Azure Pipelines
Qodana Scan
Qodana Scan is an Azure Pipelines task packed inside the Qodana Azure Pipelines extension to scan your code with Qodana.
Usage
Basic configuration
After you've installed the Qodana Azure Pipelines extension to your organization, to configure the Qodana Scan task, edit your azure-pipelines.yml
file:
Triggering this job depends on what type of repository you are using in Azure Pipelines.
The task can be run on any OS and x86_64/arm64 CPUs, but it requires the agent to have Docker installed. And since most of the Qodana Docker images are Linux-based, the docker daemon must be able to run Linux containers.
Qodana Cloud
To send the results to Qodana Cloud, all you need to do is to specify the QODANA_TOKEN
environment variable in the build configuration.
In the Azure Pipelines UI, create the
QODANA_TOKEN
secret variable and save the project token as its value.In the Azure pipeline file, add
QODANA_TOKEN
variable to theenv
section of theQodanaScan
task:
After the token is set for analysis, all Qodana Scan job results will be uploaded to your Qodana Cloud project.
SARIF SAST Scans Tab
To display Qodana report summary in Azure DevOps UI in 'Scans' tab, install Microsoft DevLabs’ SARIF SAST Scans Tab extension.
Configuration
You probably won't need other options than args
: all other options can be helpful if you are configuring multiple Qodana Scan jobs in one workflow.
Name | Description | Default Value |
---|---|---|
| Additional Qodana CLI | - |
| Directory to store the analysis results. Optional. |
|
| Upload Qodana results as an artifact to the job. Optional. |
|
| Upload qodana.sarif.json as an qodana.sarif artifact to the job. Optional. |
|
| Specify Qodana results artifact name, used for results uploading. Optional. |
|
| Directory to store Qodana caches. Optional. |
|