I am trying to configure MSDO's ESLint scan according to the instructions here:
https://github.com/microsoft/security-devops-action/wiki#ESLint-options
I would like to reproduce the command here(lifted from the current logs, made without custom configuration) as a starting point:
D:\a\_msdo\packages\node_modules\eslint\eslint.cmd
--no-eslintrc
--config D:\a\_msdo\packages\node_modules\eslint/node_modules/@microsoft/eslint-plugin-sdl/config/required.js
--ext .js
--ext .ts
--ignore-pattern *.d.ts
--format D:\a\_msdo\packages\node_modules\eslint\node_modules\@microsoft\eslint-formatter-sarif\sarif.js --output-file D:\a\1\s\.gdn\.r\eslint\001\eslint.sarif **/*.{js,ts}
These options in the MSDO config do not clearly associate to the available command line flags. At the moment I have this:
{
"tools": [
{
"tool": {
"name": "ESLint",
"version": "Latest"
},
"arguments": {
"DisableDefaultConfigurationFile": true,
"ResolvePluginsRelativeTo": "",
"ConfigurationFile": "D:\a\_msdo\packages\node_modules\eslint/node_modules/@microsoft/eslint-plugin-sdl/config/required.js",
"Environments": "",
"Extensions": [".js", ".ts"],
"Globals": "",
"Parser": "",
"ParserOptions": "",
"AdditionalRulesDirectories": "",
"Plugins": "",
"Rules": "",
"Fix": "",
"FixDryRun": "",
"FixTypes": "",
"ExclusionsFilePath": "$(BuildSourcesDirectory)/.eslintignore"
"DisableExclusions": "",
"ExclusionPatterns": "*.d.ts",
"Quiet": "",
"MaxWarnings": "",
"ExitOnFatalError": "",
"OutputFile": "D:\a\1\s\.gdn\.r\eslint\001\eslint.sarif",
"OutputFormat": "D:\a\_msdo\packages\node_modules\eslint\node_modules\@microsoft\eslint-formatter-sarif\sarif.js",
"DisableInlineConfig": "",
"ReportUnusedDisableDirectives": "",
"Cache": "",
"CacheLocation": "",
"Debug": "",
"Help": "",
"Targets": "**/*.{js,ts}"
}
}
]
}
And what I have right now gets me this output:
##[error]NullReferenceException: Object reference not set to an instance of an object.
##[error]MSDO CLI exited with an error exit code: 1
Can anyone provide some guidance on how to use this config to produce the known good outcome above?
I've tried a ton of different configurations but at this point I am kinda guessing at everything and I can't figure out why I'm getting a null reference error.
I'm also unable to create a microsoft-security-devops tag and apply it, if anyone can help me out with that part...
I have at least resolve the null reference error issue.
If anyone else is having the same battle, try setting all slashes/backslashes consistently. You can't just take a command line output that worked and feed the arguments back in - you have to standardize on '/' or '\' for all config parameters, according to the type of build agent running the pipeline.