Is this project maintained

[eliassal]

Hi, can you please tell me if this project maintained? I cloned the repo vs2019 and opened it in VS 2022 but it is not compiling because of the netcoreapp 2.0, how this can be resolved?

[JarLob]

It compiles both on my machine and in the cloud (you may look into the workflow to check what it is needed to build it). It targets .NET Standard 2.0 and .NET 4.8, so most probably your local installation lacks these components.

[eliassal]

Thanks, I reopened VS2022 and did Nuget rsore and was able to compile (I have already netapp2).
I ran my compiled security-scan.exe on 2 SLNs, one worked correctly, a 2nd raised the following

which I am not sure is it related to the securit scan tool or the project itself

here is a snapshot for the sln that went through correctly

By the way, is it possible to run the code against *.csproj or vbproj file?if yes, how? I use heavily VSC which does not create sln file.
Thanks in advance

[eliassal]

Also, if you allow, can you please point me to a document or a tutorial on how to use this scan tool in an Azure Build/Release Pipeline? Thanks again

[JarLob]

Also, if you allow, can you please point me to a document or a tutorial on how to use this scan tool in an Azure Build/Release Pipeline? Thanks again

Did you check already the documentation from https://security-code-scan.github.io/? SCS doesn't have specific integration for Azure CI, but it is a command line tool which you may call in multiple ways.

[JarLob]

By the way, is it possible to run the code against *.csproj or vbproj file?if yes, how? I use heavily VSC which does not create sln file. Thanks in advance

The standalone tool calls OpenSolutionAsync, but the MSBuildWorkspace has OpenProjectAsync too, so I guess it is possible to implement.
BTW, the standalone tool is not the only way to invoke SCS. It can be added to a specific project as a NuGet package.

[eliassal]

OK Thanks, the problem is that I have so many tasks and I have no time to implement for the time being. Regards

[JarLob]

FYI, it was implemented in 5.6.4

[eliassal]

Jarlob, can you please tell me how? Thanks in advance

[JarLob]

Update to the latest version. Pass csproj instead of sln.

[eliassal]

So many thanks for your prompt hep and support. It works like a charm with csproj. Great work
Canyou please tell me what is the difference between this tool and SonarQube? Do they do the same thing, or in other words, does it satisfy the same objectif?

[JarLob]

SCS is similar to SonarQube, Acunetix, Coverity and others in a sense that it is SAST tool.

[eliassal]

Thanks got it.