timothyswan/psscriptanalyzer repository overview

PSScriptAnalyzer⁠ is Microsoft's official PowerShell linter — the same engine VS Code's PowerShell extension runs under the hood. It applies ~70 built-in rules covering style, correctness, and security best practices to .ps1, .psm1, and .psd1 files.

This image bundles PSScriptAnalyzer with PowerShell Core (pwsh) so the scanner runs in CI as a single self-contained container. Both pwsh and the module are SHA256-verified at fetch time and layered onto Red Hat Hardened .NET base images. The built image is cosign-signed with a CycloneDX SBOM and SLSA Level 3 provenance attestation attached.

Output is SARIF v2.1.0 — emitted by the bundled Convert-ToSARIF.ps1 wrapper, which calls Invoke-ScriptAnalyzer and maps every finding to the standard SARIF result schema. Consumable by DefectDojo's Generic SARIF parser.

⁠Usage

# Lint a repo (mount the workdir at /repo; output SARIF to a file)
podman run --rm -v "$(pwd):/repo:ro,Z" psscriptanalyzer:<version>-rhhi > findings.sarif

# Limit severity (Error / Warning / Information)
podman run --rm -v "$(pwd):/repo:ro,Z" psscriptanalyzer:<version>-rhhi -Severity Error,Warning > findings.sarif

# Exclude specific rules
podman run --rm -v "$(pwd):/repo:ro,Z" psscriptanalyzer:<version>-rhhi -ExcludeRule PSAvoidUsingWriteHost > findings.sarif

# Use a settings preset (e.g., CodeFormatting)
podman run --rm -v "$(pwd):/repo:ro,Z" psscriptanalyzer:<version>-rhhi -SettingsPath /opt/microsoft/powershell/7/Modules/PSScriptAnalyzer/<ver>/Settings/CodeFormattingStroustrup.psd1 > findings.sarif

⁠Supply chain

• Base images: registry.access.redhat.com/hi/dotnet-sdk (build) → registry.access.redhat.com/hi/dotnet-runtime (runtime)
• PowerShell Core: upstream linux-x64 tarball from GitHub Releases, SHA256-verified
• PSScriptAnalyzer: upstream .nupkg from PowerShell Gallery, SHA256-verified
• Tier: 2 (prebuilt binary + module) — adapts the Tier 2 pattern for PowerShell modules
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation