Highlight Automated Code Scan (Command Line)

This page details how to automate source code scans by leveraging the Highlight command line and integrating it within your build or CI/CD environments.  This will allow you to continuously track and monitor software health and cloud readiness of your projects and applications. For any questions not addressed in this documentation, don’t hesitate to contact our support team.

Before getting started…

What is a Command Line?

For those who are not familiar with this concept, the Highlight command line is a Java binary which can be programmatically run using scripts and/or automated tasks. It replaces the Local Agent user interface using options you can configure in order to automate the code scan and results upload. In other words, you can configure the command line once to automatically scan the source code of a folder multiple times.  You can also exclude (for instance) some technologies/folders you don’t want to scan, and upload the results automatically to the SaaS platform on a regular timeline (e.g., every sprint/release).

Also, note that you can also run the command line as a Docker container. Our Docker is especially recommended for MacOS users.
Download the Command Line 5.3.39
5046

Please read and accept the license agreement prior to downloading the command line.

I have read and agree with the end-user license agreement

How to use the command line

Examples

Find below some examples of options you can reuse for your own code scan configuration.

A simple code scan of a Windows folder

java -jar HighlightAutomation.jar --workingDir "C:\highlight-myproject" --sourceDir "C:\myproject\src"  --skipUpload

A simple code scan of a Linux folder

java -jar HighlightAutomation.jar --workingDir "/home/user/highlight-myproject/" --sourceDir "/home/user/svn/myproject/src/"  --skipUpload

Scan only specific technologies (e.g. Java and Python)

java -jar HighlightAutomation.jar --workingDir "C:\highlight-myproject" --sourceDir "C:\myproject\src" --technologies "Java,Python" --skipUpload

Exclude folders with a specific string (e.g. test, jquery)

java -jar HighlightAutomation.jar --workingDir "C:\highlight-myproject" --sourceDir "C:\myproject\src" --ignoreDirectories "test,jquery" --skipUpload

Exclude paths with a specific pattern (e.g. vendor/js)

java -jar HighlightAutomation.jar --workingDir "C:\highlight-myproject" --sourceDir "C:\myproject\src" --ignorePaths ".*\/vendor\/js" --skipUpload

Scan and automatically upload results to the platform

java -jar HighlightAutomation.jar --workingDir "C:\highlight-myproject" --sourceDir "C:\myproject\src" --login "john.doe@acme.com" --password "*******" --applicationId 1234 --companyId 5678 --serverUrl "https://rpa.casthighlight.com"

Exclude files from the scan if they contain “foo” in the file name independently of the extension

java -jar HighlightAutomation.jar --workingDir "C:\highlight-myproject" --sourceDir "C:\myproject\src" --ignoreFiles ".*foo.*" --skipUpload

Exclude files from the scan if they contain “foo” name and have a .js extension

java -jar HighlightAutomation.jar --workingDir "C:\highlight-myproject" --sourceDir "C:\myproject\src" --ignoreFiles ".*foo.*\.js" --skipUpload

Exclude files from the scan based on a specific file extension (e.g. .vue)

java -jar HighlightAutomation.jar --workingDir "C:\highlight-myproject" --sourceDir "C:\myproject\src" --ignoreFiles ".*\.vue" --skipUpload

Command Line Options

--help
 Displays the different options
--printTechnos
 Print the supported technologies (e.g. Java, Python, COBOL, etc.)

Scan Options

--sourceDir (mandatory)
 The absolute path to the directory that contains the source code to be scanned by Highlight.
--workingDir (mandatory)
 This is the absolute path to the Highlight working directory. Within this directory, a Highlight temporary folder ("HLTemporary") will be created and will contain scan result files (CSVs). To make it short, this is the directory where you want to store scan results.
--technologies (optional)
 Technologies you want to explicitly scan in your sources. Separated by "," and sorted by preferences (See --printTechnos option above).
--ignoreDirectories (optional)
 Directory name patterns to ignore during the scan (e.g. test folders, .git, etc.). Separated by ",". Source code within directories matching with these patterns will be automatically excluded from the scan.
--ignorePaths (optional) List of regular expressions to ignore paths. Source code within directories matching with this regexp will be automatically excluded from the scan.

--ignoreFiles (optional)
List of regular expression to ignore file names. Separated by ",". Files matching with these patterns will be automatically excluded from the scan. Example to exclude all files containing "foo" with a .js extension: --ignoreFiles ".*foo.*\.js"
--analyzerDir (optional) Alternate directory for Highlight's analyzer scripts.
--perlInstallDir (optional)
 Directory of perl installation (default: C:\Program Files\CAST\HighlightAgent\COTS\strawberry-perl-5.12.3.0).
--keywordScan (optional)
 Path and filename of your KeywordScan XML configuration file (e.g. C:\temp\KeywordScanner_GDPR.xml). Read this post for more information on the feature.
--skipUpload (optional)
 Will generate CSV results only, no result upload will be performed.
--analyzeBigFiles (optional)
 Will bypass the file size limitation of the analyzers (will eventually take longer to scan).

Upload Options

Below are the required options to use when you want to automatically upload scan results to the Highlight platform. Then, the option “–skipUpload” should be removed.

--login (mandatory)
 Login of an active Highlight user.
--password (mandatory)
 Password for the login indicated above.
--basicAuth
Alternatively to login/password, you can use this option to pass your credentials encoded in base64
--tokenAuth
Alternatively to Basic authentication, you can use this option to pass your OAuth token

--companyId (mandatory) Identifyer for the company (can be retrieved from the Highlight portal, it is the ID displayed in the url when clicking on the top-level domain in "MANAGE PORTFOLIO > MANAGE APPLICATIONS" from the menu).
--applicationId (mandatory)
 Identifyer for the application (can be retried from the Highlight portal, it is the ID displayed in the url when editing an application in "MANAGE PORTFOLIO > MANAGE APPLICATIONS").
--serverUrl (mandatory)
 The Highlight server instance where the results has to be uploaded (user credentials have to work on this server). E.g. 'https://rpa.casthighlight.com'
--snapshotDatetime (optional)
 Time (epoch) to use for uploaded application snapshot.
--snapshotLabel (optional) The application snapshot label you want to display on the application result page on the portal (e.g. release version, build number, etc.).

Log files

The log file (HLAutomation.log) is produced after the command line is run and is stored in the working directory (–workingDir) that has been set in the options.

Requirements

For Windows
Prior using the command line, it is preferable to install the Highlight Local Agent on your machine, in order to embed the required Perl binaries. Alternatively, you can install the required Perl distribution (Strawberry) if you don’t want to install the Local Agent. The Local Agent can be downloaded from your Highlight user account, in the APPLICATION SCANS page.

 

For Linux

The following components must be installed on your machine: Perl 5 (tested on Strawberry 5.12.3.0), libjson-perl, libxml-libxml-perl

$>perl -v
on debian/ubuntu systems
$>dpkg –get-selections libxml-libxml-perl libjson-perl
Java 8
$>java -version

 

For MacOS

For MacOS users, using our Docker image is recommended to run the command line as a container.

$>perl -v

$>cpan install XML::LibXML
$>cpan install JSON

Troubleshooting
CLI error codes


0
– Ok

1 – Command Line general failure
2 – Command Line options parse error
3 – Command Line techno discovery error
4 – Command Line analysis error
5 – Command Line result upload error
6 – Command Line source dir or output dir validation error
7 – Command Line result saving to zip file error
8 – Command Line upload from zip file error

 

CLI logs

Running the command line will create an HLAutomation.log that contains traces of a scan. This file is located in the specificed working directory (–workingDir).

Integration Templates & Tutorials

Feature Focus: Re-calculate Software Health scores in real-time based on folder exclusions

This article explains how to use the CAST Highlight feature that allows users to re-calculate the Software Health scores and sizing metrics of an application in real-time based on specific folder exclusions directly in the user interface.

Feature Focus: How to use Application Tags?

Tags are a very powerful complement to domains and other filters (technologies, survey questions, etc.) as they provide an extra layer of flexibility to organize and visualize your portfolio. This article explains how to create and manage them to filter, segment and organize your application portfolio in CAST Highlight

Feature Focus: Data Retention Policy and Notifications

Some of our clients use CAST Highlight to analyze their applications and generate Software Intelligence insights on a weekly or daily basis. Over time, this generates a significant amount of data available in the CAST Highlight portal. In order to improve clarity in results and maintain an optimized user experience, CAST Highlight has implemented a scan retention policy. This article explains the retention policy and how to preview application snapshot changes in your portfolio, if the policy is applicable.

Portfolio Advisor for Cloud, an automated and smart way to segment an application portfolio for Cloud migration

Based on a multi-dimensional analysis of CAST Highlight’s Software Intelligence insights, a simple click calculates the recommended Cloud migration segment (rehost, refactor, rebuild, etc.) for each application in a portfolio. Read this article to learn how this capability works and how to leverage it within your organization.

Analyze Open Source weaknesses before they become known vulnerabilities with CAST Highlight’s OSSIDB

While it is important to ensure that your application is not exposed to known vulnerabilities from the National Vulnerability Database (NVD), a hacker could exploit software weaknesses that are not referenced yet in the NVD. CAST Highlight now identifies these security flaws on popular Open Source components as a result of CAST’s unique understanding of software structural quality. This article explains how it works and describes how to use this capability for making more informed decisions about Open Source risk.

Feature Focus: API/CLI User Token Management

CAST Highlight’s API is now used extensively across our user base for various scenarios such as building custom reports or integrating our insights into third-party products (e.g., MEGA, Alphabet, Azure DevOps, and Atlassian JIRA to name a few). Hence, there was a need for a more secure and flexible way to manage user access. This article describes how to create, manage, and use OAuth2 tokens to work with the CAST Highlight API or the command line interface (CLI).

Feature Focus: Cloud Containerization Insights

CAST Highlight’s new insights on containerization will help you understand exactly where and how an application needs to change. This article explains the benefits of application containerization and how to get containerization insights from CAST Highlight’s dashboards, exports, and API.

Feature Focus: Enhanced Technical Debt Estimates

Technical Debt is useful measure to analyze the health of an application portfolio and start prioritizing and quantifying remediation effort. We recently revisited and enhanced the Technical Debt calculation in CAST Highlight to increase estimate accuracy, to make it more flexible, and to deliver more actionable insights. Read this article to learn more about these enhancements, the impact on current results and the features it enables. This change will take effect on December 12, 2020.