search

azsk / ADOScanner-docs

Welcome to the documentation of ADO Security Scanner!
MIT License
64 stars 14 forks source link

Consider adding static code analysis step in your pipelines #69

Closed leandromsft closed 2 years ago

leandromsft commented 2 years ago

Hi Folks,

I ran the scanner in my project and the return rule Consider adding static code analysis step in your pipelines (ADO_Build_Config_Add_Static_Code_Analyzer) with failure status

But my pipeline has a sonar task configured

My question is: What does this rule validate?

Thank you Leandro Prado

juhi037 commented 2 years ago

Hi @leandromsft. The said control is not automated meaning that ADO Scanner does not do any evaluations for this control. It is upon the user to validate the control manually with the help of the recommendation. Since its not automated the control result should be "Manual" instead of "Failed". Please check if you are using the latest version of ADO Scanner (1.17.0). Let me know if the results you see are different from this. You can find the list of all automated controls here: https://github.com/azsk/ADOScanner-docs/tree/master/References/Control%20Coverage

leandromsft commented 2 years ago

Hi @juhi037 , thank you for help. I executed the scanner again and the result is "manual" for this control. Thank you