Code references
Read time: 7 minutes
Last edited: Oct 02, 2024
Code references is available to customers on an Enterprise plan. To learn more, read about our pricing. To upgrade your plan, contact Sales.
Overview
This topic explains how to use code references in LaunchDarkly to find and manage references to your feature flags.
The code references feature makes it easy to determine which projects reference your feature flags, and simplifies removal of technical debt.
LaunchDarkly uses an open-source utility called ld-find-code-refs
that scans your code and pushes code reference information to LaunchDarkly. You can integrate this utility into your CI/CD process, or use other trigger mechanisms like GitHub code references, cron
jobs, or commit-triggered Lambda functions.
Integrate ld-find-code-refs with your toolchain
LaunchDarkly services do not need direct access to your source code to use code references. The ld-find-code-refs
utility is agnostic to where your code is hosted. You can push references to LaunchDarkly whether you're using GitHub, GitHub Enterprise, Bitbucket, Bitbucket Enterprise, GitLab, Azure DevOps, or any other Git code hosting tool.
If your workflow does not have a direct integration, you can use an ld-find-code-refs
Docker container on Docker Hub.
LaunchDarkly offers built-in configurations for common trigger mechanisms and CI/CD providers, including:
- Bitbucket code references
- CircleCI code references
- Custom configuration with ld-find-code-refs
- GitHub code references
- GitLab code references
You can also invoke the ld-find-code-refs
utility from the command line. Run this utility in any custom workflow, such as a bash script or cron
job.
LaunchDarkly transmits code references-related information through LaunchDarkly's REST API, which uses the HTTPS protocol with a minimum TLS version of 1.2. LaunchDarkly encrypts data at rest using AWS encryption features based on their Key Management Service. LaunchDarkly uses strong forms of cryptography like AES256-GCM with access-controlled keys that are regularly audited and rotated.
Prerequisites
To set up code references in LaunchDarkly, you must have the following prerequisites:
- You must have an API access token with write permissions for the
code-reference-repository
resource, either through the built-in Writer role or a custom role. Create an API access token on the Authorization page. We recommend using a service token. To learn more, read API access tokens and Code reference actions. - You must have a Writer role or a custom role that allows all actions on code references.
- You must allow
ld-find-code-refs
to run in environment that has access to your source code.
To create an API access token with a custom role that allows all actions on code references, the member creating the access token must also have either a Writer role or a custom role that allows all actions on code references.
View code references for flags
You can view existing code references for feature flags from each flag's targeting page.
To view details for existing code references, navigate to the flag's targeting page and click the name of the repository from the right sidebar. The Code references page for the flag appears.
The screenshot below shows the Code references page displaying an active code reference:
The Flags list also indicates if a flag is ready for code removal: From the Flags list, open the Display menu. Then, select Archive checks.
When archive checks are displayed, each flag that is ready for code removal has a "Ready for code removal" indicator in the Flags list. Click the indicator to open the "Ready for code removal" dialog and review the checks to confirm that the flag is read for code removal. Then, click View code references to view existing code references for the flag.
You can also use the REST API: Code references
About extinction events
After you remove all code references mentioning that flag from the codebase and rerun the scanning tool, LaunchDarkly creates an extinction event. This event appears as a message on the Code references page for the feature flag. It indicates that all code references for the flag have been removed from the codebase as of a specified commit.
You can also use the REST API: List extinctions
Here is an image of an extinction event on the Code references page of a feature flag:
To disable extinctions, set lookback
to 0
in the ld-find-code-refs
configuration settings.
You can toggle a repository on or off to allow or forbid code reference triggers from pushing new data to it.
Code references in federal environments
If you are using ld-find-code-refs
in an environment that requires the use of FIPS 140-2 validated encryption modules, such as the LaunchDarkly federal instance, you may need to take additional steps to ensure compliance. To learn more, read LaunchDarkly in environments requiring FIPS 140-2 validated encryption modules.
Manage code references
Manage code references on the Integrations page for your project. Code references are organized into repositories, which the ld-find-code-refs
tool creates automatically.
