AK82 (Community Member) asked a question.
Can someone please tell me the difference between creating an SCA agent via the Operating System vs the integration options?
I understand the integration option is that you can create an agent to scan your repos in Github/Bitbucket/etc.
But how does the Operating Systems options work? Does this option mean to manually kick off commands from my local pc to scan the online repos? When would I use the OS options? This is what confuses me. Yes I did read the documentation but I still find it confusing.
.png){kind=logo}
The OS options provide the steps to provision a command line interface ("cli") agent. You can use this agent for whatever you want. It's great for running scans and generally experimenting with the agent's different command line options to become familar. Run "srcclr --help" to see all the options. The "test" command is nice to check if you have all the required software to run scans for a particular language/package manager (e.g., "srcclr test --maven"). Keep in mind the cli agent would need to be upgraded to a new version manually unlike the CI options where the latest version is downloaded on the fly via a curl command.
Hope that helps.
thank you for your reply but just to confirm, both cli and CI both relate to online repos correct?
If the CI works with online repos, then why would I use the cli? Would you say the cli is more of a manually method to scan my online repos?
Well, both cli and CI agents can scan online repos OR local repos. For a cli agent, you include the --url option for an online repo and provide the repo's root directory for a local one. With the --url option, the agent first uses git to clone the repo to a local temp directory, so it really ends up being the same thing.
Yes, the cli agent is more of a manual way to do scans and various tests. But it doesn't have to be that way. A cli agent could certainly be used to build a custom SCA scanning solution as well. Typically the goal is to automate SCA scanning in CI pipelines and for this you would use a CI agent(s). It can be done in just about any CI tool even if it's not listed (Azure DevOps for example).
P.S. You can find many example/test repos to scan at https://github.com/srcclr.
>Well, both cli and CI agents can scan online repos OR local repos
Interesting, can you please explain more about local repos? Do you mean if for example I had my files locally on my C: drive? Instead of a upload and scan, I can create an agent to scan a particular folder on my computer?
Yes, absolutely. The syntax would be "srcclr scan [directory]" where [directory] is the local folder containing your Git repository. The scan command requries either [directory] or the --url option for an online repo, but not both. (Run "srcclr --help" to see all command line options for the agent)