1. A method (300) for assessing readiness of a software repository (114), the method (300) comprising: receiving (302), by a processor (104), static analysis data (504) comprising a plurality of violations detected in source code of the software repository (114), the static analysis data (504) based on an automated static analysis of the source code, wherein each violation of the plurality of violations is associated with a severity level; determining (304), by the processor (104), a size metric representing a quantity of lines of code in the source code of the software repository (114); computing (306), by the processor (104), a weighted violation aggregate (508) by applying a severity weight corresponding to the severity level of each violation to a violation count associated with each violation, and summing the weighted violation counts across the plurality of violations; calculating (308), by the processor (104), a violation density value (514) by dividing the weighted violation aggregate (508) by a normalized size factor (512) derived from the size metric, wherein the violation density value (514) is independent of an absolute size of the software repository (114); applying (310), by the processor (104), a non-linear penalty function (518) having a configurable calibration constant to the violation density value (514) to generate a penalty score, wherein the non-linear penalty function (518) produces an asymptotic penalty score bounded between a lower bound and an upper bound as the violation density value (514) increases, and wherein the configurable calibration constant controls a steepness of the non-linear penalty function (518); computing (312), by the processor (104), a readiness score for the software repository (114) based on the penalty score; receiving (314), by the processor (104), booster data comprising a plurality of positive code patterns detected in the source code of the software repository (114), computing a booster density value (516) by dividing a weighted booster aggregate (510) by the normalized size factor (512), and computing a booster adjustment value by applying a configurable booster scaling factor to the booster density value (516); generating (316), by the processor (104), a final readiness score by combining the readiness score and the booster adjustment value, wherein the final readiness score is bounded at a predefined maximum value, wherein the source code of the software repository (114) includes one or more programming languages; determining, by the processor (104), the size metric for each programming language, computing the violation density value (514) for each programming language, and aggregating (318) readiness scores across the one or more programming languages to generate a composite readiness score using a lines-of-code proportional weight for each programming language, wherein the readiness score enables comparison of readiness across software repositories (114) of different sizes.

2. The method (300) as claimed in claim 1, wherein the normalized size factor (512) is determined by dividing the quantity of lines of code by a predetermined unit value, such that the violation density value (514) represents a count of weighted violations per the predetermined unit value of lines of code.

3. The method (300) as claimed in claim 1, wherein the non-linear penalty function (518) is determined as: PenaltyScore = ViolationDensity / (ViolationDensity + K) wherein K is the configurable calibration constant, and wherein the non-linear penalty function (518) is monotonically increasing with the violation density value (514) and asymptotically approaches the upper bound as the violation density value (514) increases toward infinity.

4. The method (300) as claimed in claim 3, wherein the readiness score is calculated as: ReadinessScore = MaxScore × (1 − PenaltyScore); wherein, MaxScore is a predefined maximum readiness value.

5. The method (300) as claimed in claim 1, wherein the severity level is selected from a predefined set of severity levels including a critical level, a high level, a medium level, a low level, and an informational level, and wherein each severity level of the predefined set of severity levels is assigned a corresponding severity weight from a configurable set of severity weights stored in a configuration store (222).

6. The method (300) as claimed in claim 1, wherein the final readiness score is calculated as: FinalScore = min (MaxScore, ReadinessScore + BoosterAdjustment) wherein BoosterAdjustment = α × BoosterDensity, and α is the configurable booster scaling factor.

7. The method (300) as claimed in claim 1, wherein each positive code pattern of the plurality of positive code patterns is associated with a booster severity level, and wherein the weighted booster aggregate (510) is computed by applying a booster severity weight corresponding to the booster severity level of each positive code pattern to a booster count associated with each positive code pattern, and summing the weighted booster counts.

8. The method (300) as claimed in claim 1, wherein the method (300) is performed for each assessment domain of a plurality of assessment domains, wherein each assessment domain includes a domain-specific configuration comprising a domain-specific calibration constant, domain-specific severity weights, and a domain-specific booster scaling factor.

9. The method (300) as claimed in claim 8, wherein the plurality of assessment domains includes at least one of: a cloud readiness domain, a containerization readiness domain, a security assessment domain, and a code quality domain.

10. The method (300) as claimed in claim 1, comprising aggregating (324), by the processor (104), readiness scores across a plurality of software repositories (114) within a portfolio to generate a portfolio-level readiness assessment, wherein the readiness scores are comparable across the plurality of software repositories (114) irrespective of respective sizes of the plurality of software repositories (114).

11. The method (300) as claimed in claim 1, wherein the aggregating (318) of readiness scores across the one or more programming languages comprises: applying the lines-of-code proportional weight corresponding to each programming language such that a contribution of each programming language to the composite readiness score is proportional to a relative quantity of lines of code of the programming language within the software repository (114).

12. The method (300) as claimed in claim 1, comprising: generating (322), by the processor (104), a structured output (526) comprising the readiness score and the violation density value (514), and providing the structured output (526) to a consuming application (118) for at least one of: benchmarking, prioritization, or quality gate evaluation.

13. The method (300) as claimed in claim 3, wherein the configurable calibration constant K is adjustable to control sensitivity of the readiness score to changes in the violation density value (514), wherein a lower value of K causes the non-linear penalty function (518) to increase more steeply for lower violation density values, and a higher value of K causes the non-linear penalty function (518) to increase more gradually.

14. The method (300) as claimed in claim 1, wherein the static analysis data (504) is received from one or more automated static code analysis tools (112).