After a repository appears on the Integrations page, you can either temporarily disable it, which prevents new code references from being added to LaunchDarkly, or delete all code references associated with the repository.
To disable the repository, click the toggle switch to Off.
To delete the repository, click Delete.
If you click Delete, LaunchDarkly purges all data associated with that repository. It will no longer have any record of the code reference or any source context lines. Deleting is permanent and cannot be undone.
If you want to remove a connection permanently, be sure to remove any ld-find-code-refs
triggers from your code. If you're not sure how or where the trigger is invoked, you can also delete the access token your trigger uses. If you delete a repository with automated code reference updates enabled, the connection is recreated the next time an automated code reference trigger executes.
Configure context lines
The ld-find-code-refs
utility sends two lines of surrounding source context to LaunchDarkly. Two lines of code appear above and two lines appear below the actual reference.
Having a few lines of context can make it easier to understand references to a feature flag. However, these lines are optional. You can disable this feature when you configure ld-find-code-refs
.
Send metadata only
You can disable contextLines
as shown in Configure context lines. When you disable contextLines
no snippets of code leave your repository. All code scanning always happens within infrastructure your team manages as outlined in Integrate ld-find-code-refs with your toolchain
Metadata sent to LaunchDarkly:
- Organization name, if applicable
- Repository name
- Commit ID
- Synced time
- File name
- Line number
Metadata sent to LaunchDarkly if extinctions
are enabled and an extinction is found:
- All of the metadata listed in the section above
- Commit message when extinction was recorded
ld-find-code-refs
is open source and available for review. Code reference give your team additional insights, such as surfacing flag usage in the codebase to provide additional safety checks when archiving flags, during the lifecycle of the flag while still maintaining a secure SDLC.
Find flag aliases
Aliases help you find indirect references to feature flags, such as flag keys stored in variables or in wrapped SDK code.
Here's how to find references to firstFeatureFlag
throughout your codebase:
var firstFeatureFlag = 'first-flag-key-123abc'
aliases:- type: camelcase
This identifies all references to firstFeatureFlag
in your codebase.
To learn more about aliases, read the aliases documentation.
Using ld-find-code-refs with a monorepo
ld-find-code-refs
version 2.5.0+ provides support for monorepos. This means a single scan of code references can find feature flags and aliases from multiple LaunchDarkly projects stored in the same repository. You can specify an optional starting subdirectory for each project, which limits your scan to directories below the initial subdirectory only. The required top-level dir
value should still be the overall git repository root directory.
To learn more about monorepo support, read Projects in the ld-find-code-refs
configuration documentation.
Limitations
The LaunchDarkly code references API asserts various limits to limit the number of "false positive" code references. ld-find-code-refs
logs warning messages if you exceed any of these limits. Above certain values, LaunchDarkly may ignore some files and references.
These limits include:
- LaunchDarkly does not scan code references for flags with keys that have fewer than three characters.
- LaunchDarkly stores up to 10,000 files with code references per repository. Additional files are ignored.
- LaunchDarkly allows up to 500 characters per line of source code stored. Additional characters are truncated.
- LaunchDarkly allows up to 25,000 code references per file. Additional references are ignored.
If you've encountered any of these limits, or are noticing a large number of false positives being detected by ld-find-code-refs
, you can configure an .ldignore
file in your repository with rules matching the files and directories you'd like to exclude.
To learn more about .ldignore
files, read the ld-find-code-refs
documentation.
Using ld-find-code-refs with the React Web SDK
The code references feature scans your source code for occurrences of your flag keys. This process requires your source code to reference flag keys exactly as they appear in LaunchDarkly.
However, by default, the React Web SDK changes all flag keys to camel-case for easier access with dot notation. To use the code references feature in conjunction with the React Web SDK, configure ld-find-code-refs
to generate camel-case aliases for the flag keys, or configure the React Web SDK to disable this camel-casing feature. To learn more, read Flag keys transposed to common casing conventions in the ld-find-code-refs
documentation and Flag keys in the React Web SDK.