Installation¶

The recommended way to run ts-sast is the Docker image. Its DevSkim backend is a .NET tool; the image bundles Python, the .NET runtime and a pinned DevSkim version, so nothing has to be installed on the host and every machine and CI runner scans with the same versions.

Docker image (recommended)¶

Every release is published as trustsource/ts-sast on Docker Hub, tagged with the release version and latest:

docker pull trustsource/ts-sast
docker run --rm -v "$(pwd)":/workspace trustsource/ts-sast scan -o /workspace/findings.sarif src

See Operating inside a container for mounting sources, CI gates and configuration.

Local installation¶

ts-sast is a Python package (v3.10, v3.11 and v3.12 are tested). For a local installation you need Python plus the .NET SDK 8 or newer for DevSkim. This is the right choice for rule development and for machines where Docker is not available.

Installation from the PyPI repository¶

pip install ts-sast

Then install DevSkim as a .NET global tool (requires the .NET SDK 8 or newer):

dotnet tool install --global Microsoft.CST.DevSkim.CLI

Global tools land in ~/.dotnet/tools, which the .NET installer adds to your PATH. If devskim --version does not work in a fresh shell, either add that directory to PATH or pass the executable explicitly:

ts-sast scan --devskim:executable ~/.dotnet/tools/devskim <path>

A DevSkim installed as a local tool (dotnet tool install Microsoft.CST.DevSkim.CLI with a tool manifest) is only reachable as dotnet devskim from the manifest's directory; wrap it in a small script and point --devskim:executable at it.

Installation from a local folder¶

git clone https://github.com/trustsource/ts-sast.git
cd ts-sast
pip install .

For development install the dev extra as well, which adds pytest and pyright:

pip install '.[dev]'

The tests that actually run DevSkim are skipped when devskim is not on the PATH.

Verify the installation¶

ts-sast --version
ts-sast scan --help
devskim --version