search

ShiftLeftSecurity / sast-scan

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.
https://discord.gg/DCNxzaeUpd
Apache License 2.0
788 stars 112 forks source link

Docker run doesn't recognize the token #397

Open 0GiS0 opened 10 months ago

0GiS0 commented 10 months ago

Hi all!

I'm trying to scan a .NET project but sast-scanner requires the token for that. If I choose sl it works perfectly:

export SHIFTLEFT_ACCESS_TOKEN=$SL_TOKEN
sl analyze --app shiftleft-csharp-demo --csharp --wait netcoreWebapi.csproj

But If I try to use the container It seems It doesn't receive the token in the env that It expects:

docker run --rm -e "WORKSPACE=${PWD}" -e SHIFTLEFT_ACCESS_TOKEN="$SL_TOKEN" -v $PWD:/app shiftleft/scan scan --src /app --out_dir /app/reports

image

Any thoughts?

Thank you so much!!

Ferada commented 10 months ago

Try also setting the SHIFTLEFT_ORG_ID environment variable to your organization ID, then it should proceed further.

Are you interested in the specific output of this tool? sl is generally better supported.