Pipelines

Put the scanner on your build server

Your build server and your Git Code Review server are usually two different machines, and the build server has never heard of the other one. That is on purpose. The check reads the code already sitting on the build server and runs the engines against it: no token, no configuration, no call to the Git Code Review server, nothing sent anywhere. It works even when that server is switched off. What the build server does need is the checking tool itself, and you put that there once.

What to do

Know what is not happening. The build server does not download this product's source code. It downloads your application, which it already does in order to build it. And findings from a build do not appear on the Git Code Review dashboard, because nothing was sent there: the dashboard shows what the server's own scans found. Two separate records of the same code, deliberately.
Pick the way that matches your build servers. If they already pull container images from a company registry, use the registry. If they do not run containers at all, install the tool on them directly. If you are unsure, ask whoever looks after them which of those two sentences is true.
Registry, step one: on the Git Code Review server, give the image a name pointing at your registry. Replace the address with your own.
```
docker tag github-code-review:1.0.1 registry.example.com/security/ghscan:1.0.1
```

Registry, step two: send it there.

docker push registry.example.com/security/ghscan:1.0.1

Registry, step three: use that name in the build. Everything here is fixed text except the registry address and the name of your main branch.

docker run --rm -v "$WORKSPACE:/src:ro" --entrypoint /opt/gcr/bin/ghscan registry.example.com/security/ghscan:1.0.1 review /src --diff origin/main --fail-on secrets

Direct install, step one: install the six engines on each build server. The script ships with the product and is safe to run more than once.
```
sudo contrib/install-deps.sh
```
Direct install, step two: copy the tool into place. It finds everything relative to itself, so these two directories side by side are a complete install.
```
sudo mkdir -p /opt/ghscan &amp;&amp; sudo cp -r bin lib /opt/ghscan/
```

Direct install, step three: call it directly from the build.

/opt/ghscan/bin/ghscan review "$WORKSPACE" --diff origin/main --fail-on secrets

Name a version rather than writing latest. A build following latest changes what it enforces on a day nobody chose, and the first anybody hears of it is a build failing on code that did not change.

Worth knowing

Build servers usually download only the newest commit, to save time. If yours does, the branch you are comparing against is not there and the check quietly examines the whole repository instead of your change. It then reports the entire backlog on every build, and people switch it off within a fortnight. Fetch the main branch first, or turn the shallow download off.

Product

Start here

More

Put the scanner on your build server

What to do

Worth knowing

Other guides

Install the editor plugin on Windows

Install the editor plugin on macOS or Linux

Exclude one credential everywhere it appears