Skip to content

Project 1: AI-Assisted SQA on Real-World Projects

This assignment is a continuation of Exercise 1 and contributes to the project grade component. In this project, you will apply automated quality assurance, CI/CD security scanning, and modern AI-assisted Software Quality Assurance (SQA) workflows with Model Context Protocol (MCP) to your own past or current software project.

Unlike previous years, this project is an individual assignment. Every student is independently responsible for configuring a CI/CD pipeline, connecting static analysis tools, and orchestrating AI-driven refactoring guarded by automated tests.

Codebase Selection Criteria

You are required to select a medium-sized codebase from your previous coursework (e.g., a project from PPL or Propensi, an ongoing software development work in your current workplace, or an active open-source repository.

Note: if you choose to work on a codebase from your workplace, make sure you asked for permission first since most of the time the codebase is proprietary. The codebase will have to be imported to GitLab CSUI and SonarQube CSUI.

The chosen codebase must meet the following mandatory criteria:

  1. You must be able to build and run the test suite cleanly on your local machine before choosing it. Pretty often you might find an old codebase that you may continue, but the tech stack already old. Please avoid such codebase.
  2. The project must already have an automated unit or integration test suite (e.g., JUnit, pytest, Jest/Vitest, Go test).
  3. The current code coverage must be less than 100%, allowing you to write new automated tests to cover previously untested execution paths.
  4. The project must have identifiable code smells, maintainability issues, or security hotspots that can be flagged by SonarQube.

In addition, this project work will continue on subsequent project assignments. So make sure you choose a codebase that you are familiar working with.

Tasks

Once you have decided on the codebase, do the following tasks:

  1. Fork the original codebase into GitLab CSUI. If the original codebase is already on GitLab CSUI, then you can make the fork as easy as clicking a button. But if the original codebase is located outside of GitLab CSUI, then you need to clone the codebase and push it to GitLab CSUI.
  2. Most importantly, clone the forked codebase to your local development machine. Make sure you can run the project locally, including the test suite.
  3. If the forked codebase originally not from any GitLab instance or does not have any CI/CD pipeline, set up a GitLab CI/CD configuration that automatically build, test, and report the code coverage. Otherwise, update the GitLab CI/CD configuration so it runs properly on your forked codebase and also includes the required CI jobs.
  4. Set up a new SonarQube project on SonarQube CSUI for the forked codebase. Do not forget to update the CI/CD configuration to include a CI job that runs Sonar Scanner after executing the test and coverage reporting.
  5. Set up, at minimum, SAST and Dependency Scanning CI jobs, on the codebase. Feel free to set up other built-in GitLab CI jobs (e.g., DAST, Fuzzy Test) that you feel relevant and useful to your codebase.
  6. Improve the code coverage and quality of the codebase by applying AI-assisted refactoring you practiced in the Exercise 1. For each fix you implement, make sure it is written in a branch and merged to the main via MR. Aim to improve the overall health of your codebase by:
    • Increasing the code coverage, at least 3% to 5%. Or try to cover at least 2 previously untested components if the codebase already had very high coverage.
    • Remediate code quality issues, at least 5 SonarQube issues.
    • Ensure the CI/CD pipelines always passes and maintains a passing Quality Gate on SonarQube CSUI.
  7. Ensure the CI/CD pipelines are still working each time you merged an MR.
  8. Document all attempts to increase code coverage and fix issues into a text document similar to Exercise 1's report.

GenAI Usage Policy

This exercise allows GenAI and LLM tools as learning materials and tools. Even so, it is still imperative for you as course participant of SQA and user of GenAI to factually check the responses generated by GenAI.

The use of GenAI does not mean you can entirely delegate your learning process to GenAI. You enrolled in a course to learn and obtain knowledge and skills. Do not make GenAI to be the one that does the learning, making you as a "meat proxy" for them.

Allowed Uses

  • Querying static analysis data and metrics via MCP servers.
  • Requesting refactoring proposals for identified code smells and rule violations.
  • Directing assistants to execute test suites and self-correct based on test feedback.
  • Asking for explanations of compiler errors, test assertions, or SonarQube rule rationales.
  • (If the imported codebase is not from GitLab CSUI) Draft a GitLab CI/CD configuration for the imported codebase.

