Skip to main content

JavaScript/TypeScript

This article shows you how to analyze your applications written in JavaScript or TypeScript (including those that use the Angular, React.js, and Vue.js frameworks) using Qwiet AI by Harness. It assumes that you have already set up and authenticated with Qwiet.

note

Qwiet offers sample applications that you can use to run and test Qwiet AI by Harness. They also include functioning configuration files to demonstrate how you can leverage GitHub Actions to automate code analysis whenever you open a new Pull Request (PR).

Requirements​

See Prerequisites for more information.

Analyzing your JavaScript application​

To analyze your JavaScript application without the need to build it, run:

sl analyze --app <name> --jssrc [<path>]
ParameterDescription
--app <name>The name of the application to be analyzed (maximum length: 100 characters)
--jssrcThe flag identifying the application's language
<path>The path to the application directory

See the CLI reference for additional sl analyze options.

Additional parameters​

The analysis accepts additional parameters after a double hyphen --.

For example, the following excludes any folder with tests in its path:

sl analyze --jssrc /path/to/my/javascript-project -- --exclude-regex 'tests'

Such parameters, if valid, are passed directly to the JavaScript plugin.

ParameterDescription
--exclude <path>Exclude the specified file/directory during code analysis; can be relative to the project directory or absolute; can be specified multiple times
--exclude-regex <value>A regex specifying files to exclude (matched against paths relative to the input directory)
--output <value>The CPG output file name (defaults to cpg.bin.zip)

SCA​

To identify open-source vulnerabilities, Qwiet AI by Harness automatically searches for build manifests in the project path you provided when running sl analyze. However, depending on how your project repo is structured, you may need to provide --oss-project-dir <project-path> so that Qwiet AI by Harness can identify where your dependencies are located.

SCA requires a lock file (package-lock.json, yarn.lock, pnpm-lock.yaml, or Rush.js). If your repository does not include one, generate it before running sl analyze — for example:

npm install --package-lock-only

This creates a package-lock.json without installing packages into node_modules. For other package managers, consult their documentation for the equivalent command.

Tagging results with your branch name​

To include the branch name in your Qwiet AI by Harness results, allowing you to distinguish one set of results from another, add the following to your invocation of Qwiet:

sl analyze --tag branch=$(git symbolic-ref --short HEAD)

If you're working in a GitHub environment (e.g., GitHub Actions), you can also use --tag branch=${{ github.head_ref }} to populate your branch name.

If you don't provide a branch name, but Qwiet detects one available in your environment, it will use that name.

Troubleshooting​

If you have any issues scanning your project, please see our general troubleshooting page, as well as the JavaScript-specific suggestions below.

Excluding files / directories​

The analysis automatically excludes several directories by default, including node_modules, dist, build, test, tests, vendor, and others. Use --exclude (for specific paths) or --exclude-regex (for a regex pattern) to exclude additional files or directories.

No findings found​

If a scan returns no findings, re-run with verbose logging enabled to see which files were included in the analysis. The output will show which files were skipped due to default exclusion rules or user-provided exclusion flags.

Zero files parsed​

If no source files are parsed at all, your project's source files may all fall under a default-excluded directory (e.g., the entire project is inside a dist/ or build/ folder). Check the verbose logs to confirm. Restructure your project so that source files are not under a default-excluded path, or use --exclude-regex with a pattern that does not match your source files.