server enables connection with external tools, systems, and databases by running MCP-compliant services. This allows for integration, extensibility, and advanced interactions within your development environment.

Warning

MCP server is not available in version 3.x due to security reasons.

Restricted CASTLE (R-CASTLE)

Mon, 01 Jan 0001 00:00:00 +0000

We’re still working on this page and adding more content. Check back soon for updates!

Platform purpose

🚧 Section Under Construction

Usage Limitation

🚧 Section Under Construction

Available services

Service	URL	Availability
GitLab on R-CASTLE	<>
Artifactory on R-CASTLE	<>
Xray on R-CASTLE	<>
SonarQube on R-CASTLE	<>
Coverity on R-CASTLE	<>

Access and Subscription

Pricing

36€ for Software License + 40€ for platform hosting.

Releases

Mon, 01 Jan 0001 00:00:00 +0000

Glossary

Mon, 01 Jan 0001 00:00:00 +0000

Glossary

Mon, 01 Jan 0001 00:00:00 +0000

Troubleshooting Guide

Mon, 01 Jan 0001 00:00:00 +0000

Check the logs

To solve many problems, the first step is reading the logs to find the relevant error message. To do this, follow these steps:

Console logs

In order to view debug logs, which contain extra information, select the dropdown at the top that says “Default levels” and select “Verbose”.

Common issues

Mon, 01 Jan 0001 00:00:00 +0000

Common issues

This section highlights frequent challenges, errors, or obstacles you may encounter while using the Code Companion.

Keyboard shortcuts not resolving

If your keyboard shortcuts are not resolving, you may have other commands that are taking precedence over Code Companion shortcuts. You can see if this is the case, and change your shortcut mappings, in the configuration of your IDE.

Will Code Companion work on a remote SSH configuration or with my WSL?

Yes. Make sure the remote machine whitelists the following endpoints over port 443:

FAQ

Mon, 01 Jan 0001 00:00:00 +0000

General Information

What is the price?

The Code Companion costs only 30€ per user per month with unlimited requests and tokens. Only the systems limits apply. Once your TDF Account is created, the cost will be charged to your entity, like any other license or platform cost.
You can unsubscribe whenever you want on PostIT.

Is there a trial period?

You can request a trial through this form

Why OpenAI? Why not Mistral or others?

OpenAI has the advantage to be available on Azure, meaning it is served as a service and scale. The IS/IT is working on the deployment of Mistral models on premise.

What are the supported languages?

Code Companion is efficient in mainstream languages, particularly in Python, but also in JavaScript, Java, Ada, C, C++, C#, Go, Perl, PHP, Ruby, Swift, TypeScript, Shell, and more. And you can talk to Code Companion in your native language: French, English, German, Spanish or any other.

Is Code Companion searching on the internet?

No, the Code Companion does not search and give result based on live internet information.

What is the difference between Hermes, Code Companion and GitHub Copilot?

Hermes is the previous name for Code Companion, so Hermes = Code Companion.
GitHub Copilot or any other solution using public models can’t be used with C2 data. Only open source C1 data.

Setup and Installation

What IDE can I use?

Only VSCode and JetBrains IDE (IntelliJ, PyCharm) are supported for now. For others (Visual Studio, Eclipse), it’s in the backlog but we’re not working on it for the moment. And nothing is planned for vi, emacs, NetBeans and notepad++.

Is it possible to run it locally (no internet connection)?

It is not yet supported outside of TDP.

Are the updates automatically done?

No, you will need to get the latest manually through our communications since we’re not in the marketplace

Security and Data Sensitivity

What data sensitivity (C2, C3-CA, C3…) can be used on code companion? Is export controlled allowed?

C2 data is supported.
C3-CA (Cloud Authorized - in Azure) is supported.
C3-BS (Business Sensitive - on premise) is entering the Early Adoption phase.
Export controlled data are not allowed.

Code Companion is the only solution validated for Thales Data.

Contact Us

Mon, 01 Jan 0001 00:00:00 +0000

Report a bug or an issue

Encoutering an issue? If you have used Code Companion and encountered a bug, experienced unusual behavior, or simply have a question, please let us know by creating a support ticket:

Create a ticket on Post-it

Show off what you’ve built! Whether you’ve discovered a clever workaround, a creative use case or solved a tough problem, we want to hear your story.

