This tutorial helps you use the bootstrap command to create a new project for a C# code base.
In this tutorial you will create a snapshot to allow you to analyze the DevSkim code base. DevSkim is an open-source framework of IDE extensions and language analyzers written in C#.
The tutorial covers basic use of the
odasa bootstrap tool to retrieve source files, start code analysis and export a snapshot of the project.
Time needed: 10–15 minutes
This tutorial assumes:
- You are using Microsoft Windows.
- You have installed Semmle's analysis software—see Installing Semmle Core.
- You have set up the environment for Semmle Core—see Setting up the environment.
- You have installed Git and added it to your path – see http://git-scm.com/book/en/Getting-Started-Installing-Git.
Create a new project with odasa bootstrap
The quickest way to create a new Semmle analysis project is to use the
odasa bootstrap command. The bootstrap tool steps you through the process and generates configuration files that you can reuse later. The process described here gives the steps required to analyze a particular C# project. Other projects will require different responses to some of the bootstrap prompts.
The bootstrap tool's on-screen instructions indicate what you should enter at each step. However, the first time you run it, you may find it useful to refer to the following procedure for some additional information.
Open a command console.
- Change to the directory where Semmle Core is installed – for example,
Enter the following command to make sure the environment is set up correctly:
Enter the following command to start the bootstrap tool:
The tool guides you through the rest of the process. The remainder of the steps provided below give some additional guidance that you may find useful the first time you run the bootstrap tool.
For additional on-screen information, enter
?at any of the prompts.
Project languageThe DevSkim project is written in C#.
- Make sure to enter a capital
Cfor C# and not a lowercase
- The languages listed here depend on your Semmle license and the version of the Semmle software you have installed. All recent releases support C# analysis, so if you do not see the C# option you should check that your license includes C#.
- Make sure to enter a capital
The DevSkim project uses Git as the version control system for its source code.
The DevSkim project stores its source code in GitHub.
bootstraptool with the URL of the repository makes it possible to automatically download the latest version of the software each time an analysis is triggered.
Press Enter without specifying a branch name.
The bootstrap tool will default to cloning the code from the "master" branch for the project.
This project can be analyzed without building.
Creating a snapshot
You have now supplied all the information needed for the project file that is used each time a snapshot is generated. You can now go ahead and create a snapshot.
This tells the bootstrap tool that you want to clone the current DevSkim source files from GitHub and generate files needed to build a Semmle snapshot. This command will be run at the end of the bootstrap process.
Running a set of analyses
This tells the bootstrap tool that you want to run a set of queries to analyze the snapshot. This command will be run at the end of the bootstrap process.
Specifying an analysis suite
If you press Enter without specifying a suite the bootstrap tool will run the standard set of C# queries.
Alternatively, you can tell the bootstrap tool to run the same queries that are run on LGTM by specifying the LGTM query suite for C#:
Exporting the database archive
This tells the bootstrap tool to create a zip archive containing a snapshot in your project directory. This command will be run at the end of the bootstrap process.
The bootstrap tool now:
- Clones the current DevSkim source files from GitHub, and generates files needed to build the snapshot.
- Indexes the code base, builds a snapshot, performs C# analysis, and saves the results of the analysis in a SARIF results file in the project directory.
- Exports the snapshot as a zip archive. You can use this snapshot to run queries in your IDE, for example using the QL for Eclipse plugin.
Completing these operations will take a few minutes.
When the bootstrap tool finishes, it displays a message like this:
Now you can view the analysis results in a SARIF viewer, or import the snapshot database into your IDE and run additional analyses.
If error messages are reported, you can investigate the problem by reviewing the log files:
Before rerunning the bootstrap process, enable prototyping mode. This will help with any further troubleshooting you need to do.
Spend some time investigating the analysis of the DevSkim code base. This will help you familiarize yourself with the standard rules available for C# analysis.
Query the snapshot in your IDE
If you install a QL plugin or extension, you can easily write custom queries to analyze snapshots and view the results directly in your IDE.
Create more snapshots
Use the bootstrap tool to create a project for your own code base.
Work through the tutorial on advanced project creation to see some examples of the available configuration options.