15. A system (100) for assessing readiness of a software repository (114), the system (100) comprising: a processor (104); a non-transitory storage medium (108) storing instructions executable on the processor (104) to: receive static analysis data (504) comprising a plurality of violations detected in source code of a software repository (114), the static analysis data (504) based on an automated static analysis of the source code, wherein each violation of the plurality of violations is associated with a severity level; determine a size metric representing a quantity of lines of code in the source code of the software repository (114) and derive a normalized size factor (512) from the size metric; compute a violation density value (514) based on a weighted violation aggregate (508) divided by the normalized size factor (512), the weighted violation aggregate (508) derived by applying a severity weight corresponding to the severity level of each violation to a violation count associated with each violation, wherein the violation density value (514) is independent of an absolute size of the software repository (114); apply a non-linear penalty function (518) having a configurable calibration constant to the violation density value (514) to generate an asymptotic penalty score bounded between a lower bound and an upper bound, the configurable calibration constant controlling a steepness of the non-linear penalty function (518); compute a readiness score for the software repository (114) based on the asymptotic penalty score; receive booster data comprising a plurality of positive code patterns detected in the source code, compute a booster density value (516) by dividing a weighted booster aggregate (510) by the normalized size factor (512), apply a configurable booster scaling factor to the booster density value (516) to compute a booster adjustment value, and generate a final readiness score bounded at a predefined maximum value by combining the readiness score and the booster adjustment value; and determine the size metric for each programming language when the source code comprises one or more programming languages, compute the violation density value (514) for each programming language, and aggregate readiness scores across the one or more programming languages to generate a composite readiness score using a lines-of-code proportional weight for each programming language, wherein the composite readiness score enables comparison of readiness across software repositories (114) of different sizes.

16. The system (100) as claimed in claim 15, wherein the non-linear penalty function (518) is defined as PenaltyScore = ViolationDensity / (ViolationDensity + K), wherein K is the configurable calibration constant, and the readiness score is calculated as ReadinessScore = MaxScore × (1 − PenaltyScore).

17. The system (100) as claimed in claim 15, wherein the program instructions are executable on the processor (104) to perform readiness assessment across a plurality of assessment domains, each assessment domain of the plurality of assessment domains having a domain-specific configuration comprising a domain-specific calibration constant, domain-specific severity weights, and a domain-specific booster scaling factor.

18. The system (100) as claimed in claim 15, wherein the severity level is selected from a predefined set of severity levels comprising a critical level, a high level, a medium level, a low level, and an informational level, and wherein each severity level of the predefined set of severity levels is assigned a corresponding severity weight from a configurable set of severity weights.

19. A non-transitory computer readable storage medium (108) comprising program instructions that when executed cause a processor (104) to: receive static analysis data (504) comprising a plurality of violations detected in source code of a software repository (114) written in one or more programming languages, wherein each violation of the plurality of violations is associated with a severity level; determine a size metric representing a quantity of lines of code in the source code of the software repository (114), and derive a normalized size factor (512) from the size metric; compute a violation density value (514) that is independent of an absolute size of the software repository (114), the violation density value (514) based on a weighted violation aggregate (508) divided by the normalized size factor (512); apply a non-linear penalty function (518) having a configurable calibration constant to the violation density value (514) to generate an asymptotic penalty score bounded between a lower bound and an upper bound, the configurable calibration constant controlling a steepness of the non-linear penalty function (518); compute a readiness score for the software repository (114) based on the asymptotic penalty score; receive booster data comprising a plurality of positive code patterns detected in the source code, compute a booster density value (516) by dividing a weighted booster aggregate (510) by the normalized size factor (512), apply a configurable booster scaling factor to the booster density value (516) to compute a booster adjustment value, and generate a final readiness score bounded at a predefined maximum value by combining the readiness score and the booster adjustment value; and determine the size metric for each programming language of the one or more programming languages, compute the violation density value (514) for each programming language, and aggregate readiness scores across the one or more programming languages to generate a composite readiness score using a lines-of-code proportional weight for each programming language, wherein the composite readiness score enables comparison of readiness across software repositories (114) of different sizes.

20. The non-transitory computer readable storage medium (108) as claimed in claim 19, wherein the non-linear penalty function (518) is defined as PenaltyScore = ViolationDensity / (ViolationDensity + K), wherein K is the configurable calibration constant, and the readiness score is calculated as ReadinessScore = MaxScore × (1 − PenaltyScore), and wherein the instructions further cause the processor (104) to perform readiness assessment for each assessment domain of a plurality of assessment domains, each assessment domain having a domain-specific configuration comprising a domain-specific calibration constant, domain-specific severity weights, and a domain-specific booster scaling factor. Dated this 06th day of March 2026 BALIP AMIT ABASAHEB [IN/PA-5184] Authorized Patent Agent of the Applicant

Description:FIELD OF THE INVENTION
[0001] The present invention relates generally to the field of software quality assessment and application modernization analytics. More specifically, the present invention pertains to a system and method for assessing readiness of a software repository.
BACKGROUND FOR THE INVENTION:
[0002] Software quality assessment has become increasingly critical as organizations undertake large-scale application modernization initiatives including cloud migration, containerization, and code quality evaluation. Organizations typically maintain portfolios comprising hundreds or thousands of software repositories ranging from a few thousand lines of code to over one million lines of code. Accurate assessment of the readiness of each software repository for modernization is essential for effective portfolio management, resource allocation, and migration planning.
[0003] However, existing software quality assessment methods suffer from several significant limitations. A limitation in the existing software quality assessment is size bias in quality assessment. Larger software repositories inherently contain higher absolute violation counts than smaller software repositories, even when the violation density of the larger software repository is lower than the violation density of the smaller software repository. Traditional assessment tools that rely on absolute violation counts produce scores that penalize larger software repositories disproportionately, leading to inaccurate quality comparisons across a portfolio of software repositories of varying sizes.
[0004] Another limitation in the existing software quality assessment is the inability to produce comparable scores across software repositories of different sizes. A software repository with ten violations in one thousand lines of code and a software repository with one hundred violations in ten thousand lines of code may have identical violation densities, yet existing tools may assign substantially different quality scores to the two software repositories. The absence of size normalization prevents organizations from establishing meaningful, universal readiness thresholds that apply fairly across all software repositories in a portfolio.
[0005] Yet another limitation of existing tools is the use of linear penalty models for violations. In linear penalty models, each additional violation contributes equally to the quality degradation regardless of the current violation density. Linear penalty models do not accurately reflect real-world quality degradation, where the initial violations in a clean codebase have less practical impact than the same number of violations in an already-degraded codebase. The linear penalty models also lack bounded behaviour, potentially producing negative or meaningless scores for software repositories with high violation counts.
[0006] Another limitation is that traditional assessment tools only penalize violations without recognizing or rewarding positive code patterns and practices. Existing tools produce one-dimensional assessments that fail to capture the full quality picture of a software repository. A software repository that exhibits strong coding patterns alongside some violations may, in practice, demonstrate higher readiness than a software repository with fewer violations but no positive patterns.
[0007] Yet another limitation is the inability of existing tools to adapt quality metrics to different assessment contexts and organizational priorities. Different assessment domains such as cloud readiness, containerization readiness, security assessment, and code quality assessment require different evaluation parameters, penalty sensitivities, and weighting schemes. Existing tools typically apply a single, fixed evaluation methodology across all assessment contexts.
[0008] In view of the above limitations, there exists a need for an improved software readiness assessment system that provides normalized, repository-size independent readiness scores.

