• English

    • Scan command

    The agent is launched using the scan command with possible scanning options:

    Launch options

    Available and required options for launching the agent for scanning can be viewed using the help flag.

    $ ./johnny scan --help
NAME:
   johnny scan - Run scan

USAGE:
   johnny scan [command [command options]]

COMMANDS:
   dir          Scan directory
   file         Scan file
   image        Scan image
   bom          Scan bom
   java         Scan java
   js           Scan js
   go           Scan go
   clang        Scan clang
   objective-c  Scan objective-c
   csharp       Scan csharp
   php          Scan php
   python       Scan python
   ruby         Scan ruby
   rust         Scan rust
   conda        Scan conda
   swift        Scan swift
   hex          Scan hex

OPTIONS:
   --alerts-format string                        Alerts format. Supported formats: coloredtable, table, text, csv, json. Default output to console. Supports multiformat. Example: 'coloredtable,csv>>csv.csv' (default: "coloredtable")
   --block-on-empty-result                       Block on empty result
   --bom-format string                           Bom format. Supported formats: cyclonedx_v1_4_json,cyclonedx_v1_5_json,cyclonedx_v1_6_ext_json,cyclonedx_v1_6_json,cyclonedx_v1_7_json (default: "cyclonedx_v1_6_json")
   --bom-path string                             Path for save bom file (default: "bom.json")
   --branch-or-tag string                        Reference to repository branch or tag (e.g. refs/tags/v1.0)
   --cg-lang string                              Language to parse call graph with. Supported languages: csharp,go,java,javascript,kotlin,python
   --cg-path string                              Path to call graph for vulnerability reachability analysis
   --cloud-resolve                               Activate cloud resolve
   --commit string                               Commit
   --create-project                              Create project in CodeScoring if not exists
   --create-project-categories                   Create project categories in CodeScoring if not exist
   --create-project-group                        Create group in CodeScoring if not exists
   --exclude-envs string                         Exclude the listed dependency environments (scopes) from the result, comma-separated, e.g. --exclude-envs=test,dev
   --format string, -f string                    Report format. Supported formats: coloredtable, table, text, junit, sarif, csv, gl-dependency-scanning-report, gl-code-quality-report. Default output to console. Supports multiformat. Example: 'coloredtable,junit>>junit.xml' (default: "coloredtable")
   --group-vulnerabilities-by string, -g string  Group vulnerabilities by. Supported kinds 'vulnerability', 'affect' (default: "vulnerability")
   --ignore string [ --ignore string ]           Ignore paths (--ignore first --ignore "/**/onem?re")
   --ignores-format string                       Displays the ignores of the specified project with formatting. Supported formats: coloredtable, table, text, csv, json. Default output to console. Supports multiformat. Example: 'coloredtable,csv>>csv.csv' (default: "coloredtable")
   --include-envs string                         Include only the listed dependency environments (scopes) in the result, comma-separated, e.g. --include-envs=compile,runtime
   --license string                              Project license code
   --no-summary                                  Do not print summary
   --no-wait                                     No wait analysis results
   --only-hashes                                 Search only for direct inclusion of dependencies using file hashes
   --policy-ignores                              Displays the ignores
   --project string                              Project name in CodeScoring
   --project-categories string                   Category names for created project in CodeScoring (comma-separated list)
   --project-group string                        Group for created or added project in CodeScoring
   --project-proprietor string                   Proprietor for created project in CodeScoring
   --reachability-format string                  Reachability paths format. Supported formats: json, text, table, coloredtable. Example: 'json>>reachability.json'
   --save-results                                Save results to CodeScoring. Used just together with project name
   --set-as-default-version                      Set branch or tag as the default project version in CodeScoring
   --sort-vulnerabilities-by string, -s string   Sort vulnerabilities by. Comma separated field names. For DESC - write field name with prefix '-'.
                                                 FieldNames: 'vulnerability', 'fixedversion', 'cvss2', 'cvss3', 'cwes', 'links', 'affect' (default: "-cvss4,-cvss3,-cvss2,fixedversion,vulnerability,cwes,links,affect")
   --stage string                                Policy stage (build, dev, source, stage, test, prod, proxy) (default: "build")
   --timeout int, -t int                         Timeout of analysis results waiting in seconds (default: 3600)
   --vex-file string                             Path to CycloneDX VEX file to apply before analysis
   --with-hashes                                 Search for direct inclusion of dependencies using file hashes
   --help, -h                                    show help

GLOBAL OPTIONS:
   --api_token string     API token for integration with CodeScoring server (required if api_url is set) (default: "api_token")
   --api_url string       CodeScoring server url (e.g. https://codescoring.mycompany.com) (required if api_token is set) (default: "api_url")
   --config string        config file (default: "codescoring-johnny-config.yaml")
   --localization string  Localization language (en|ru) (default: "en")
   --progress-bar string  Progress bar formats: spinner,text (default: "text")

    The --api_url parameter must contain the full address of the on-premise platform. The value for --api_token can be taken from the platform user profile.

    Specifying the --project parameter will allow scanning to apply policies related to the selected project.

    To specify the path to a SBOM save file, you must add the --bom-path parameter to the request or assign the bom-path variable in the config file. By default, the SBOM is saved in the startup directory in the file bom.json.

    Run results

    Depending on the run result and launch parameters, the agent returns the corresponding exit code:

    • 0 – successful run, no issues were detected;
    • 1 – as a result of the scan, problems were found that correspond to the configured security policies, user action is required;
    • 2 – run failure;
    • 3 – empty result, no artifacts were found for analysis. Returned only if the --block-on-empty-result parameter is set to true.

    Failed resolve

    2026.35.0 If the agent failed to resolve dependencies for some manifests, the list of these manifests is printed at the end of the scan results under the Failed resolve heading. Use it to check whether the build environment provides everything required for resolution.

    Priority of settings

    Since agent startup parameters can be configured in multiple ways, if two or more methods are used at the same time, the agent will accept parameters in the following priority order:

    1. Value of the scan-technology command (if used);
    2. Value of the command flag;
    3. Value of environment variable;
    4. Value from config file.

    Launch without the platform

    If the --api_url and --api_token parameters are not specified, the scan will be launched without interacting with the CodeScoring platform. The scan will generate an SBOM file containing only a list of components and their versions without any additional information.

    Was this page helpful?