binskim scans files one by one #85

Activity

1. kewalaka commented on Nov 9, 2023

   

   Stu Mace (kewalaka)

   on Nov 9, 2023

   Last edited by kewalaka

   More actions

   hi Fábio Franco (@fabio-s-franco) - I was just hitting the same wall myself. I've found this documentation here which was helpful:

   https://github.com/microsoft/security-devops-azdevops/wiki

   You can use a gdnconfig file & supply that to the defender for devops task, as the config option, from the above docs:

    - task: MicrosoftSecurityDevOps@1
      inputs:
      # command: 'run' | 'pre-job' | 'post-job'. Optional. The command to run. Default: run
      # config: string. Optional. A file path to an MSDO configuration file ('*.gdnconfig').
      # policy: 'azuredevops' | 'microsoft' | 'none'. Optional. The name of a well-known Microsoft policy. If no configuration file or list of tools is provided, the policy may instruct MSDO which tools to run. Default: azuredevops.
      # categories: string. Optional. A comma-separated list of analyzer categories to run. Values: 'secrets', 'code', 'artifacts', 'IaC', 'containers. Example: 'IaC,secrets'. Defaults to all.
      # languages: string. Optional. A comma-separated list of languages to analyze. Example: 'javascript,typescript'. Defaults to all.
      # tools: string. Optional. A comma-separated list of analyzer tools to run. Values: 'bandit', 'binskim', 'eslint', 'templateanalyzer', 'terrascan', 'trivy'.
      # break: boolean. Optional. If true, will fail this build step if any error level results are found. Default: false.
      # publish: boolean. Optional. If true, will publish the output SARIF results file to the chosen pipeline artifact. Default: true.
      # artifactName: string. Optional. The name of the pipeline artifact to publish the SARIF result file to. Default: CodeAnalysisLogs*.
   

   There's also a sample file for BinSkim options (and other tools) further on the same page:

   https://github.com/microsoft/security-devops-azdevops/wiki#bandit-options

   I couldn't find this on Learn with the other pipeline yaml definitions, that would have made the search easier.

   👍React with 👍1Reacted by Fábio Franco