Full project scan with SARIF report only

What this task does: Set up and execute an AI-powered code scan using Bridge CLI and Signal, with the results in a SARIF report.

Prerequisites:

API Key for the LLM that will be used by Signal

Quickstart

Signal uses AI scans to secure code, including code generated by agentic workflows. This page explains how to set up Signal for AI scans with results reported in a SARIF file.

Note: Available with: Signal Enterprise.

Running an AI scan with Bridge CLI for the first time

Download the latest version of Bridge, if you haven't installed it already.
```
https://repo.blackduck.com/bds-integrations-release/com/blackduck/integration/bridge/binaries
```
Important: Choose bridge-cli-bundle, which also installs Signal.
Add Bridge to your $PATH variable.

Set the following environment variables.

export BRIDGE_SIGNAL_LLM_KEY=Insert_your_LLM_key

From the root level of the project, run the following.
```
bridge-cli --stage signal \
  signal.mode=PROJECT \
  signal.exclude=".\\examples" \
  signal.reportFile="C:\\MyReports\testProject.json" \
  signal.args="--oversight true --log-level debug" 
```
About this example:
- The results of your scan will be available in a SARIF report, stored at the location you provide for the signal.reportFile property. In this example it is: C:\\MyReports\\testProject.json.
- Setting signal.mode as "PROJECT" tells Signal to scan the entire project.
- You can use the exclude property to indicate directories that Signal should not scan.
If the scan succeeds, the SARIF report will be found at the location you indicated.

Troubleshooting

If the scan fails check the following.

Have you provided a valid LLM API key.