> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/prezero/static-analysis-sast/analyzing-applications/scala.md).

# Scala

This article shows you how to analyze your applications that are written in Scala using Qwiet AI by Harness. It assumes that you have already [set up and authenticated](broken://spaces/uPVBkglG6gsk2SsnsKgG/pages/fDfomI4jhzwCNFxmGSLc) with Qwiet.

## Requirements <a href="#requirements" id="requirements"></a>

See [Prerequisites](broken://spaces/uPVBkglG6gsk2SsnsKgG/pages/0c1ezDgaUil5NxR4VnY3#language-support-and-requirements) for more information.

## Analyzing your Scala application <a href="#analyzing-your-scala-application" id="analyzing-your-scala-application"></a>

To analyze your Scala application, run:

```
sl analyze --app <name> --java [<path>]
```

![](/files/DfHDmRpYn5HJOmhRtTva) ![](/files/P5vj8JOtHNJWVEvAqKym)

| Parameter      | Description                                                                 |
| -------------- | --------------------------------------------------------------------------- |
| `--app <name>` | The name of the application to be analyzed (maximum length: 100 characters) |
| `--java`       | The flag identifying the application's language                             |
| `<path>`       | The location of the application's `.jar` / `.war` file to be analyzed       |

See the [CLI reference](broken://spaces/4t03gua31tHpZwtcczPO/pages/bfq0NtVB7O7f6pFvFzK3) for additional `sl analyze` options.

### SCA <a href="#sca" id="sca"></a>

To [identify open-source vulnerabilities](/sast-and-sca/prezero/oss-vulnerabilities.md), Qwiet AI by Harness automatically searches for build manifests in the directory from which you run `sl analyze` (while you must provide the packaged artifact or the project pacakge, Qwiet AI by Harness assumes that the directory from which you run `sl analyze` is the directory that contains the application's source code).

Depending on how your project repo is structured, you may need to provide the following configuration options so that Qwiet AI by Harness can identify where your dependencies are located:

| **Configuration option**             | **Description**                                                                                                                                                              |
| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--oss-project-dir <project-path>`   | The (non-default) location where projects are defined                                                                                                                        |
| `--oss-subproject <subproject-name>` | For sbt projects only: collect open-source package information **only** from a specific subproject. This flag should only be used for complex monorepos/multi-project builds |

## Tagging results with your branch name <a href="#tagging-results-with-your-branch-name" id="tagging-results-with-your-branch-name"></a>

To include the branch name in your Qwiet AI by Harness results, allowing you to distinguish one set of results from another, add the following to your invocation of Qwiet:

```
sl analyze --tag branch=`git symbolic-ref --short HEAD`
```

![](/files/DfHDmRpYn5HJOmhRtTva) ![](/files/P5vj8JOtHNJWVEvAqKym)

If you're working in a GitHub environment (e.g., [GitHub Actions](https://github.com/features/actions)), you can also use `--tag branch=${{ github.head_ref }}` to populate your branch name.

If you don't provide a branch name, but Qwiet detects one available in your environment, it will use that name.

## Source code view <a href="#source-code-view" id="source-code-view"></a>

The Qwiet Dashboard's findings list can include URLs that, when used, will [direct you](/sast-and-sca/prezero/ui/application-details/settings.md) to the specific source code lines where the vulnerability occurs.

However, to leverage Qwiet's source code view with Scala applications, you **must** [augment the source code filepaths](/sast-and-sca/prezero/ui/application-details/settings.md#modifying-the-source-code-file-paths-used). Qwiet AI by Harness uses the byte code, not the source code, for analysis, so you'll need to provide additional information about your filepath structure to ensure that Qwiet AI by Harness generates the links properly.