Static Code Analysis and CircleCI Orbs

Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > Static Code Analysis and CircleCI Orbs

Overview

Run a Datadog Static Code Analysis job in your CircleCI workflows.

Setup

To use Datadog Static Code Analysis, you need to add a static-analysis.datadog.yml file in your repository’s root directory to specify which rulesets to use.

rulesets:
  - <ruleset-name>
  - <ruleset-name>

Example for Python

You can see an example for Python-based repositories:

rulesets:
  - python-code-style
  - python-best-practices
  - python-inclusive

Workflow

Create a file in .circleci to run a Datadog Static Code Analysis job.

The following is a sample workflow file.

version: 2.1
orbs:
  datadog-static-analysis: datadog/datadog-static-analyzer-circleci-orb@1
jobs:
  run-static-analysis-job:
    docker:
      - image: cimg/node:current
    steps:
      - checkout
      - datadog-static-analysis/analyze:
          service: "my-service"
          env: "ci"
          site: 
          cpu_count: 2
          enable_performance_statistics: false
workflows:
  main:
    jobs:
      - run-static-analysis-job

Environment variables

Set the following environment variables in the CircleCI Project Settings page.

Name	Description	Required
`DD_API_KEY`	Your Datadog API key. This key is created by your Datadog organization and should be stored as a secret.	Yes
`DD_APP_KEY`	Your Datadog application key. This key is created by your Datadog organization and should be stored as a secret.	Yes

Inputs

To customize your workflow, you can set the following parameters for Static Code Analysis.

Name	Description	Required	Default
`service`	The service you want your results tagged with.	Yes
`env`	The environment you want your results tagged with. Datadog recommends using `ci` as the value for this input.	No	`none`
`site`	The Datadog site to send information to.	No	`datadoghq.com`
`cpu_count`	Set the number of CPUs used to by the analyzer.	No	`2`
`enable_performance_statistics`	Get the execution time statistics for analyzed files.	No	`false`