Analyze Codebase (Command Line)

The focus of this tutorial is to guide you through scanning a codebase package using ScanCode.io.

Note

This tutorial assumes you have a recent version of ScanCode.io installed locally on your machine and running with Docker. If you do not have it installed, see our Installation guide for instructions.

Requirements

Before you follow the instructions in this tutorial, you need to:

  • Install ScanCode.io locally

  • Have Shell access on the machine where ScanCode.io is installed

Instructions

  • Create a new directory in your home directory that will be used to put the input code to be scanned.

$ mkdir -p ~/codedrop/
$ curl https://files.pythonhosted.org/packages/c0/e8/578887011652048c2d273bf98839a11020891917f3aa638a0bc9ac04d653/asgiref-3.3.0-py3-none-any.whl --output ~/codedrop/asgiref-3.3.0-py3-none-any.whl
  • Create an alias to the scanpipe command executed through the docker compose command line interface with:

$ alias scanpipe="docker compose -f ${PWD}/docker-compose.yml run --volume ~/codedrop/:/codedrop:ro web scanpipe"
  • Create a new project named asgiref:

$ scanpipe create-project asgiref
>> Project asgiref created with work directory /var/scancodeio/workspace/projects/asgiref-35519104
  • Add the package archive to the project workspace’s input/ directory:

$ scanpipe add-input --project asgiref --input-file /codedrop/asgiref-3.3.0-py3-none-any.whl
>> File copied to the project inputs directory:
  - asgiref-3.3.0-py3-none-any.whl
  • Add the scan_codebase pipeline to your project:

$ scanpipe add-pipeline --project asgiref scan_codebase
>> Pipeline scan_codebase added to the project

Note

The content of the input/ directory will be copied in the codebase/ directory where extractcode will be executed before running scancode. Alternatively, the codebase content can be manually copied to the codebase/ directory in which case the --input option can be omitted.

  • Run the scan_codebase pipeline on your project. The pipeline execution progress is shown within the following command’s output:

$ scanpipe execute --project asgiref
>> Pipeline scan_codebase run in progress..
   Pipeline [scan_codebase] starting
   Step [copy_inputs_to_codebase_directory] starting
   Step [copy_inputs_to_codebase_directory] completed in 0.00 seconds
   Step [extract_archives] starting
   [...]
   Pipeline completed
   scan_codebase successfully executed on project asgiref
  • Finally, export the scan results as JSON format:

    $ scanpipe output --project asgiref --format json --print > asgiref-3.3.0_results.json
    

Tip

The inputs and pipelines can be provided at the same time when calling the create-project command. For instance, the following command will create a new project named asgiref2, add the package archive as the project input, add the scan_codebase pipeline to the project, and execute it:

$ scanpipe create-project asgiref2 \
    --input-file /codedrop/asgiref-3.3.0-py3-none-any.whl \
    --pipeline scan_codebase \
    --execute
>> Project asgiref2 created with work directory /var/scancodeio/workspace/projects/asgiref2-bea7a5e9
   File copied to the project inputs directory:
   - asgiref-3.3.0-py3-none-any.whl
   Start the scan_codebase pipeline execution...
   [...]
   Pipeline completed
   scan_codebase successfully executed on project asgiref2