Automate CAST Profiler

Running CAST Profiler unattended - in a container and from a GitHub repository

Overview

CAST Profiler is a single executable with no interactive requirement once you pass an explicit mode, which makes it suitable for running on a schedule or as a pipeline step. These pages cover the two hosted routes for doing that.

Run with Docker

The container image, mounting source, retrieving results, and pinning a version in a pipeline.

Scan a GitHub repository

The GitHub App and the workflow it installs, and what it commits to your repository.

To run the executable directly on a build agent, see the CLI reference. For what to do with the files a run produces, including gating a pipeline on alerts, see Result files.

Before you automate anything

Two behaviours will break an unattended run if you have not accounted for them:

  • Pass --complete-insight or --offline explicitly. With neither, the CLI uploads the results and opens a browser, which is rarely what an unattended run should do.
  • Add --clean-log or --text-log. The default progress bar writes control characters that make a captured pipeline log unreadable.

A safe baseline for any pipeline is therefore:

$ ./CAST-Profiler --offline --clean-log --output "$OUTPUT_DIR" --name "$APP_NAME" "$SOURCE_DIR"

Add --no-browser if you use --complete-insight, so that no browser launch is attempted on the agent.