★ wanayoo — archive 1999 https://github.com/security-code-scan/security-code-scan/issues/161Nouvelle recherche | Portail wanayoo
Skip to content

/ security-code-scan

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Integration into CI/CD as command line/post build script #161

Open
abhijitparkhi1983 opened this issue Apr 8, 2020 · 5 comments
Open

Integration into CI/CD as command line/post build script #161

abhijitparkhi1983 opened this issue Apr 8, 2020 · 5 comments

Comments

@abhijitparkhi1983
Copy link

@abhijitparkhi1983 abhijitparkhi1983 commented Apr 8, 2020

Sorry for not using the format you guys have given. Thats because this is not a bug. But wanted to understand the way the tool can be used.

So we have multiple C# and VB.NET projects build on .NET standard and .NET Core. We use git's pull request feature for every commit. The pull request triggers a Jenkins build process.

We would like to explore a possibility of running security-code-scan as a post build step as a command line step. Like say giving the .sln path as a parameter to say a dotnet command which runs secuirty-code-scan on the entire solution.

We dont want to add the nugget to each and every project that we have.
I haven't seen any document / guidance on such a usage. Is it possible ?
@abhijitparkhi1983
Copy link
Author

@abhijitparkhi1983 abhijitparkhi1983 commented Apr 8, 2020

The document does mention "If the CI server of your choice is using MSBuild, then integration of SCS is just a matter of adding NuGet packages and collecting the output from the build. SCS warnings are in the form of"
But there isnt any command mentioned. Please guide through it
@JarLob
Copy link
Contributor

@JarLob JarLob commented Apr 8, 2020 •
edited

Imho everything is in Continuous Integration Builds section already. dotnet add src/SourcesFolderName/ProjectName.csproj package SecurityCodeScanVS2017 and dotnet build. You can add the nuget to all projects by script. There is no other integration outside Visual Studio afaik.
@emmcardenas
Copy link

@emmcardenas emmcardenas commented Apr 8, 2020

i'm excuting dotnet add src/SourceFolderName/ProjectName.csproj package SecurityCodeScan --version 3.5.0 and works fine with dotnet 2.2. But when i run it with dotnet 3.1 it doesn't find vulnerabilities
@eloisetaylor5693
Copy link
Contributor

@eloisetaylor5693 eloisetaylor5693 commented Apr 18, 2020 •
edited

Could create an Azure Devops task/extension so that the results can be reported nicely, when looking at the build output. Some extensions add another tab to the build information.

eg:
image

Could create for other build tools as well eg TeamCity etc etc
@JarLob
Copy link
Contributor

@JarLob JarLob commented May 5, 2020

@eloisetaylor5693 I'm not sure how to read your message: as "everything works, here is how to do it", suggestion for improvement or are you volunteering :)
@emmcardenas It is a bad practice to hijack unrelated threads. Try dotnet build --no-incremental instead.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants
@abhijitparkhi1983 @eloisetaylor5693 @JarLob @emmcardenas
You can’t perform that action at this time.