Code Scan Agent

Overview

The PQC Agent uses a download-and-execute deployment model and does not require permanent installation on CI/CD runners.

During pipeline execution, the required agent files are downloaded from a centrally managed repository and executed locally on the runner. Once the scan is completed, no persistent agent service remains installed on the runner.

Deployment Options

The PQC Code Scan Agent is available in the following deployment options:

Linux Executable
Supported Operating Systems
  • Ubuntu 20.04 or later
  • RHEL 8 or later
  • GLIBC version 2.28 or later
Docker Container
Supported Platforms
  • Any operating system that supports Docker Engine 20.10 or later
Windows Executable
Supported Platforms
  • Windows 10 and above with 64-bit architecture
  • Windows Server 2019 and above with 64-bit architecture

Required Agent Files

The following files are required to perform a PQC code scan:
File Description
code-scan-agent Executable responsible for performing the code scan.
config.ini Agent configuration file.
secret.key Authentication key used by the agent.
These files are hosted in a centrally managed repository maintained by the organization's DevOps team.

Execution Flow

When a CI/CD pipeline is triggered:
  1. The pipeline downloads the required agent files from the configured repository.
  2. The files are downloaded to the CI/CD runner executing the pipeline.
  3. The PQC Agent is executed locally on the runner.
  4. The code scan is performed and results are generated.
  5. The pipeline execution completes.
No permanent installation, background service, or ongoing agent maintenance is required on the runner.

Scalability Across CI/CD Runners

The PQC Agent supports environments containing any number of CI/CD runners.

Each runner independently downloads and executes the required agent files whenever a pipeline is triggered. No centralized agent deployment, synchronization, or runtime coordination between runners is required.

Example: In an environment with 100 CI/CD runners, the PQC Agent does not need to be installed or maintained on each runner. A single pipeline configuration can be reused across all runners, and each runner automatically downloads and executes the agent when the pipeline runs.

DevOps Team Responsibilities

The DevOps team is responsible for configuring the agent download and execution process within the CI/CD pipeline.

This includes:
  • Configuring the centralized location that hosts the required agent files.
  • Configuring authentication and access controls for hosted location, if required.
  • Configuring the pipeline steps used to download and execute the agent.
  • Configuring fallback download sources for high availability, if applicable.
  • Ensuring CI/CD runners have the required network connectivity and permissions to access the configured centralized location.
  • Maintaining and updating the centrally hosted agent files.
  • Reusing the same pipeline configuration across CI/CD runners where appropriate.
Once the pipeline has been configured, no additional installation or configuration is required on individual runners.

PQC Agent Availability and Failover

To improve availability and resiliency, the DevOps team can configure multiple download sources that host the PQC Agent files.

When a CI/CD pipeline is triggered, the pipeline first attempts to download the required files from the primary configured download source. If the download fails or the primary download source is unavailable, the pipeline automatically attempts to download the files from the next configured source based on the predefined failover order.

The failover sequence is fully controlled by the DevOps team through the CI/CD pipeline configuration.

This approach:
  • Reduces dependency on a single download source.
  • Improves resilience against infrastructure or network failures.
  • Supports business continuity during temporary outages.
  • Helps ensure uninterrupted PQC scanning operations when an alternative download source is available.

AppViewX Code Scan Agent: Execution Flow

Executing the code scan agent is a three-step process, as outlined below:
  1. Create the configuration file.
  2. Integrate the AppViewX Code Scan Agent with the CI/CD pipeline of your code repository.
  3. Execute the AppViewX Code Scan Agent.
Each of these steps is covered in detail in the subsequent chapters and sections.