SWORD4J provides seamless integration with the eclipse build process.  To enable automatic security analysis on full builds, simply right mouse-click on an open Java or Plug-in project in an open workspace and then select "Security->Analyze on Full Build" from the pop-up context menu.

When the "Analyze on Full Build" feature is enabled, SWORD4J generates three files in the project root folder to support headless analysis of the project.

The Analyze on Full Build feature generates the same output as the normal security analysis.  That being, markers generated in the workspace, and HTML output to the project folder "Analysis\<Project name>\security".

One additional file is generated by the "Analyze on Full Build" feature.  Namely, the secbuild.txt file.  This file contains the results of the security analysis in an output format consistent with that of the javac command.  Build engineers can use this output to programmatically parse or grep through it to determine build success or failure from the perspective of security analysis.  For a developer to review the results, simply launch the eclipse client in the same workspace and review the generated markers via the GUI as usual.

As mentioned earlier, the automatic analysis on full build feature generates the same output as the manual Security Analysis feature.  However, when the automatic analysis is run, the markers must be manually refreshed using the Analysis view "Refresh analysis view" action.

This concludes the demonstration of enabling a Java or Plug-in project for Analyze on Full Build.  Next up:  Headless build execution and analysis generation by running sword4jbuild.bat.

After changing directory to the project folder which has been enabled for Analysis on Full Build, the sword4jbuild.bat file can be executed.

The batch file invokes antRunner to perform an eclipse incremental build and security analysis is now automatic as part of the build.

Once the build completes, output can be reviewed by inspecting the output files or by launching eclipse and reviewing the generated markers.

To summarize, the "Analyze on Full Build" feature provides an easy to use and seamless integration with the eclipse build process in both UI and non-UI  build scenarios.