ballerina/tool_scan Ballerina Tool

Scan Tool Overview

Static Code Analysis (SCA) uses tools to examine code without executing the code. They are used for identifying potential issues like bugs, vulnerabilities, and style violations. SCA improves software quality by detecting issues early, ensuring better maintainability, and providing enhanced security. Ballerina supports SCA using the Ballerina scan tool.

The scan tool compile and perform static code analysis, print results to the console, and report results. It analyzes the source code defined in each module when compiling a package or analyzes the given source file when compiling a single Ballerina file.

Note: Analyzing individual Ballerina files of a package is not allowed.

Synopsis

bal scan [OPTIONS] [<package>|<source-file>]

CLI Options

• Specify target path for saving analysis reports. (Only for ballerina build projects)

--target-dir=<path>

• Generate an HTML report containing the analysis results. (Only for ballerina build projects)

--scan-report

• List all available rules

--list-rules

• Run analysis for a specific set of rules.

--include-rules=<rule1, ...>

• Exclude analysis for a specific set of rules.

--exclude-rules=<rule1, ...>

• Define platform(s) to report results. The user can define more than one platform.

--platforms=<platformName1, ...>

Examples

• Run analysis against all Ballerina documents in the current package, print results to the console, and save results in JSON file format in the target directory.

bal scan

• Run analysis against a standalone Ballerina file and print results to the console. The file path of the Ballerina file can be relative or absolute.

bal scan main.bal

• Run analysis and save analysis results in a specified directory.

bal scan --target-dir="results"

• Run analysis and generate an HTML report in the target directory.

bal scan --scan-report

• View all available rules.

bal scan --list-rules

• Run analysis for a specific rule.

bal scan --include-rules="ballerina:101"

• Run analysis for a specific set of rules.

bal scan --include-rules="ballerina:101, ballerina/io:101"

• Exclude analysis for a specific rule.

bal scan --exclude-rules="ballerina/io:101"

• Exclude analysis for a specific set of rules.

bal scan --exclude-rules="ballerina:101, ballerina/io:101"

• Run analysis and report to sonarqube

bal scan --platforms=sonarqube

• Run analysis and report to multiple platforms

bal scan --platforms="sonarqube, semgrep, codeql"