Scans a codebase with a selection of rules. You can scan the codebase with all the rules in the registry, or use parameters to filter the rules based on rulename, category, or ruleset. You can specify the format of the output, such as XML or JUnit. You can print the output to the console (default) or to a file using the –outfile parameter.
Review these examples for some ideas on how to run Code Analyzer to its full potential.
Run All Rules
This example evaluates all rules against somefile.js. When you invoke Code Analyzer without specifying any rules, it runs all rules.
1$ sf scanner run --format xml --target somefile.js
Replace these values:
xml: The output format.
somefile.js: The source code location.
Run Rules in Specific Categories
This example evaluates all rules in the Design and Best Practices categories. When you specify multiple categories or rulesets, the results are combined with a logical OR.
1$ sf scanner run --format xml --target somefile.js --category Design,Best Practices
Replace these values:
xml: The output format.
somefile.js: The source code location.
Design,Best Practices: The categories of rules to run.
Run Against Files With Exceptions
These examples evaluate rules against all .js files in the current directory, except for IgnoreMe.js. Wrap globs in quotes.
Unix Example
1$ sf scanner run --target ./**/*.js,!./**/IgnoreMe.js ...
Windows Example
1> sf scanner run --target .\**\*.js,!.\**\IgnoreMe.js ...
Replace this value:
./**/*.js,!./**/IgnoreMe.js: The source code location.
Run Across Directories
This example scans the project contained in /my-project if the current working directory is another directory. Specify tsconfig.json if the current working directory doesn’t contain the tsconfig.json that corresponds to the TypeScript files being scanned.
1$ cd /my-home-directory2 $ sf scanner run --target /my-project/**/*.ts --tsconfig /my-project/tsconfig.json
Replace these values:
/my-home-directory: The source code location.
/my-project/tsconfig.json: The tsconfig file location.
Use Environment Variables
This example evaluates rules against somefile.js, including Jasmine in the environment variables. Uses --env to override the default ESLint environment variables to add frameworks.
1$ sf scanner run --target somefile.js --env {"jasmine": true}
Replace these values:
somefile.js: The source code location.
{"jasmine": true}: An ESLint environment variable used to override the default.
Include or Exclude Engines Against a File
This example evaluates rules against somefile.js using eslint-lwc and pmd engines. Use --engine to include or exclude engines. Any engine listed runs, regardless of its current disabled attribute.
1$ sf scanner run --target somefile.js --engine eslint-lwc,pmd
Replace these values:
somefile.js: The source code location.
eslint-lwc,pmd: The engine or engines to run.
Include or Exclude Engines Against a Directory
In this example, ESLint and RetireJS run even if they’re disabled, and no other engine runs. Use --engine to include or exclude engines. Regardless of their current disabled attribute, any specified engine runs, and all others won’t.
1$ sf scanner run --target somedirectory --engine eslint,retire-js
Use --engine to invoke engines that aren’t enabled by default.
Replace these values:
somedirectory: The source code location.
eslint,retire-js: The engine or engines to run.
Execute CPD
This example executes CPD engine against known file extensions in /some/dir. CPD helps detect blocks of code duplication in selected languages.
1$ sf scanner run --target /some/dir --engine cpd
Replace these values:
/some/dir: The source code location.
cpd: The engine or engines to run.
Run with Custom PMD Rules
This example executes rules defined in pmd_rule_ref.xml against the files in src. To use PMD with your own rule reference file, use --pmdconfig. Rule filters aren’t applied.
1$ sf scanner run --target src --pmdconfig pmd_rule_ref.xml
Replace these values:
src: The source code location.
pmd_rule_ref.xml: The location of the PMD rule reference XML file.
Run with Custom Config
This example uses a custom config to scan the files in src. To use ESLint with your own .eslintrc.json file, use --eslintconfig. Make sure that the directory you run the command from has all the NPM dependencies installed.
1$ sf scanner run --target src --eslintconfig /home/my/setup/.eslintrc.json
Replace these values:
src: The source code location.