Useful Links

Mon, 01 Jan 0001 00:00:00 +0000

(Un)Subscribe

Code Companion product page

Code Companion - home

FAQ’s

Community

Generative AI Community

ADR

Mon, 01 Jan 0001 00:00:00 +0000

You find here the detailed architecture decision record that references in the TASD .

For information part of theses decision are logged in Lewis Craftsmanship archi decisions list .

ADR001: From services to product to deploy services

Status: Accepted in September 2022

Creation of sf-package in September 2022
Recorded in [SWF organization] in April 2023

Context

Software Factory services available on TDP C2, TDP C3, RTDP.
Code for TDP C2 & TDP C3 + platform is similar (pipeline, terraform for IaaS, helm + kubectl for Kubernetes) but not in only one code base.
Need to merge our different repos.
Need to deploy a Software Factory on CASTLE.
Plan to deploy Country Eyes Only Software Factories.

Decision

New deliverable: a product.
Deploy and update CASTLE with the product (1rst deployment in March 2023).
In the mid/long term, platform TDP C2 & C3 will migrate to the product delivery.
Keep in mind that RTDP is currently directly deployed on a VM and will not be compatible with the product.

Consequences

Put in place Smart Delivery team that will manage the product.

ADR002: Deploy using Flux

Status: Accepted in January 2023

Context

Software Factory product launch.
Deploying SF on TDP C2 & TDP C3-CA with pipelines & runners.
DevOps mode.
Analysis on different deployment mode (DevOps with pipeline, GitOps with Flux / with ArgoCD) + POC.
Pipeline require credential to be external of the Kubernetes Cluster.
Flux deploy and update using one source of trust, and store internally secrets.
GitLab choose Flux.

Decision

Use Flux.

Consequences

Refactor POC to become the product.

ADR003: Add components Black Duck and Synopsys Alert

Status: Accepted in June 2024

SWaaP in EA

Cleaning Up Artifactory

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

Artifactory, as a central repository for managing your organization’s software artifacts, plays a vital role in ensuring efficient development workflows and reliable deployments.

However, with continuous integration and delivery practices, the volume of artifacts stored in Artifactory can grow rapidly, potentially leading to storage constraints and performance issues.

This document outlines best practices and recommendations for implementing effective cleanup strategies within your Artifactory instance.

By proactively managing your artifacts, you can optimize storage utilization, reduce clutter, and maintain a healthy repository that supports your development teams.

Continuous Integration

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Continuous Integration (CI) is a software development practice that has revolutionized how teams build and deliver software.

At its core, CI involves frequently integrating code changes into a shared repository, typically several times a day.

Each integration is verified by an automated build and test process, allowing teams to detect and address issues early in the development cycle.

Continuous Integration is a development practice where team members frequently integrate their work, often daily, resulting in multiple integrations per day.

Documentation

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

Good documentation is essential for projects to be successful. It allows team collaboration and easy onboarding, and preserves valuable knowledge.

GitLab offers a variety of powerful tools to help you document your project comprehensively.

In this guide, we will explore the different options available for project documentation.

By using these tools, you can create clear, accessible, and well-organized documentation.

GitLab Wiki

GitLab Wiki is an integrated feature within GitLab projects providing a collaborative space for teams to write, edit, and organize content.

Documentation Freshness Report

Mon, 01 Jan 0001 00:00:00 +0000

Internal dashboard tracking page freshness across the entire site.

GitLab Documentation

Mon, 01 Jan 0001 00:00:00 +0000

Automated Documentation with Sphinx

Create a .gitlab-ci.yml file if it does not already exist.

Add a job for generating documentation. For example:

stages:
 - build
 - docs

generate_docs:
 stage: docs
 image: sphinxdoc/sphinx
 script:
 - sphinx-build -b html source/ build/html
 artifacts:
 paths:
 - build/html

Configure your pipeline to trigger the documentation generation job on relevant events, such as merging to the main branch or tagging a release.

GitLab pipeline

Mon, 01 Jan 0001 00:00:00 +0000

Keep Your Pipelines Idempotent
Keep Your Pipelines Fast
Use Trusted Docker Images

Test Job Commands Locally

Before running job commands in GitLab, it’s beneficial to perform local tests. This approach offers several advantages:

Detect and correct issues more efficiently.
Minimize the chances of unexpected problems in GitLab.

By focusing on local testing, you can ensure a smoother operation when implementing commands in the GitLab environment. If you need external services to run tests, you can use docker-compose on your local environnement.

