Run scans

Build the project before scanning

Supply a project's dependencies with the source, for scanners that build the project before they analyse it.

View as Markdown

Some Java and C#/.NET engines, FindSecBugs (the SpotBugs analyzer) and Security Code Scan among them, build the project before they analyse it. They run with the Full scanner for the language chosen in Main Language. To build, the source must be complete and its dependencies must be downloadable from where the scanner runs: from the internet or an internal artifact repository that needs no login. When they are not, you supply them with the source.

CodeQL builds the project too, but a default installation no longer includes it. It runs only where your operator has added its image.

Ask the developers who maintain the project how to get a buildable copy of the code. The results are usually worth the extra step.

The example below covers Maven-built Java projects. The engines also understand Gradle, Ant and a few more build tools, and download the dependencies named in the build file themselves.

When the dependency repository is reachable

Nothing to do: choose Full and the language, and scan as usual.

When it is not

Download the dependencies on a machine that can reach them, and upload them inside the source archive.

Before you start

PrerequisiteHow to check
A machine that can build the projectFrom the source folder, ./mvnw -v prints the Maven and Java versions.
The archive will fit the upload limitA ZIP of up to 2000 MB unless your operator changed MAX_UPLOAD_MB. A full ~/.m2 cache can approach it: zip only what the project needs.
  1. 01
    Cache the dependencies

    Run this from the source folder. Maven stores the modules in ~/.m2/repository.

    Shell
    ./mvnw dependency:go-offline
  2. 02
    Copy the cache into a folder named dependency at the top of the source tree

    The folder stands in for ~/.m2, so the modules end up in dependency/repository. Check: ls dependency/repository lists folders such as org and com.

    Shell
    mkdir -p dependency && cp -r ~/.m2/repository dependency/
  3. 03
    Zip the source tree, dependency folder included
    Shell
    zip -qr ../project-with-deps.zip .
  4. 04
    Open Static Code Analysis and drop the archive on the Upload ZIP tab
  5. 05
    Switch on Full under Classic SAST Scanners, and set Main Language to java

    Not All supported languages, the default: choose the language explicitly for a build-dependent engine.

  6. 06
    Click Start Analysis
Maven go-offline output
Caching Maven dependencies
Maven local repository
The populated ~/.m2 folder
Archive with cached dependencies
The dependency folder inside the uploaded archive

Check it worked: before you upload, unzip -l ../project-with-deps.zip | grep dependency/ | head lists files under dependency/. After the scan, the scan log on the scan page shows the Java engine's run, and its findings are in the scan report. The Java engines (FindSecBugs, and CodeQL where installed) use the dependency folder as their ~/.m2.

Last reviewed 2026-10-19