/home/my/setup/.eslintrc.json: The location of the ESLintrc config.
Run with --normalize-severity
This example uses --normalize-severity to output normalized severity and engine-specific severity across all engines. Normalized severity is: 1 (high), 2 (moderate), and 3 (low).
1$ sf scanner run --target /some-project/ --format csv --normalize-severity
Replace these values:
/some-project/: The source code location.
csv: The output format.
Run with --severity-threshold
This example uses --severity-threshold to throw a non-zero exit code when rule violations of normalized severity 2 or greater are found. If any violations with the specified severity (or greater) are found, the exit code equals the severity of the most severe violation.
1$ sf scanner run --target /some-project/ --severity-threshold 2
Replace these values:
/some-project/: The source code location.
2: A severity value. Possible values are: 1 (high), 2 (moderate), and 3 (low).
Usage
sf scanner run
[-c CATEGORY_LIST]
[-e ENGINE_LIST]
[-f FORMAT]
[-o OUTFILE]
[-p PROJECTDIR_LIST]
[-s SEVERITY-THRESHOLD]
[-t TARGET_LIST]
[--eslintconfig ESLINTCONFIG]
[--json]
[--normalize-severity]
[--pmdconfig PMDCONFIG]
[--tsconfig TSCONFIG]
[--verbose-violations]
[--verbose]
Flags
-c|--category CATEGORY_LIST
Optional
One or more categories of rules to run. Specify multiple values as a comma-separated list.
Type: option
-e|--engine ENGINE_LIST
Optional
Specifies one or more engines to run. Submit multiple values as a comma-separated list.
Specifies the output format for results written directly to the console.
Type: option
Possible Values: csv | html | json | junit | sarif | table | xml
-o|--outfile OUTFILE
Optional
Writes output to a file.
Type: option
-p|--projectdir PROJECTDIR_LIST
Optional
Provides the relative or absolute root project directories used to set the context for Graph Engine’s analysis. Specify multiple values as a comma-separated list. Each project directory must be a path, not a glob. If –projectdir isn’t specified, a default value is calculated. The default value is a directory that contains all the target files.
Type: option
-s|--severity-threshold SEVERITY-THRESHOLD
Optional
Throws an error when violations are found with equal or greater severity than the provided value. Values are 1 (high), 2 (moderate), and 3 (low). Exit code is the most severe violation. Using this flag also invokes the –normalize-severity flag.
Type: option
-t|--target TARGET_LIST
Optional
Specifies the source code location. Can use glob patterns. Specify multiple values as a comma-separated list. Default is ”.”.
Type: option
--eslintconfig ESLINTCONFIG
Optional
Specifies the location of eslintrc config to customize ESLint engine. The –tsconfig flag can’t be used with –eslintconfig flag.
Type: option
--json
Optional
Format output as JSON.
Type: boolean
--normalize-severity
Optional
Returns normalized severity 1 (high), 2 (moderate), and 3 (low), and the engine-specific severity. For the html option, the normalized severity is displayed instead of the engine severity.
Type: boolean
--pmdconfig PMDCONFIG
Optional
Specifies the location of the PMD rule reference XML file to customize rule selection.
Type: option
--tsconfig TSCONFIG
Optional
The location of the tsconfig.json file used by the eslint-typescript engine. The –tsconfig flag can’t be used with –eslintconfig flag.
Type: option
--verbose-violations
Optional
Returns retire-js violation-message details about each vulnerability, including summary, common vulnerabilities and exposures (CVE), and URLs.
Type: boolean
--verbose
Optional
Emit additional command output to stdout.
Type: boolean
[DEPRECATED] --env ENV
Optional
Deprecated. Overrides ESLint’s default environmental variables, in JSON-formatted string.
Type: option
[DEPRECATED] -r|--ruleset RULESET_LIST
Optional
Deprecated. Use category instead. One or more rulesets to run. Specify multiple values as a comma-separated list.
j