SCANOSS Code Scan Task

The SCANOSS Code Scan task enhances your software development process by automatically scanning your code for security vulnerabilities and license compliance with configurable policies.

Usage

Before using the SCANOSS Code Scan Task, you need to install it from the Azure Marketplace. You can find it here.

Set Up

The SCANOSS Code Scan Task uses the Azure API to create Checks and Comments on Pull Requests. Once the pipeline is available upstream, ensure you have the correct permissions set up on your repository:

Open the repository settings section:

1. Project Settings
2. Repositories
3. Select the repository

A) Allow Pull Request Contribute Access:

1. Open the 'Security' tab.
2. Select the repository Build Service account under the 'Users' group.
3. Allow "Contribute to pull requests".

B) Add Build Validation Policy to the integration branch:

1. Open the 'Policies' tab.
2. Select the integration branch under 'Branch Policies'.
3. Add a new Build Validation Policy, configure the options, and save:
   1. Build Pipeline: Select your pipeline.
   2. Trigger: Automatic.
   3. Policy Requirement: Select your option.
   4. Build Expiration: Select your option.
   5. Set a display name.

Azure agent jobs

If an Azure Agent Job is being run, ensure that the 'Allow scripts to access OAuth token' option is enabled. The SCANOSS Code Scan Task requires access to the System Access token to push the results to the PR.

Pipeline

A basic pipeline should be set and the SCANOSS task should be included within it:

trigger: none

pr:
  - main

pool:
  vmImage: ubuntu-latest

##schedules:
##  - cron: "*/5 * * * *"  # Every 5 minutes
##    displayName: "Run every 5 minutes"
##    always: true         # Ensures the pipeline runs even if there are no code changes
##    branches:
##      include:
##        - main           # Specify the branch(es) to trigger the schedule on  
  
variables:
  HTTP_PROXY: $(HTTP_PROXY_URL)
  HTTPS_PROXY: $(HTTPS_PROXY_URL)   

steps:
  - checkout: self
    persistCredentials: true

  - task: scanoss@0
    displayName: "SCANOSS Code Scan"
    inputs:
     # apiKey: $(APIKEY)
     # apiUrl: 'https://api.scanoss.com/scan/direct'
      sbomFilepath: SBOM.json
      policies: copyleft,undeclared
      policiesHaltOnFailure: false
      dependenciesEnabled: true
      dependenciesScope: prod 
      licensesCopyleftInclude: AGPL-1.0-or-later, AGPL-1.0-only

   

NOTE:
Minor versions can be set by specifying the full version number of a task after the @ sign (example: scanoss@0.1.1). For further details, please refer to the task version.

3. Proxy Configuration

If your pipeline is running behind a proxy, add the following configuration to the pipeline:

variables:
  HTTP_PROXY: http://your-proxy:8080
  HTTPS_PROXY: http://your-proxy:8080
...
inputs:
  runtimeContainer: '<self_hosted_registry>/scanoss-py:v1.15.0'

Inside the SCANOSS task add the runtimeContainer input with the address of your internal Docker registry.

Pipeline Triggers

In addition to being triggered by pull requests (PRs), pipelines can also be run manually and scheduled to execute at regular intervals. When the pipeline is manually triggered or runs on a schedule, the results are uploaded only to the run artifacts.

Action Input Parameters

Policy Checks

The SCANOSS Code Scan Task includes two configurable policies:

1. Copyleft: This policy checks if any component or code snippet is associated with a copyleft license. If such a license is detected, the pull request (PR) is rejected. The default list of Copyleft licenses is defined in the following file.

2. Undeclared: This policy compares the components detected in the repository against those declared in the sbom.json file (customizable through the sbom.filepath parameter). If there are undeclared components, the PR is rejected.

Additionally, if it is a Pull Request, a comment with a summary of the report will be automatically generated.

Artifacts

The scan results and policy check outcomes are uploaded to the artifacts folder of the specific run of the pipeline.

Example Repository

An example use case can be found at the following link.