GitLab tokens

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

In GitLab, tokens are used to facilitate secure access to the GitLab API, manage permissions, and automate processes. Here are the different types of tokens you might encounter:

Personal Access Tokens: These are user-specific tokens that allow you to authenticate API requests with your user account. They can be scoped to different permissions, such as read or write access to the repository.
Project Access Tokens: These tokens are designed for automated processes within a specific project. They can be used for CI/CD pipelines, allowing services to interact with the project without exposing personal credentials.
Group Access Tokens: These tokens grant access to all projects within a specific group. They are useful for situations where you want to manage permissions across multiple projects efficiently.

How to create a personal Access Token

Here are the steps you typically follow:

LFS

Mon, 01 Jan 0001 00:00:00 +0000

Understanding Git LFS

Git Large File Storage (LFS) is a Git extension that handles large binary files more efficiently by storing them separately from your Git repository.

The problem

Git stores every version of every file. This creates issues with large binary file:

Repository can grow rapidly
Slow clone/fetch operations
Wastes bandwidth and disk space

This becomes a bottleneck in workflows during cloning and fetching repositories with large binary files.

Registry

Mon, 01 Jan 0001 00:00:00 +0000

Overview of Registry

The GitLab Registry is a private registry for storing and managing Docker images and other formats.

It’s built into GitLab. This makes it easy to integrate container image management into your CI/CD workflows.

Store Docker images: Securely store your Docker images within your GitLab project.
CI/CD integration: Build and push images as part of your CI/CD pipelines.
Access control: Control who can access and use your images.

✅ Use the GitLab Registry to manage your container images and streamline your deployment process.

Repo Mirroring

Mon, 01 Jan 0001 00:00:00 +0000

Disclaimer

Each platform choose their limitation to use this feature. Refer to Service per platform .

Software Factory recommends that only platform admins have the privilege to create Mirrors.

Runners

Mon, 01 Jan 0001 00:00:00 +0000

GitLab Runners are essential components of GitLab’s CI/CD system. While your project’s pipeline defines what should be done (build, test, deploy steps), runners are the agents responsible for where and how those jobs are actually executed.

They enable teams to automate processes, enforce consistent environments, and scale their software delivery.

Runners execute your CI/CD job from the following options:

Instance Runners: aka Shared runners Available to all projects in a GitLab instance. For some security reason they may not be available on all platforms . On TDP C2 ,they are provided as a free managed service for quick testing or prototyping.
Managed Dedicated Runners: a managed service that guarantees the best quality of life, freeing time for developpers to focus on their projects.
Self-managed Dedicated Runners: Deploy and manage your own project or group runners on your infrastructure.

Runner Architecture

Runners are installed processes (services or daemons) that interact with the GitLab server.

Sandboxing Issue Triage

Mon, 01 Jan 0001 00:00:00 +0000

This page explains the Issue Sandboxing behavior you will see after the upgrade. This page is designed to help you prepare for the upgrade.

SonarQube 2026.1 LTA — What new to expect

We are upgrading from SonarQube 2025.1 LTA → 2026.1 LTA.

TL;DR

A major LTA-to-LTA upgrade brings a significant number of new and improved rules across all languages.

New issues can appear on code you haven’t touched — either because the analyzers got smarter or because new rules were added to the quality profile.

Search Results

Mon, 01 Jan 0001 00:00:00 +0000

Secrets in Black Duck SCA

Mon, 01 Jan 0001 00:00:00 +0000

API Tokens are the only authentication method available in the Software Factory, for both CI/CD pipelines and API access.

API Tokens

API tokens (referred to as “User Access Tokens” in the Black Duck documentation) are authentication credentials that replace username/password combinations when accessing Black Duck APIs and scanning tools.

API tokens are tied to a specific user account and inherit the same permissions and roles as that user.

Secrets, Tokens and Credentials in Artifactory

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by an administrator user in JFrog Artifactory.

List of credentials

Credentials type	Usage	Official documentation link	Comment
Tokens
Access Token	JWT issued for API auth	Access Tokens
Identity Scoped Token	User‑generated, limited‑permission scoped token	Understanding identity tokens
Admin Scoped Token	Used for elevated administrative capabilities	Create admin scoped token
Project Admin Token	Used to perform project‑level administrative actions	Create project admin token
User Scoped Token	Tied to a specific user, allowing actions based on that user’s existing permissions	Create user scoped token
Group Scoped Token	Group specific token, allowing actions based on groups permissions	Create group scoped token
Keys
SSH Keys	Git LFS Integration/Git Workflows	Manage SSH Keys
Other
Username/password	User Authentication	Security configuration
Multi-factor authentication (MFA)	Higher level of security when accessing JFrog Artifactory	Multi-factor Authentication
mTLS	Mutual TLS authentication via reverse proxy	mTLS
API Keys	REST API authentication	API Key	Deprecated

Note

Not mentioned in the table: all scoped tokens can have a reference token created. It is a shorter 64 character string that references the actual token.

