Analyzing Source Code with the Code Reader

This section of the guide is designed for team members with a Contributor role — typically application owners. If your team wants to leverage automation capabilities instead of the desktop app, the same analyzers are available through the CAST Highlight Command Line Interface (CLI), which integrates into CI/CD pipelines.

Download the binary that corresponds to the operating system where the Code Reader will be installed, then follow the installer wizard steps. The Code Reader is packaged with Perl and the CAST Highlight CLI, both required elements.

Prefer automation? Download the CAST Highlight CLI instead — it contains the same analyzers as the Code Reader and integrates within your CI/CD environment. See the Command Line (CLI) section below.

CAST Highlight analyzes code at the file level and doesn't evaluate logical links or dependencies between files — every file inside the scan scope is treated as part of the application. To get accurate, consistent results, use the folder/file exclusion features to prepare your scope first.

• Open source & COTS packages — include the folders that contain them if you want to identify them (often grouped under a third-party subfolder, with main code under src/main).
• Test classes — exclude them unless you specifically want them scanned.
• Generated code (e.g. *.t.ds, *.flow.js) — exclude it, since the development team can't manage the health of auto-produced code.
• SCM, build & deployment folders (e.g. .git, .svn) — exclude for more consistent results.
• Dependency manifests (e.g. pom.xml, build.gradle, package.json, .vcsproj) — keep these in scope if you want framework and dependency insights.

Once the scan is finished, you can:

• Save Results — produces the ZIP file you'll upload to the SaaS platform for the corresponding application.
• Open / Save scan logs.
• Re-scan the selected folder, or go back to the initial screen to scan another folder.
• Save scan settings (a .properties file) to ease future automation through the CLI.

Common reasons a file is excluded

These settings are shared with the Command Line and can be retrieved from the Command Line (CLI) section below. Reset to default values at any time with "Reset Configuration".

• Under Application Scans, click the campaign, then the application.
• Click the "Survey" button and answer the questions for each section.
• If the survey is de-activated for your organization, simply click "Submit" — you're finished.

Survey progress is shown at the top of the screen. Once all mandatory questions are answered, you can submit your results — though answering every question enriches your organization's CAST Highlight data.

• Once all required CSV files are uploaded and any mandatory survey questions are complete, click "Submit" on the application under Application Scans.
• This step is required to populate results in the portal.

The CAST Highlight command line (HighlightAutomation.jar) is a Java binary that enables automated source code scans inside CI/CD environments. It replaces the Code Reader's desktop UI with fully scriptable options, so continuous software health and cloud readiness monitoring can run unattended on every build.

Requirements

Version 5.12.18 is available for download after accepting the end-user license agreement, from the Application Scans section of the portal.

Core Syntax

Mandatory Options

Scan Options

Git Repository Options

Upload Options

Utility Options

Usage Examples

Default Excluded Directories

The CLI automatically skips these common directories, so you rarely need to list them yourself with --ignoreDirectories:

.git* .svn .circleci .scannerwork .azure .vscode test/ tests/ sample/ samples/ example/ examples/ demo/ __MACOSX/ .DS_Store debug/ /obj/Release/ /obj/Debug/ /bin/Release/ /bin/Debug/ node_modules/ vendor/ packages/ Pods/ bin/ build/ dist/ out/ target/ mocks swagger karma e2e

Default Excluded Files

Test and flow files are excluded by default:

*.t.ds *.flow.js *.spec.ts *.spec.js *-spec.js *.specs.js *-specs.js

Exit Codes

Output

A log file named HLAutomation.log is created in the working directory after each run. Scan results are generated as CSV files under HLTemporary/analysis/, and discovery logs are written to HLTemporary/discover/.

Binary extensions considered for Software Composition Analysis

CAST Highlight's analyzers also take binary extensions into account to help detect third-party components: .jar (Java), .dll (Windows), .a, .lib, .so. After a scan, binary file information is stored in a separate result CSV (BinaryLibraries.csv) which needs to be uploaded along with the other CSV results.

Customer data is never sent over the internet by e-mail or any other protocol. The result of the code-level analysis performed by the Code Reader on client infrastructure is uploaded to the website over HTTPS and encrypted in transit using a 256-bit encryption mechanism. The Code Reader produces several types of CSV result files — all readable, so feel free to open them and inspect their structure and content.

Output File Attributes

Section Attributes

The section data defines the file structure for the specific analyzer along with additional analyzer attributes. Scan metrics are anonymized (e.g. Id_123) and decoded by the portal once the file has been uploaded.

File Output Structure Example

File Output Attribute Definitions

A file summary is generated for each file analyzed, following the Section format above. Example:

Known Limitations