OBJECTS OF THE INVENTION:
[0009] An object of the present invention is to provide a system and method for assessing readiness of a software repository by normalizing violation counts based on repository size to produce readiness scores that are independent of the absolute size of the software repository.
[0010] Another object of the present invention is to apply a non-linear asymptotic penalty function to a violation density value, wherein the non-linear penalty function produces bounded penalty scores that reflect real-world quality degradation patterns and prevent unbounded penalty accumulation.
[0011] Another object of the present invention is to provide dual-polarity assessment by recognizing both negative violations and positive code patterns through a booster mechanism, enabling balanced evaluation that rewards good coding practices alongside penalizing anti-patterns.
[0012] Another object of the present invention is to support multi-domain assessment with domain-specific configurable parameters including a domain-specific calibration constant, domain-specific severity weights, and a domain-specific booster scaling factor.
[0013] Another object of the present invention is to enable meaningful cross-repository benchmarking and portfolio-level readiness assessment across a portfolio of software repositories of varying sizes.
[0014] Another object of the present invention is to support multi-language source code assessment by computing violation density values independently for each programming language and aggregating readiness scores using lines-of-code proportional weights.
SUMMARY OF THE INVENTION:
[0015] The present invention provides a system and method for assessing readiness of a software repository through violation density normalization, non-linear penalty transformation, and dual-polarity scoring. In accordance with the present invention, a processor receives static analysis data from the source code of a software repository. The static analysis data comprises a plurality of violations detected in the source code. Each violation of the plurality of violations is associated with a severity level. The severity level indicates a degree of impact of the violation on the readiness of the software repository. The processor further determines a size metric for the source code of the software repository. The size metric represents a quantity of lines of code present in the source code.
[0016] The processor computes a weighted violation aggregate from the plurality of violations. The weighted violation aggregate is computed by applying a severity weight to each violation. The severity weight corresponds to the severity level of the respective violation. Each violation has a violation count associated with it. The severity weight is applied to the violation count of each violation to produce a weighted violation count. The weighted violation counts are summed across the plurality of violations to produce the weighted violation aggregate.
[0017] The processor calculates a violation density value from the weighted violation aggregate. The violation density value is calculated by dividing the weighted violation aggregate by a normalized size factor. The normalized size factor is derived from the size metric. The violation density value thereby represents a density of weighted violations relative to the size of the source code. The violation density value is independent of an absolute size of the software repository.
[0018] The processor applies a non-linear penalty function to the violation density value to generate a penalty score. The non-linear penalty function includes a configurable calibration constant. The configurable calibration constant controls steepness of the non-linear penalty function. The non-linear penalty function produces an asymptotic penalty score. The asymptotic penalty score is bounded between a lower bound and an upper bound as the violation density value increases. The processor computes a readiness score for the software repository based on the penalty score. The readiness score enables comparison of readiness across software repositories of different sizes.
[0019] In one implementation, the non-linear penalty function is defined as PenaltyScore = ViolationDensity / (ViolationDensity + K). K is the configurable calibration constant. A lower value of K causes the non-linear penalty function to increase more steeply for lower violation density values. A higher value of K causes the non-linear penalty function to increase more gradually. The readiness score is calculated as ReadinessScore = MaxScore × (1 − PenaltyScore). MaxScore is a predefined maximum readiness value.
[0020] In one implementation, the method further includes receiving booster data from the source code of the software repository. The booster data comprises a plurality of positive code patterns detected in the source code. Each positive code pattern is associated with a booster severity level. The processor computes a weighted booster aggregate by applying a booster severity weight to a booster count for each positive code pattern. The processor calculates a booster density value by dividing the weighted booster aggregate by the normalized size factor. A booster adjustment value is computed by applying a configurable booster scaling factor to the booster density value. A final readiness score is generated by adding the booster adjustment value to the readiness score. The final readiness score is bounded at a predefined maximum value.
[0021] In one implementation, the source code of the software repository comprises one or more programming languages. The processor determines the size metric for each programming language of one or more programming languages. The processor computes the violation density value for each programming language. The readiness scores across the one or more programming languages are aggregated to generate a composite readiness score for the software repository. The aggregation uses a lines-of-code proportional weight for each programming language.

