Skip to content

VS Code Quick Start

Use this guide when developers need workspace scans, Problems diagnostics, report history, comparison, and navigation from findings to source.

Typical time: 10 minutes. Requires VS Code 1.92+, Java, OpenGrep, the VSIX artifact, and an issued license.

1. Confirm the deployment requirements

Have the VSIX release artifact and an issued postq.lic available. This deployment requires Visual Studio Code, Java, and OpenGrep.

2. Install prerequisites

Use your organization's approved software distribution process, or install from the publisher resources:

Then run the supplied pre-install check:

.\postq-code-scanner-preinstall-check.ps1 -Profile vscode

bash ./postq-code-scanner-preinstall-check.sh --profile vscode

IDE discovery is advisory. Confirm the extension is installed even when the checker can find the VS Code launcher.

For platform notes and supported versions, see Prerequisites.

3. Install the extension

  1. Open Extensions in VS Code.
  2. Select the Extensions menu, then Install from VSIX....
  3. Choose postq-code-scanner-vscode-<version>.vsix.
  4. Reload VS Code when prompted.

4. Activate the license

  1. Open the PostQ Crypto Readiness Activity Bar view.
  2. Expand License.
  3. Select Activate License From File.
  4. Choose the issued postq.lic file.
  5. Confirm that the License view reports a valid status.

5. Scan a workspace

  1. Download and extract the Java Quick Start project, or choose a representative repository.
  2. Open the extracted postq-java-quickstart directory as a VS Code workspace.
  3. Open the Command Palette.
  4. Run PostQ Crypto Readiness: Scan Workspace Folder.
  5. Choose a fresh scan when prompted.
  6. Keep the PostQ Scanner terminal open until the scan completes.

If OpenGrep is outside PATH, set postqCryptoReadiness.scanner.openGrepPath before scanning. If Java is outside PATH, set postqCryptoReadiness.scanner.javaPath before scanning.

6. Review the result

  1. Expand Reports in the PostQ Activity Bar view.
  2. Open the newest completed scan.
  3. Review Assessment, Crypto Functions, and Operation Groups.
  4. Select a finding to navigate to its source when the file remains in the workspace.

Reports are stored below:

<workspace>/reports/postq/scans/<scan-id>/

Success checklist

  • The scan status is complete.
  • The PostQ Scanner terminal shows exit 0.
  • The completed scan appears under Reports.
  • Backend findings appear in Problems when diagnostics are enabled.

Next: VS Code usage and settings.