devcontainer directory, with the value MS-SarifVSCode.sarif-viewer within the extensions array.All of my day-to-day projects are using Team Foundation Version Control (TFVC) repositories, but recently we have been considering using Git. To leverage this in your environment, drop a. This removes the step of installing the SARIF Viewer Extension manually. Use VS Code DevContainers to speed up the installation of the SARIF Extensionĭevelopers are able to configure a dev container to have their developer environment preconfigured with everything required to see the code scanning results instantaneously. Once you have remediated the finding and commit to your branch to see the fix happen in realtime. To make a fix, simply expand the details for the code scanning finding of your choice. Once installed, authenticate with GitHub, then you can begin to see your code scanning results in your codespace.

Navigate to the extensions tab and search for the SARIF Viewer extension. To view GitHub code scanning results in Codespaces, start by creating a codespace environment in your repository of choice. Enable GitHub code scanning results in Codespaces Thus, vulnerabilities are prevented even more seamlessly with the combination of pull request scanning and results in the IDE. And once the fixes are pushed to GitHub code scanning can confirm them and give the green light to merge. Additionally, because the underlying analysis still happens in the cloud, they can get the accurate results only deep scanning is capable of.īy pulling results into the IDE developers can work on them without switching context. With the newly updated SARIF Viewer Extension for VS Code, developers can now view code scanning findings directly in VS Code or GitHub Codespaces, and fix them even faster.

But it also goes further: by exposing those results as SARIF, code scanning makes it easy to integrate them into any IDE. GitHub code scanning displays results natively in the pull request-exactly when developers are looking for code review. Developers need access to security alerts and remediation information as they develop.

A seamless developer experience is critical if you want to fix security issues fast.

Github with visual studio code