BRIEF DESCRIPTION OF DRAWINGS:
[0022] Fig. 1 illustrates a system architecture for assessing readiness of a software repository, in accordance with an implementation of the present invention.
[0023] Fig. 2 illustrates a block diagram showing different components of the system for assessing readiness of a software repository, in accordance with an implementation of the present invention.
[0024] Fig. 3 illustrates a flowchart showing a method for assessing readiness of a software repository, in accordance with an implementation of the present invention.
[0025] Fig. 4 illustrates a graph showing a non-linear asymptotic penalty curve and corresponding readiness score curve as a function of violation density, in accordance with an implementation of the present invention.
[0026] Fig. 5 illustrates a data flow diagram showing processing of static analysis data through violation density normalization, penalty curve transformation, booster integration, and multi-language aggregation, in accordance with an implementation of the present invention.
DETAILED DESCRIPTION OF DRAWINGS:
[0027] The embodiments herein and the various features and advantageous details thereof are explained more fully with reference to the non-limiting embodiments and detailed in the following description. Descriptions of well-known components and processing techniques are omitted so as not to unnecessarily obscure the embodiments herein. The examples used herein are intended merely to facilitate an understanding of ways in which the embodiments herein may be practiced and to further enable those of skill in the art to practice the embodiments herein. Accordingly, the examples should not be construed as limiting the scope of the embodiments herein.
[0028] Some embodiments of this disclosure, illustrating all its features, will now be discussed in detail. The words "receiving", "mapping", "determining", "calculating", "computing", "applying", and "generating" and other forms thereof, are intended to be open ended in that an item or items following any one of these words is not meant to be an exhaustive listing of such item or items or meant to be limited to only the listed item or items. It must also be noted that as used herein and in the appended claims, the singular forms "a," "an," and "the" include plural references unless the context clearly dictates otherwise. The terms "comprises," "comprising," "has," "having," "includes" and/or "including" as used herein, specify the presence of stated features, elements, and/or components and the like, but do not preclude the presence or addition of one or more other features, elements, components and/or combinations thereof. The term "an embodiment" is to be read as "at least one embodiment." The term "another embodiment" is to be read as "at least one other embodiment." Although any methods and systems similar or equivalent to those described herein can be used in the practice or testing of embodiments of the present disclosure, the exemplary methods and systems are now described.
[0029] The disclosed embodiments are merely examples of the disclosure, which may be embodied in various forms. Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure is not intended to be limited to the embodiments described but is to be accorded the widest scope consistent with the principles and features described herein.
[0030] Fig. 1 illustrates a system (100) for assessing readiness of a software repository, in accordance with an implementation of the present invention. The system (100) includes a memory (102), a processor (104), and a communication module (106), which operate collectively to transform static analysis data into normalized, repository-size independent readiness scores. The system (100) may be implemented over a cloud network, an on-premises server, or a combination thereof.
[0031] The system (100) further includes a non-transitory computer readable storage medium (108) configured to store machine readable instructions that, when executed by the processor (104), cause the processor (104) to perform all readiness assessment operations described herein. The system (100) further includes an interface (110) configured to provide input and output capabilities. The interface (110) may be implemented as a web-based graphical user interface, a command line interface, or an application programming interface.
[0032] The system (100) is communicatively connected through network (116) to one or more static code analysis tools (112) and to one or more software repositories (114-1 to 114-n, generally referred to as software repositories 114). The one or more static code analysis tools (112) perform automated static analysis of source code within the software repositories (114) and generate static analysis data comprising a plurality of violations detected in the source code. Each software repository of the software repositories (114) may contain source code written in one or more programming languages and may range in size from a few thousand lines of code to over one million lines of code.
[0033] The system (100) may further communicate with one or more consuming applications (118) through the network (116). The one or more consuming applications (118) may include continuous integration and continuous deployment pipelines, quality dashboards, and quality gate evaluation systems. The system (100) provides structured output comprising readiness scores and violation density values to the one or more consuming applications (118) for benchmarking, prioritization, and quality gate evaluation.
[0034] Fig. 2 illustrates a block diagram showing different components of the system (100) for assessing readiness of a software repository, in accordance with an implementation of the present invention. The system (100) includes the interface (110), the processor (104), and the memory (102). The interface (110) is communicatively coupled to the processor (104) for transmitting and receiving data. The processor (104) is communicatively coupled to the memory (102) for executing program instructions stored in the memory (102). The memory (102) stores program instructions for performing various readiness assessment operations. A detailed functioning of each set of program instructions stored in the memory (102) is provided henceforth.
[0035] The memory (102) stores program instructions to receive static analysis data (202). The program instructions to receive static analysis data (202) may cause the processor (104) to receive static analysis data from the one or more static code analysis tools (112) through the communication module (106) and the network (116). The static analysis data includes a plurality of violations detected in source code of the software repository (114), wherein each violation of the plurality of violations is associated with a severity level. The severity level may be selected from a predefined set of severity levels comprising a critical level, a high level, a medium level, a low level, and an informational level. Each violation of the plurality of violations is further associated with a rule that identifies the coding standard, security requirement, or quality criterion that the violation represents. The program instructions to receive static analysis data (202) may further cause the processor (104) to receive booster data comprising a plurality of positive code patterns detected in the source code of the software repository (114), wherein each positive code pattern of the plurality of positive code patterns is associated with a booster severity level. The positive code patterns represent good coding practices, design patterns, and quality indicators that demonstrate readiness for modernization.
[0036] The memory (102) further stores program instructions to determine a size metric and compute a weighted violation aggregate (204). The program instructions (204) may cause the processor (104) to determine a size metric representing a quantity of lines of code in the source code of the software repository (114). When the source code of the software repository (114) comprises one or more programming languages, the program instructions (204) may cause the processor (104) to determine the size metric separately for each programming language of the one or more programming languages. The program instructions (204) may further cause the processor (104) to compute a weighted violation aggregate by applying a severity weight corresponding to the severity level of each violation to a violation count associated with each violation, and summing the weighted violation counts across the plurality of violations.
[0037] In one implementation, the severity weight for each severity level may be configurable and stored in a configuration store (222). For example, a critical level may be assigned a severity weight of ten, a high level may be assigned a severity weight of six, a medium level may be assigned a severity weight of three, a low level may be assigned a severity weight of one, and an informational level may be assigned a severity weight of zero. The program instructions (204) may further cause the processor (104) to compute a weighted booster aggregate by applying a booster severity weight corresponding to the booster severity level of each positive code pattern to a booster count associated with each positive code pattern, and summing the weighted booster counts.