Secrets, Tokens and Credentials in Blackduck

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by an administrator user in Blackduck.

List of credentials

Credentials type	Usage	Official documentation link
Tokens
Access/API Token	JWT issued for API auth	Access Tokens
Other
Username/password	User Authentication	Creating a user account

Credential Configuration Parameters

This section lists all parameters available for credential configuration. Each parameter can be set by an administrator through the Admin Module UI

Secrets, Tokens and Credentials in Coverity

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by an administrator user in Coverity.

List of credentials

Credentials type	Usage	Official documentation link
Tokens
Authentication Keys	API auth and run Coverity analysis from local	Authentication Keys
Other
Username/password	User Authentication	Configuring sign-in settings

Credential Configuration Parameters

This section lists all parameters available for credential configuration. Each parameter can be set by an administrator through the Configuration > System

Secrets, Tokens and Credentials in GitLab

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by an administrator user in GitLab.

List of credentials

Credentials type	Usage	Official documentation link
Tokens
Personal Access Tokens	Authenticate to GitLab API, Git repositories through HTTPS, GitLab registry	Personal Access Tokens
Project access tokens	Access tokens scoped to a project	Project access tokens
Group access tokens	Access tokens scoped yo a group	Group access tokens
Impersonation Tokens	Admin‑created personal access token that lets you authenticate to the GitLab API, repositories, and registry as a specific user	Impersonation tokens
OAuth 2.0 tokens	Allow other services to access the GitLab API on a user’s behalf	OAuth 2.0 tokens
Keys
SSH Keys	Git Workflows	Use SSH Keys
Other
User passwords	User Authentication	Security configuration
Two-factor authentication (2FA)	Additional level of security to GitLab account	Two-factor Authentication

Credential Configuration Parameters

This section lists all parameters available for credential configuration. Each parameter can be set by an administrator through the Admin UI, REST API request, or defined in a configuration file.

Secrets, Tokens and Credentials in SonarQube

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by an administrator user in SonarQube Server.

List of credentials

Credentials type	Usage	Official documentation link	Comment
Tokens
User tokens	Authenticate to SonarQube Web API	User Tokens	Provides traceability and reflects user permissions. Suitable for manual/API usage.
Project analysis tokens	Run analysis on a specific project	Project analysis tokens	Recommended for CI/CD. Limits access to a single project, reducing impact if compromised (least privilege).
Global analysis tokens	Run analysis on all projects	Global analysis tokens	Should not be used by default. Grants access to all projects and violates the principle of least privilege. Use only in exceptional cases where project-scoped tokens cannot be applied.
Other
User passwords	Local user authentication (fallback when SSO is not used)	Changing password	Cannot be fully disabled. Should not be used when SSO is enabled; access must be enforced via external Identity Provider.

Note

SonarQube does not support API Keys or SSH keys. Authentication is primarily handled through tokens and external identity providers.

Secrets, Tokens and Credentials in Artifactory

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by a non-administrator user in JFrog Artifactory.

For each item, a concise explanation of its usage and a link to the official documentation are provided.

Quick Selection Guide

Choose the appropriate credential type based on your needs:

Your Need	Recommended Credential
Tokens
Personal authentication with your permissions	Identity Token
Access scoped to a group	Group-scoped Token
Access scoped to a project role	Project Role Token
Administrative access	Admin Token
Keys
SSH-based access (JFrog CLI, Git LFS, SCP)	SSH Keys
Other methods
Mutual TLS authentication via reverse proxy	Client Certificates (mTLS)
Direct login to web UI	Username and Password

Access Tokens

Description

Access tokens are full JSON Web Tokens (JWT) that can be used for authentication with Artifactory. These tokens are typically longer (700+ characters) and contain embedded claims and permissions.

Secrets, Tokens and Credentials in Coverity

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by a non-administrator user in Coverity.

For each item, a concise explanation of its usage and a link to the official documentation are provided.

