github-actionsdevopseslint

How do I configure Microsoft Security DevOps' ESLint scan to produce the correct command-line output?


I am trying to configure MSDO's ESLint scan according to the instructions here:

https://github.com/microsoft/security-devops-action/wiki#ESLint-options

I would like to reproduce the command here(lifted from the current logs, made without custom configuration) as a starting point:

D:\a\_msdo\packages\node_modules\eslint\eslint.cmd
  --no-eslintrc 
  --config D:\a\_msdo\packages\node_modules\eslint/node_modules/@microsoft/eslint-plugin-sdl/config/required.js 
  --ext .js
  --ext .ts
  --ignore-pattern *.d.ts 
  --format D:\a\_msdo\packages\node_modules\eslint\node_modules\@microsoft\eslint-formatter-sarif\sarif.js --output-file D:\a\1\s\.gdn\.r\eslint\001\eslint.sarif **/*.{js,ts}

These options in the MSDO config do not clearly associate to the available command line flags. At the moment I have this:

{
  "tools": [
    {
      "tool": {
        "name": "ESLint",
        "version": "Latest"
      },
      "arguments": {
        "DisableDefaultConfigurationFile": true,
        "ResolvePluginsRelativeTo": "",
        "ConfigurationFile": "D:\a\_msdo\packages\node_modules\eslint/node_modules/@microsoft/eslint-plugin-sdl/config/required.js",
        "Environments": "",
        "Extensions": [".js", ".ts"],
        "Globals": "",
        "Parser": "",
        "ParserOptions": "",
        "AdditionalRulesDirectories": "",
        "Plugins": "",
        "Rules": "",
        "Fix": "",
        "FixDryRun": "",
        "FixTypes": "",
        "ExclusionsFilePath": "$(BuildSourcesDirectory)/.eslintignore"
        "DisableExclusions": "",
        "ExclusionPatterns": "*.d.ts",
        "Quiet": "",
        "MaxWarnings": "",
        "ExitOnFatalError": "",
        "OutputFile": "D:\a\1\s\.gdn\.r\eslint\001\eslint.sarif",
        "OutputFormat": "D:\a\_msdo\packages\node_modules\eslint\node_modules\@microsoft\eslint-formatter-sarif\sarif.js",
        "DisableInlineConfig": "",
        "ReportUnusedDisableDirectives": "",
        "Cache": "",
        "CacheLocation": "",
        "Debug": "",
        "Help": "",
        "Targets": "**/*.{js,ts}"
      }
    }
  ]
}

And what I have right now gets me this output:

##[error]NullReferenceException: Object reference not set to an instance of an object.

##[error]MSDO CLI exited with an error exit code: 1

Can anyone provide some guidance on how to use this config to produce the known good outcome above?

I've tried a ton of different configurations but at this point I am kinda guessing at everything and I can't figure out why I'm getting a null reference error.

I'm also unable to create a microsoft-security-devops tag and apply it, if anyone can help me out with that part...


Solution

  • I have at least resolve the null reference error issue.

    If anyone else is having the same battle, try setting all slashes/backslashes consistently. You can't just take a command line output that worked and feed the arguments back in - you have to standardize on '/' or '\' for all config parameters, according to the type of build agent running the pipeline.