[0038] The memory (102) further stores program instructions to calculate a violation density value (206). The program instructions to calculate the violation density value (206) may cause the processor (104) to divide the weighted violation aggregate by a normalized size factor derived from the size metric. The normalized size factor is calculated by dividing the quantity of lines of code by a predetermined unit value, such as one thousand, such that the violation density value represents a count of weighted violations per one thousand lines of code. The violation density value produced by the program instructions to calculate the violation density value (206) is independent of an absolute size of the software repository (114), thereby eliminating the size bias present in traditional assessment methods. The program instructions to calculate the violation density value (206) may further cause the processor (104) to calculate a booster density value by dividing the weighted booster aggregate by the normalized size factor. The booster density value uses the same per-thousand-lines-of-code normalization as the violation density value, ensuring consistent size-independent treatment of both violations and positive code patterns.
[0039] The memory (102) further stores program instructions to apply a non-linear penalty function and compute a readiness score (208). The program instructions (208) may cause the processor (104) to apply a non-linear penalty function having a configurable calibration constant K to the violation density value to generate a penalty score. The non-linear penalty function produces an asymptotic penalty score bounded between a lower bound of zero and an upper bound of one hundred as the violation density value increases. In one implementation, the non-linear penalty function is defined as PenaltyScore = ViolationDensity / (ViolationDensity + K), wherein K is the configurable calibration constant controlling a steepness of the non-linear penalty function. The non-linear penalty function is monotonically increasing with the violation density value and asymptotically approaches the upper bound as the violation density value increases toward infinity. A lower value of K causes the non-linear penalty function to increase more steeply for lower violation density values, and a higher value of K causes the non-linear penalty function to increase more gradually. The configurable calibration constant K is retrieved from the configuration store (222) and may be domain specific.
[0040] The program instructions (208) may further cause the processor (104) to compute a readiness score for the software repository (114) based on the penalty score. In one implementation, the readiness score is calculated as ReadinessScore = MaxScore × (1 − PenaltyScore), wherein MaxScore is a predefined maximum readiness value such as one hundred. The readiness score enables comparison of readiness across software repositories of different sizes.
[0041] The memory (102) further stores program instructions to compute a booster adjustment and generate a final readiness score (210). The program instructions (210) may cause the processor (104) to compute a booster adjustment value by applying a configurable booster scaling factor α to the booster density value calculated by the program instructions to calculate the violation density value (206). The configurable booster scaling factor α is retrieved from the configuration store (222) and may be domain specific. The program instructions (210) may further cause the processor (104) to generate a final readiness score by combining the readiness score computed by the program instructions (208) and the booster adjustment value. In one implementation, the final readiness score is calculated as FinalScore = min (MaxScore, ReadinessScore + BoosterAdjustment), wherein BoosterAdjustment = α × BoosterDensity. The final readiness score is bounded at a predefined maximum value to prevent score inflation beyond the maximum scale. The dual-polarity nature of the final readiness score, which accounts for both penalty from violations and reward from positive code patterns, provides a more comprehensive assessment of software readiness than single-polarity methods that only penalize violations.
[0042] The memory (102) further stores program instructions for multi-language aggregation (212). The program instructions for multi-language aggregation (212) may cause the processor (104) to determine the size metric for each programming language when the source code of the software repository (114) comprises one or more programming languages, compute the violation density value for each programming language, and aggregate readiness scores across the one or more programming languages to generate a composite readiness score using a lines-of-code proportional weight for each programming language. The lines-of-code proportional weight corresponding to each programming language ensures that the contribution of each programming language to the composite readiness score is proportional to the relative quantity of lines of code of the programming language within the software repository (114). For example, if a software repository (114) comprises sixty thousand lines of Java code and forty thousand lines of Python code, the Java readiness score contributes sixty percent and the Python readiness score contributes forty percent to the composite readiness score.
[0043] The memory (102) further stores program instructions for domain-specific configuration (214). The program instructions for domain-specific configuration (214) may cause the processor (104) to perform readiness assessment for each assessment domain of a plurality of assessment domains. Each assessment domain has a domain-specific configuration comprising a domain-specific calibration constant, domain-specific severity weights, and a domain-specific booster scaling factor. The domain-specific configuration may enable the system (100) to evaluate the same software repository (114) against multiple assessment criteria, with each assessment domain applying evaluation parameters tuned to the specific requirements of the assessment domain. In one implementation, the plurality of assessment domains comprises at least one of a cloud readiness domain, a containerization readiness domain, a security assessment domain, and a code quality domain. The domain-specific configurations are stored in the configuration store (222).
[0044] The memory (102) further stores program instructions to generate a structured output (216). The program instructions to generate the structured output (216) may cause the processor (104) to generate a structured output comprising the readiness score, the violation density value, the booster density value, and the final readiness score. The program instructions to generate the structured output (216) may further cause the processor (104) to provide the structured output to one or more consuming applications (118) for at least one of benchmarking, prioritization, or quality gate evaluation. The structured output may be formatted in a machine-readable data format suitable for integration with continuous integration and continuous deployment pipelines, quality dashboards, and automated reporting systems.
[0045] The memory (102) further stores program instructions for portfolio-level aggregation (218). The program instructions for portfolio-level aggregation (218) may cause the processor (104) to aggregate readiness scores across a plurality of software repositories (114) within a portfolio to generate a portfolio-level readiness assessment. The readiness scores produced by the system (100) are independent of the absolute size of each software repository (114). The readiness scores are therefore comparable across the plurality of software repositories (114) irrespective of the respective sizes of the plurality of software repositories (114). The portfolio-level readiness assessment may enable organizations to identify which software repositories (114) within the portfolio require the most attention, to prioritize modernization efforts, and to track readiness improvement over time.
[0046] The memory (102) further stores a configuration store. The configuration store may store configurable parameters including severity weights for each severity level, the configurable calibration constant K for each assessment domain, the configurable booster scaling factor α for each assessment domain, and domain-specific weight sets. The configuration store may be communicatively accessible by the program instructions (204), (206), (208), (210), and (214) for retrieving assessment parameters during readiness assessment operations. The configuration store may enable organizations to customize assessment parameters based on organizational priorities and assessment contexts without modifying the underlying assessment logic of the system (100).
