Skip to content

tutorial_cli_analyze_codebase.rst

Latest commit

 

History

History
130 lines (86 loc) · 4.24 KB

tutorial_cli_analyze_codebase.rst

File metadata and controls

130 lines (86 loc) · 4.24 KB
Raw

Analyze Codebase (Command Line)

The focus of this tutorial is to guide you through scanning a codebase package using ScanCode.io.

Note

This tutorial assumes you have a recent version of ScanCode.io installed locally on your machine and running with Docker. If you do not have it installed, see our :ref:`installation` guide for instructions.

Requirements

Before you follow the instructions in this tutorial, you need to:

  • Install ScanCode.io locally
  • Have Shell access on the machine where ScanCode.io is installed

Instructions

  • Create a new directory in your home directory that will be used to put the input code to be scanned.
$ mkdir -p ~/codedrop/
$ curl https://files.pythonhosted.org/packages/c0/e8/578887011652048c2d273bf98839a11020891917f3aa638a0bc9ac04d653/asgiref-3.3.0-py3-none-any.whl --output ~/codedrop/asgiref-3.3.0-py3-none-any.whl
  • Create an alias to the scanpipe command executed through the docker compose command line interface with:
$ alias scanpipe="docker compose -f ${PWD}/docker-compose.yml run --volume ~/codedrop/:/codedrop:ro web scanpipe"
  • Create a new project named asgiref:
$ scanpipe create-project asgiref
>> Project asgiref created with work directory /var/scancodeio/workspace/projects/asgiref-35519104
$ scanpipe add-input --project asgiref --input-file /codedrop/asgiref-3.3.0-py3-none-any.whl
>> File copied to the project inputs directory:
  - asgiref-3.3.0-py3-none-any.whl
  • Add the scan_codebase pipeline to your project:
$ scanpipe add-pipeline --project asgiref scan_codebase
>> Pipeline scan_codebase added to the project

Note

The content of the :guilabel:`input/` directory will be copied in the :guilabel:`codebase/` directory where extractcode will be executed before running scancode. Alternatively, the codebase content can be manually copied to the :guilabel:`codebase/` directory in which case the --input option can be omitted.

  • Run the scan_codebase pipeline on your project. The pipeline execution progress is shown within the following command's output:
$ scanpipe execute --project asgiref
>> Pipeline scan_codebase run in progress..
   Pipeline [scan_codebase] starting
   Step [copy_inputs_to_codebase_directory] starting
   Step [copy_inputs_to_codebase_directory] completed in 0.00 seconds
   Step [extract_archives] starting
   [...]
   Pipeline completed
   scan_codebase successfully executed on project asgiref

  • Finally, export the scan results as JSON format:

    $ scanpipe output --project asgiref --format json --print > asgiref-3.3.0_results.json

Tip

The inputs and pipelines can be provided at the same time when calling the create-project command. For instance, the following command will create a new project named asgiref2, add the package archive as the project input, add the scan_codebase pipeline to the project, and execute it:

$ scanpipe create-project asgiref2 \
    --input-file /codedrop/asgiref-3.3.0-py3-none-any.whl \
    --pipeline scan_codebase \
    --execute
>> Project asgiref2 created with work directory /var/scancodeio/workspace/projects/asgiref2-bea7a5e9
   File copied to the project inputs directory:
   - asgiref-3.3.0-py3-none-any.whl
   Start the scan_codebase pipeline execution...
   [...]
   Pipeline completed
   scan_codebase successfully executed on project asgiref2