SecurityCodeScan-example.toml

[source-code]

relativeDirectory=''                                                    # source code directory specified by relative directory name (overrides projectFileDirectoryPatterns)
projectFileDirectoryPatterns=['*.sln','*.csproj','*.vbproj','*.fsproj'] # patterns (e.g., *.sln,*.csproj) to find source code directory by largest, first file found

[request]  # (reserved for Code Dx use)

# The image name contains the Docker image that handles this scan request file.
#
imageName = "codedx/codedx-securitycodescanrunner:v1.57.0"

# The work directory stores k8s secrets, trusted CA certificates,a copy of the scan request
# file, and the exit code file. The user running the Docker image *must* have write access
# to the work directory.
#
# $workDirectory/analysis-exit-code  - exit code of the shell command
# $workDirectory/ca-certificates     - trusted CA certificates
# $workDirectory/config/request.toml - a copy of the scan request file
# $workDirectory/input               - analysis input
# $workDirectory/workflow-secrets    - workflow secrets
#
workDirectory = "/opt/codedx/securitycodescan/work"

# The shell cmd to run as the entry point for the tool.
#
shellCmd = '''
	source=$(ls /opt/codedx/securitycodescan/work/input)
	pwsh /opt/codedx/securitycodescan/script/SecurityCodeScan.ps1 \
		"/opt/codedx/securitycodescan/work/input/$source" \
		/opt/codedx/securitycodescan/work/output/securitycodescan.output \
		/opt/codedx/securitycodescan/work/config/request.toml
'''

# The result file contains the tool output provided to Code Dx.
#
resultFilePath = "/opt/codedx/securitycodescan/work/output/securitycodescan.output"

# The Intelligent Orchestration security activities supported by this tool (e.g., sca, sast, dast)
#
securityActivities = ['sast']

# The list of emptyDir volumes for the tool. The /.cache and /.local are needed when not using uid 1000.
#
ephemeralVolumePaths = ["/tmp","/.cache","/.local","/.dotnet","/.nuget","/home/securitycodescan/.cache","/home/securitycodescan/.local","/home/securitycodescan/.dotnet","/home/securitycodescan/.nuget","/opt/codedx/securitycodescan/work","/opt/codedx/securitycodescan/work/output"]

[request.workflowSecurityContext]

# The pod security context for the tool.
#
podSecurityContext = '''
{
	"fsGroup": 1000,
	"runAsGroup": 1000,
	"runAsUser": 1000,
	"runAsNonRoot": true,
	"seccompProfile": {
		"type": "RuntimeDefault"
	},
	"supplementalGroups": []
}
'''

# The container security context for the tool.
#
securityContext = '''
{
	"allowPrivilegeEscalation": false,
	"capabilities": {
		"drop": [
			"ALL"
		]
	},
	"readOnlyRootFilesystem": true
}
'''