[0047] Fig. 3 illustrates a flowchart showing a method (300) for assessing readiness of a software repository, in accordance with an implementation of the present invention. The method (300) comprises multiple coordinated steps executed by the system (100). The method (300) may be described with reference to the system (100) components described in fig. 1 and fig. 2.
[0048] At step (302), the processor (104) receives static analysis data from the source code of the software repository (114). The static analysis data includes a plurality of violations detected in the source code. The static analysis data may be based on an automated static analysis of the source code performed by the one or more static code analysis tools (112). Each violation of the plurality of violations is associated with a severity level selected from a predefined set of severity levels. At step (304), the method (300) proceeds with determining, by the processor (104), a size metric representing a quantity of lines of code in the source code of the software repository (114). The source code of the software repository (114) may include one or more programming languages. In such an implementation, the processor (104) may determine the size metric separately for each programming language.
[0049] At step (306), the method (300) continues with computing, by the processor (104), a weighted violation aggregate by applying a severity weight corresponding to the severity level of each violation to a violation count associated with each violation, and summing the weighted violation counts across the plurality of violations. Each severity level of the predefined set of severity levels may be assigned a corresponding severity weight from a configurable set of severity weights stored in the configuration store (226). At step (308), the processor (104) calculates a violation density value. The violation density value is calculated by dividing the weighted violation aggregate by a normalized size factor. The normalized size factor is derived from the size metric. The normalized size factor may be calculated by dividing the quantity of lines of code by a predetermined unit value such as one thousand. The violation density value is independent of an absolute size of the software repository (114).
[0050] At step (310), the method (300) continues with applying, by the processor (104), a non-linear penalty function having a configurable calibration constant K to the violation density value to generate a penalty score. The non-linear penalty function produces an asymptotic penalty score bounded between a lower bound and an upper bound as the violation density value increases. The configurable calibration constant K controls a steepness of the non-linear penalty function. In one implementation, the non-linear penalty function is defined as PenaltyScore = ViolationDensity / (ViolationDensity + K).
[0051] At step (312), the method (300) proceeds with computing, by the processor (104), a readiness score for the software repository (114) based on the penalty score. In one implementation, the readiness score is calculated as ReadinessScore = MaxScore × (1 − PenaltyScore), wherein MaxScore is a predefined maximum readiness value. At step (314), the method (300) continues with receiving, by the processor (104), booster data comprising a plurality of positive code patterns detected in the source code of the software repository (114). The processor (104) computes a booster density value by dividing a weighted booster aggregate by the normalized size factor, and computes a booster adjustment value by applying a configurable booster scaling factor α to the booster density value.
[0052] At step (316), the method (300) proceeds with generating, by the processor (104), a final readiness score by combining the readiness score and the booster adjustment value. The final readiness score is bounded at a predefined maximum value. In one implementation, the final readiness score is calculated as FinalScore = min (MaxScore, ReadinessScore + BoosterAdjustment), wherein BoosterAdjustment = α × BoosterDensity.
[0053] At step (318), the method (300) continues with aggregating readiness scores across the one or more programming languages to generate a composite readiness score using a lines-of-code proportional weight for each programming language. The contribution of each programming language to the composite readiness score is proportional to the relative quantity of lines of code of the programming language within the software repository (114). At step (320), the method (300) proceeds with generating a structured output comprising the readiness score and the violation density value, and providing the structured output to one or more consuming applications (118) for at least one of benchmarking, prioritization, or quality gate evaluation.
[0054] Fig. 4 illustrates a graph (400) showing a non-linear asymptotic penalty curve and a corresponding readiness score curve as a function of violation density, in accordance with an implementation of the present invention. The horizontal axis of the graph (400) represents the violation density measured as weighted violations per one thousand lines of code. The vertical axis of the graph (400) represents the score value expressed as a percentage.
[0055] The graph (400) depicts the penalty score curve as a monotonically increasing curve that starts at zero when the violation density is zero and asymptotically approaches one hundred percent as the violation density increases toward infinity. For a configurable calibration constant K equal to ten, the penalty score reaches fifty percent when the violation density equals ten, demonstrating that the configurable calibration constant K determines the violation density at which the penalty score reaches fifty percent of the upper bound.
[0056] The graph (400) further depicts the readiness score curve as a monotonically decreasing curve that starts at one hundred when the violation density is zero and asymptotically approaches zero as the violation density increases toward infinity. The readiness score curve represents the complement of the penalty score curve, calculated as ReadinessScore = MaxScore × (1 − PenaltyScore). The non-linear behaviour of the penalty curve ensures that initial violations have proportionally less impact on the readiness score than violations accumulated in software repositories that already exhibit high violation density.
[0057] Fig. 5 illustrates a data flow diagram (500) showing processing of static analysis data through the readiness assessment pipeline, in accordance with an implementation of the present invention. The data flow diagram (500) depicts the transformation of input data through sequential processing stages to produce normalized readiness scores.
[0058] The data flow diagram (500) begins with input data comprising a source code repository (502), static analysis data (504), a configuration store (226), and lines-of-code data per language (506). The static analysis data (504) is processed through a weighted violation aggregate stage (508) and a weighted booster aggregate stage (510) using severity weights from the configuration store (226) and a normalized size factor (512) derived from the lines-of-code data per language (506).
[0059] The weighted violation aggregate (508) and the normalized size factor (512) are processed through a violation density stage (514) that produces a violation density value. Similarly, the weighted booster aggregate (510) and the normalized size factor (512) are processed through a booster density stage (516) that produces a booster density value. Both the violation density value and the booster density value may be normalized on a per-thousand-lines-of-code basis, ensuring consistent size-independent treatment.
[0060] The violation density value is processed through a non-linear penalty function stage (518) using the configurable calibration constant K from the configuration store (226) to produce a penalty score and a readiness score. The readiness score and the booster density value may be then processed through a score aggregation stage (520) using the configurable booster scaling factor α to produce the final readiness score.
[0061] The final readiness score may be processed through a multi-language aggregation stage (522) to produce a composite readiness score when the source code comprises one or more programming languages. The composite readiness score may further be processed through a multi-domain assessment stage (524) for each assessment domain having domain-specific configuration parameters. The results may be produced as structured output (526) and portfolio assessment output (528).
[0062] An advantage of the present invention is that the violation density normalization on a per-thousand-lines-of-code basis eliminates the size bias present in traditional assessment methods. Software repositories of different sizes produce comparable readiness scores because the assessment is based on violation density rather than absolute violation counts.