Mandatory Requirements

  • All AI-generated changes must be guarded and verified by automated tests.
  • You must critically review all diffs produced by an AI assistant before committing.

Deliverables

At the end of this project, you are required to prepare the following artefacts:

  • A fork repository of project in a namespace on GitLab CSUI.
  • Working CI/CD pipeline configuration (.gitlab-ci.yml) with automated testing, SonarQube, SAST, and Dependency Scanning.
  • Passing Quality Gate on SonarQube CSUI.
  • A written report committed at the root of your repository named PROJECT_1_REPORT.md following the template below.

The due date for Project 1 is: 8 November 2026, 23:55 UTC+7. Submit the URL of your repository to the designated submission slot on SCELE. Please make sure any updates to the repository related to this exercise were made and pushed before the due date.

Report Template

Create a Markdown file named PROJECT_1_REPORT.md at the root of your repository based on the following template:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# Project 1 Report: AI-Assisted SQA on Real-World Projects

- **Name:** <YOUR_NAME>
- **NPM:** <YOUR_NPM>
- **GitLab Repository URL:** <URL>
- **SonarQube Project Key:** <pmpl-2026-project1-YOUR_NPM>

## 1. Project Profile & Baseline Metrics

- **Project Name & Origin:** `<e.g., Koperasi Burhan Sejahtera - Backend>`
- **Technology Stack:** `<e.g., Python 3.12 / Django / pytest>`
- **Baseline Test Coverage:** `<initial percentage>%`
- **Initial SonarQube Metrics:**
  - Code Smells: `<count>`
  - Bugs: `<count>`
  - Vulnerabilities: `<count>`

## 2. Refactoring Log

> In tabular format. The entries in the following table are only example!

| Method | Target Issue / Rule | Refactoring Strategy | Test Verification Result |
| :--- | :--- | :--- | :--- |
| Manual (Step 6.1) | `<Rule Key>` | `<Brief description of fix>` | Passed local test suite on first run. |
| AI Prompt v1 (Step 6.2) | `<Rule Key>` | `<Brief description of fix>` | `<Passed / Failed initial run>` |
| AI Agentic Loop (Step 6.3) | `<Rule Key>` | `<Brief description of fix>` | Passed after `<N>` test iteration(s). |

## 3. MCP Configuration & Tool Inspection

- **MCP Client Used:** `<e.g., VS Code / Antigravity / Codex / Claude>`
- **Observed MCP Tool Calls:**
  - `<e.g., search_sonar_issues_in_projects(...)>`
  - `<e.g., get_component_measures(...)>`

## 4. Prompt Engineering

### Prompt Iteration 1

- **Model Used:** `<e.g., Gemini 3.8 Flash / Claude 5.5 Sonnet / Kimi K2.5>`
- **Prompt Text:**
  > `<Paste your exact prompt>`
- **Assistant Behavior & Tool Usage:** `<Describe what tools were called and what diff was generated.>`
- **Evaluation:** `<Did the code compile? Did existing tests pass without intervention?>`

### Prompt Iteration 2

- **Model Used:** `<e.g., Gemini 3.8 Flash / Claude 5.5 Sonnet / Kimi K2.5>`
- **Prompt Text:**
  > `<Paste your exact prompt>`
- **Assistant Behavior & Tool Usage:** `<Describe what tools were called and what diff was generated.>`
- **Evaluation:** `<Did the code compile? Did existing tests pass without intervention?>`

### Prompt Iteration N

*Follows similar structure as previous iterations*

## 5. Test Coverage & Quality Gate Summary

- **New Tests Added:** `<Describe the modules/methods targeted by new tests>`
- **Final Test Coverage:** `<final percentage>%` (Change: `+<delta>%`)
- **Total Issues Resolved:** `<count>` issues
- **Final Quality Gate Status:** `<Passed / Failed>`

## 6. Reflections & Practical Insights

> Share any interesting technical challenges, nuances when integrating MCP with your stack, or insights on AI-assisted quality assurance on your codebase.
> Write your findings at most three paragraphs and no exceeding one A4 page when the Markdown file is exported to a PDF document.
> **Your report here may be used in the upcoming final exam as part of written notes that you are allowed to peruse during exam.**
Last update: 2026-10-29 11:37:49
Created: 2026-10-29 11:37:49