Quick Selection Guide

Choose the appropriate credential type based on your needs:

Your Need	Recommended Credential
CI/CD pipelines and automated analysis	Authentication Keys
Command-line operations	Authentication Keys
Direct login to Coverity Connect web UI	Username and Password

Authentication Keys

Authentication keys are cryptographic credentials that provide password-less authentication for command-line operations and CI/CD automation with Coverity Connect.

Secrets, Tokens and Credentials in SonarQube

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by a non-administrator user in SonarQube.

For each item, a concise explanation of its usage and a link to the official documentation are provided.

Type	Description	Details
User Token	Full user-level authentication token, inherits all user permissions	User Token
Project Analysis Token	Scoped token for running analyses on a single project	Project Analysis Token
Global Analysis Token	Token for running analyses on all projects in the instance	Global Analysis Token
Webhook Secret	HMAC-SHA256 secret to verify authenticity of webhook payloads	Webhook Secret
Project Badge Token	Auto-generated token for displaying project metrics badges	Project Badge Token
DevOps Platform PAT	GitLab PAT for project import and Merge Request decoration	DevOps Platform Integration
Login/Password (deprecated)	Legacy authentication method, replaced by tokens	Login/Password

User Token

Description

Authentication token that allows a user to perform all actions the user can do via the web interface, without using their actual credentials (login/password).

What's new

Mon, 01 Jan 0001 00:00:00 +0000

SonarQube has released a new version with exciting features and improvements.

We will discuss some of the key highlights that are activated and available within the Software Factory.

Features to look for in SonarQube Server 2025.1 LTA

For this new major SonarQube Server version the following new features will be available:

Project Administration

Guided configuration of all projects in a monorepo
Flexible main branch designation
Guidance on project onboarding related to new code configuration .

Analyzers, Scanners

Faster analysis bootstrap
Faster scan times
Improved experience for C and C++ analysis
Maven scanner scans all files
New C, C++, and Objective-C GitHub Action

Quality Gates and Quality Profiles

Set rule priority to uphold your coding standards
Updated Sonar Way quality gate condition
Exclude rule from inherited quality profile
Dual operating modes with Standard Experience Mode that preserves familiar rule and issue qualities and severities for users or Multi Quality Rule (MQR) Mode to more accurately represent the impact an issue has on all software qualities

Issues on previous version as 9.9.x

Issue: Refers to a problem or defect detected in the source code that does not comply with a rule. It can potentially impact the quality and maintainability of the software. Here are the 5 common types of issues in SonarQube:

Software Factory

Code Companion - Configuration

Introduction

Members & Roles

Roles Overview

Code Companion - Modes

Modes in Code Companion

Plan Mode

Source Code Management

Organize your repositories

GitLab Group

Getting Started with VSCode

Prerequisites

Installation

Standard installation (host)

Code Companion - Agentic

How Agent Mode Works

Getting Started with JetBrains

Prerequisites

Installation

Code Companion - Rules

How to Create and Manage Rules in Continue

Secrets

Quick Selection Guide

Tokens

Personal Access Tokens (PATs)

CI/CD

Key Concepts and Components

Code Companion - Plan

Plan Mode in Continue – Safe, Read-Only Code Exploration

What is Plan mode?

What Are the Key Features of Plan Mode?

How Plan Mode Works

Code Companion - Prompts

How to Create and Manage Prompts

Creating Prompts

1. Through the UI

Code Companion - Chat

Quick Start

Basic Usage

1. Start a Conversation

2. Include Code Context

Code Companion - Context Providers

Context Providers

Migrating from Deprecated Context Providers

Code Companion - Autocomplete

Quick Start

How to use

Code Companion - Docs

Make Agent Mode Aware of Relevant Documentation

Public Documentation - Rule

Public Documentation - Prompt template

Code Companion - Codebase Awareness

Codebase Awareness

Make Agent Mode Aware of Your Open Codebase

Initialize Codebase Awareness with /init

Code Companion - Edit

Quick Start

How to use it

Highlight code and activate

Code Companion - Built-in Tools

Built-in Tools

1. read_file

2. create_new_file

CASTLE

Platform purpose

Usage Limitation

Available services

Access and Subscription

Pricing

Code Companion - MCP Server

MCP Server

Restricted CASTLE (R-CASTLE)

Platform purpose

Usage Limitation

Available services

Access and Subscription

Pricing

Releases

Glossary

Initialize Codebase Awareness with `/init`