[0063] Another advantage of the present invention is that the non-linear asymptotic penalty function provides mathematically bounded behaviour that prevents unbounded penalty accumulation. The asymptotic property ensures that the penalty score never exceeds the upper bound regardless of how high the violation density becomes, producing meaningful readiness scores for all software repositories.
[0064] Yet another advantage of the present invention is that the dual-polarity assessment through the booster mechanism recognizes both negative violations and positive code patterns. The balanced evaluation provides a more comprehensive picture of software readiness than assessment methods that only penalize violations.
[0065] A further advantage of the present invention is that the configurable calibration constant K enables organizations to tune the sensitivity of the penalty curve to match different assessment contexts and organizational standards. The multi-domain configuration with domain-specific parameters enables a single system to perform specialized assessments across different evaluation contexts.
[0066] An implementation of the disclosure may be an article of manufacture in which a machine-readable medium, such as microelectronic memory, has stored thereon instructions which program one or more data processing components, generically referred to herein as a processor, to perform the operations described above. In other implementations, some of the operations described above might be performed by specific hardware components that contain hardwired logic, including dedicated digital filter blocks and state machines. The said operations might alternatively be performed by any combination of programmed data processing components and fixed hardwired circuit components.
[0067] A non-transitory computer-readable storage medium includes program instructions to implement various operations embodied by a computing device such as a laptop, desktop, or a server. The medium may also include, alone or in combination with the program instructions, data files, data structures, and the like. The medium and program instructions may be those specially designed and constructed for the purposes, or the medium and program instructions may be of the kind well-known and available to those having skill in the computer software arts. Examples of non-transitory computer-readable storage medium include magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as Compact Disc Read-Only Memory (CD-ROM) disks and Digital Video Disc (DVD); magneto-optical media such as floptical disks; and hardware devices that are specially designed to store and perform program instructions, such as Read Only Memory (ROM), Random Access Memory (RAM), flash memory, and the like.
[0068] A processor may include one or more general purpose processors such as INTEL® or Advanced Micro Devices® (AMD) microprocessors and one or more special purpose processors such as digital signal processors or Xilinx® System On Chip (SOC) Field Programmable Gate Array (FPGA) processor, MIPS/ARM-class processor, a microprocessor, a digital signal processor, an application specific integrated circuit, a microcontroller, a state machine, or any type of programmable logic array.
[0069] The terms "or" and "and/or" as used herein are to be interpreted as inclusive or meaning any one or any combination. Therefore, "A, B or C" or "A, B and/or C" mean "any of the following: A; B; C; A and B; A and C; B and C; A, B and C." An exception to this definition will occur only when a combination of elements, functions, steps or acts are in some way inherently mutually exclusive.
[0070] The foregoing description of the specific embodiments will so fully reveal the general nature of the embodiments herein that others can, by applying current knowledge, readily configure and/or adapt for various applications such specific embodiments without departing from the generic concept, and, therefore, such adaptations and modifications should and are intended to be comprehended within the meaning and range of equivalents of the disclosed embodiments. The phraseology and terminology employed herein is for the purpose of description and not of limitation. Therefore, while the embodiments herein have been described in terms of implementations, those skilled in the art will recognize that the embodiments herein can be practiced with modification within the spirit and scope of the appended claims. , C , Claims:CLAIMS
I/We Claim:
1. A method (300) for assessing readiness of a software repository (114), the method (300) comprising:
receiving (302), by a processor (104), static analysis data (504) comprising a plurality of violations detected in source code of the software repository (114), the static analysis data (504) based on an automated static analysis of the source code, wherein each violation of the plurality of violations is associated with a severity level;
determining (304), by the processor (104), a size metric representing a quantity of lines of code in the source code of the software repository (114);
computing (306), by the processor (104), a weighted violation aggregate (508) by applying a severity weight corresponding to the severity level of each violation to a violation count associated with each violation, and summing the weighted violation counts across the plurality of violations;
calculating (308), by the processor (104), a violation density value (514) by dividing the weighted violation aggregate (508) by a normalized size factor (512) derived from the size metric, wherein the violation density value (514) is independent of an absolute size of the software repository (114);
applying (310), by the processor (104), a non-linear penalty function (518) having a configurable calibration constant to the violation density value (514) to generate a penalty score, wherein the non-linear penalty function (518) produces an asymptotic penalty score bounded between a lower bound and an upper bound as the violation density value (514) increases, and wherein the configurable calibration constant controls a steepness of the non-linear penalty function (518);
computing (312), by the processor (104), a readiness score for the software repository (114) based on the penalty score;
receiving (314), by the processor (104), booster data comprising a plurality of positive code patterns detected in the source code of the software repository (114), computing a booster density value (516) by dividing a weighted booster aggregate (510) by the normalized size factor (512), and computing a booster adjustment value by applying a configurable booster scaling factor to the booster density value (516);
generating (316), by the processor (104), a final readiness score by combining the readiness score and the booster adjustment value, wherein the final readiness score is bounded at a predefined maximum value, wherein the source code of the software repository (114) includes one or more programming languages;
determining, by the processor (104), the size metric for each programming language, computing the violation density value (514) for each programming language, and aggregating (318) readiness scores across the one or more programming languages to generate a composite readiness score using a lines-of-code proportional weight for each programming language, wherein the readiness score enables comparison of readiness across software repositories (114) of different sizes.
2. The method (300) as claimed in claim 1, wherein the normalized size factor (512) is determined by dividing the quantity of lines of code by a predetermined unit value, such that the violation density value (514) represents a count of weighted violations per the predetermined unit value of lines of code.
3. The method (300) as claimed in claim 1, wherein the non-linear penalty function (518) is determined as:
PenaltyScore = ViolationDensity / (ViolationDensity + K)
wherein K is the configurable calibration constant, and wherein the non-linear penalty function (518) is monotonically increasing with the violation density value (514) and asymptotically approaches the upper bound as the violation density value (514) increases toward infinity.
4. The method (300) as claimed in claim 3, wherein the readiness score is calculated as:
ReadinessScore = MaxScore × (1 − PenaltyScore);
wherein, MaxScore is a predefined maximum readiness value.
5. The method (300) as claimed in claim 1, wherein the severity level is selected from a predefined set of severity levels including a critical level, a high level, a medium level, a low level, and an informational level, and wherein each severity level of the predefined set of severity levels is assigned a corresponding severity weight from a configurable set of severity weights stored in a configuration store (222).
6. The method (300) as claimed in claim 1, wherein the final readiness score is calculated as:
FinalScore = min (MaxScore, ReadinessScore + BoosterAdjustment)
wherein BoosterAdjustment = α × BoosterDensity, and α is the configurable booster scaling factor.
7. The method (300) as claimed in claim 1, wherein each positive code pattern of the plurality of positive code patterns is associated with a booster severity level, and wherein the weighted booster aggregate (510) is computed by applying a booster severity weight corresponding to the booster severity level of each positive code pattern to a booster count associated with each positive code pattern, and summing the weighted booster counts.
