microsoft safety scanner command line switches

#Microsoft safety scanner command line switches how to
#Microsoft safety scanner command line switches install
#Microsoft safety scanner command line switches full
#Microsoft safety scanner command line switches code

It is recommended to use a Debian “slim” distribution or Alpine Linux. If the scanner requires a fully functional Linux environment,

If that isn’t possible, try to keep it below 1.46 GB, The CI may have to fetch the Docker image every time the job runs.įor the scanning job to run fast and avoid wasting bandwidth, Docker images should be as small as Regardless of the individual machine the scanner runs on. Packaging your scanner into a Docker image makes its dependencies and configuration always present, The scanner with all the libraries and tools it depends on. The Docker image is a self-contained environment that combines Mysec_dependency_scanning : rules : - if : $DEPENDENCY_SCANNING_DISABLED when : never - if : $GITLAB_FEATURES =~ /dependency_scanning/ exists : - ' **/*.java'Īny additional job policy should only be configured by users based on their needs.įor instance, predefined policies should not trigger the scanning jobįor a particular branch or when a particular set of files changes.

#Microsoft safety scanner command line switches code

The project repository contains Java source code and the dependency_scanning feature is enabled:

#Microsoft safety scanner command line switches how to

This example shows how to skip a custom Dependency Scanning job, mysec_dependency_scanning, unless Language detection currently relies on the linguist Ruby gem. Depending on this value, your scanner may or may not do something different. GitLab also defines a CI_PROJECT_REPOSITORY_LANGUAGES variable, which provides the list of If appropriate based on the scanner type, you should then disable running the custom scanner. PoliciesĬertain GitLab workflows, such as AutoDevOps,ĭefine CI/CD variables to indicate that given scans should be disabled. It’s declared under the reports:sast key in the job definition, not because of the filename. The Output file section for more details. Note that gl-sast-report.json is an example file path but any other filename can be used. Mysec_sast : image : /secure/mysec artifacts : reports : sast : gl-sast-report.json Scanning jobs must declare a report that corresponds to the type of scanning they perform,įor example, here is the definition of a SAST job that generates a file named gl-sast-report.json, So the allow_failure parameter should be set to true. Scanning jobs should not block the pipeline when they fail, To be aligned with the GitLab Security paradigm, The stage keyword can be omitted because test is the default value. Stageįor consistency, scanning jobs should belong to the test stage when possible. Should not be used in the job definition, because it may be overridden by users.

#Microsoft safety scanner command line switches install

Should not be used in the job definition because users may rely on this to prepare their projects before performing the scan.įor instance, it is common practice to use before_script to install system librariesĪ particular project needs before performing SAST or Dependency Scanning. To perform the scan automatically, without passing any command. It is not possible to rely on the predefined ENTRYPOINT and CMD of the Docker image Is used to specify the commands to run the scanner.īecause the script entry can’t be left empty, it must be set to the command that performs the scan. The job name is suffixed after the type of scanning:įor instance, the dependency scanning job based on the “MySec” scanner would be named mysec_dependency_scanning.

#Microsoft safety scanner command line switches full

Full documentation on these and other available fields can be viewedįor consistency, scanning jobs should be named after the scanner, in lower case. This section describes several important fields to add to the security scanner’s jobĭefinition file. Scanner, as well as requirements and guidelines for the Docker image. This page documents requirements and guidelines for writing CI jobs that implement a security That contains the scanner and all its dependencies in a self-contained environment. The scanning job is usually based on a Docker image These results are thenĪutomatically presented in various places in GitLab, such as the Pipeline view, merge request This CI job should then output its results in a GitLab-specified format.

They can add to their CI configuration files to scan their GitLab projects. Integrating a security scanner into GitLab consists of providing end users