TeamCity

TeamCity is a cloud CI/CD service by JetBrains that is used to automatically build and test code projects. It combines continuous integration (CI) and continuous delivery (CD) to test and build your code and ship it to any target.

This how-to will provide a basic understanding of how add the Relyance Source Code inspector (SCI) into a typical build job.

Prerequisites:

1. A source code repository needs to be available.
2. The relyance.yaml file needs to be in the source code root directory.
3. Docker needs to be available in the scanning environment.
4. Grab the command line code from Step 2 of the Relyance Source Code Integration settings from your Relyance instance. See more info about the SCI commands here.

Steps:

1. Login to your TeamCity Account.
2. Go to your project or create a new one.
3. Click on Edit project... button in the top right-hand side.
4. Under the Build Configurations section click the Create build configuration button.
5. Select the desired repository in the wizard. Provide a meaningful name for your pipeline (e.g. Relyance Scan).
6. This will bring you into the project build settings. Click on Build Steps in the left-hand navigation menu.
7. Click the +Add build step button.
8. This will open a list of potential build steps, use the Command Line step.
9. Provide a meaningful Step name and enter the Step 2 command from your Relyance tenant into the Custom script box.
10. Click Save.
11. The default behaviour is to run a scan upon VCS trigger. If you wish to run this under a schedule instead, click Triggers from the left-hand navigation menu. It's suggested to delete the default VCS trigger since we are only concerned with the main branch.
12. Click the +Add new trigger button.
13. Select Schedule Trigger from the dropdown menu.
14. In the resulting dialog set the schedule cadence and set the branch to your main or master branch in order to only scan the current default. It is recommended to always run a scan regardless of changes as the source code inspector is being consistently improved and can pick up new things periodically.
15. Click Save to save your trigger schedule.
16. Once complete, click the Run... button at the top of the page to do your first Relyance scan.
17. If there are no errors, you should start to see SCI results in your Relyance tenant.

Appendix:

Source Code Integration Step 2 info:

Example Step 2 Command

1. This command pulls the latest version of the Relyance Source Code Inspector.
2. This command initiates the Relyance Source Code Inspector within a local Docker container, establishing a shared folder and providing the necessary tenant API credentials.