8. The method (300) as claimed in claim 1, wherein the method (300) is performed for each assessment domain of a plurality of assessment domains, wherein each assessment domain includes a domain-specific configuration comprising a domain-specific calibration constant, domain-specific severity weights, and a domain-specific booster scaling factor.
9. The method (300) as claimed in claim 8, wherein the plurality of assessment domains includes at least one of: a cloud readiness domain, a containerization readiness domain, a security assessment domain, and a code quality domain.
10. The method (300) as claimed in claim 1, comprising aggregating (324), by the processor (104), readiness scores across a plurality of software repositories (114) within a portfolio to generate a portfolio-level readiness assessment, wherein the readiness scores are comparable across the plurality of software repositories (114) irrespective of respective sizes of the plurality of software repositories (114).
11. The method (300) as claimed in claim 1, wherein the aggregating (318) of readiness scores across the one or more programming languages comprises: applying the lines-of-code proportional weight corresponding to each programming language such that a contribution of each programming language to the composite readiness score is proportional to a relative quantity of lines of code of the programming language within the software repository (114).
12. The method (300) as claimed in claim 1, comprising: generating (322), by the processor (104), a structured output (526) comprising the readiness score and the violation density value (514), and providing the structured output (526) to a consuming application (118) for at least one of: benchmarking, prioritization, or quality gate evaluation.
13. The method (300) as claimed in claim 3, wherein the configurable calibration constant K is adjustable to control sensitivity of the readiness score to changes in the violation density value (514), wherein a lower value of K causes the non-linear penalty function (518) to increase more steeply for lower violation density values, and a higher value of K causes the non-linear penalty function (518) to increase more gradually.
14. The method (300) as claimed in claim 1, wherein the static analysis data (504) is received from one or more automated static code analysis tools (112).
15. A system (100) for assessing readiness of a software repository (114), the system (100) comprising:
a processor (104);
a non-transitory storage medium (108) storing instructions executable on the processor (104) to:
receive static analysis data (504) comprising a plurality of violations detected in source code of a software repository (114), the static analysis data (504) based on an automated static analysis of the source code, wherein each violation of the plurality of violations is associated with a severity level;
determine a size metric representing a quantity of lines of code in the source code of the software repository (114) and derive a normalized size factor (512) from the size metric;
compute a violation density value (514) based on a weighted violation aggregate (508) divided by the normalized size factor (512), the weighted violation aggregate (508) derived by applying a severity weight corresponding to the severity level of each violation to a violation count associated with each violation, wherein the violation density value (514) is independent of an absolute size of the software repository (114);
apply a non-linear penalty function (518) having a configurable calibration constant to the violation density value (514) to generate an asymptotic penalty score bounded between a lower bound and an upper bound, the configurable calibration constant controlling a steepness of the non-linear penalty function (518);
compute a readiness score for the software repository (114) based on the asymptotic penalty score;
receive booster data comprising a plurality of positive code patterns detected in the source code, compute a booster density value (516) by dividing a weighted booster aggregate (510) by the normalized size factor (512), apply a configurable booster scaling factor to the booster density value (516) to compute a booster adjustment value, and generate a final readiness score bounded at a predefined maximum value by combining the readiness score and the booster adjustment value; and
determine the size metric for each programming language when the source code comprises one or more programming languages, compute the violation density value (514) for each programming language, and aggregate readiness scores across the one or more programming languages to generate a composite readiness score using a lines-of-code proportional weight for each programming language, wherein the composite readiness score enables comparison of readiness across software repositories (114) of different sizes.
16. The system (100) as claimed in claim 15, wherein the non-linear penalty function (518) is defined as PenaltyScore = ViolationDensity / (ViolationDensity + K), wherein K is the configurable calibration constant, and the readiness score is calculated as ReadinessScore = MaxScore × (1 − PenaltyScore).
17. The system (100) as claimed in claim 15, wherein the program instructions are executable on the processor (104) to perform readiness assessment across a plurality of assessment domains, each assessment domain of the plurality of assessment domains having a domain-specific configuration comprising a domain-specific calibration constant, domain-specific severity weights, and a domain-specific booster scaling factor.
18. The system (100) as claimed in claim 15, wherein the severity level is selected from a predefined set of severity levels comprising a critical level, a high level, a medium level, a low level, and an informational level, and wherein each severity level of the predefined set of severity levels is assigned a corresponding severity weight from a configurable set of severity weights.
19. A non-transitory computer readable storage medium (108) comprising program instructions that when executed cause a processor (104) to:
receive static analysis data (504) comprising a plurality of violations detected in source code of a software repository (114) written in one or more programming languages, wherein each violation of the plurality of violations is associated with a severity level;
determine a size metric representing a quantity of lines of code in the source code of the software repository (114), and derive a normalized size factor (512) from the size metric;
compute a violation density value (514) that is independent of an absolute size of the software repository (114), the violation density value (514) based on a weighted violation aggregate (508) divided by the normalized size factor (512);
apply a non-linear penalty function (518) having a configurable calibration constant to the violation density value (514) to generate an asymptotic penalty score bounded between a lower bound and an upper bound, the configurable calibration constant controlling a steepness of the non-linear penalty function (518);
compute a readiness score for the software repository (114) based on the asymptotic penalty score;
receive booster data comprising a plurality of positive code patterns detected in the source code, compute a booster density value (516) by dividing a weighted booster aggregate (510) by the normalized size factor (512), apply a configurable booster scaling factor to the booster density value (516) to compute a booster adjustment value, and generate a final readiness score bounded at a predefined maximum value by combining the readiness score and the booster adjustment value; and
determine the size metric for each programming language of the one or more programming languages, compute the violation density value (514) for each programming language, and aggregate readiness scores across the one or more programming languages to generate a composite readiness score using a lines-of-code proportional weight for each programming language, wherein the composite readiness score enables comparison of readiness across software repositories (114) of different sizes.
20. The non-transitory computer readable storage medium (108) as claimed in claim 19, wherein the non-linear penalty function (518) is defined as
PenaltyScore = ViolationDensity / (ViolationDensity + K),
wherein K is the configurable calibration constant, and the readiness score is calculated as ReadinessScore = MaxScore × (1 − PenaltyScore), and wherein the instructions further cause the processor (104) to perform readiness assessment for each assessment domain of a plurality of assessment domains, each assessment domain having a domain-specific configuration comprising a domain-specific calibration constant, domain-specific severity weights, and a domain-specific booster scaling factor.
Dated this 06th day of March 2026

BALIP AMIT ABASAHEB [IN/PA-5184]
Authorized Patent Agent of the Applicant