From af69fc4b7ea1b3c5406b4446731aaccc1aea3b00 Mon Sep 17 00:00:00 2001
From: Fernando Rojo <ferojo@microsoft.com>
Date: Fri, 25 Oct 2024 17:15:04 -0700
Subject: [PATCH 1/3] Introduce config as code support

---
 .../ComponentDetectionConfigFileService.cs    | 129 ++++++++++++++++++
 .../IComponentDetectionConfigFileService.cs   |  25 ++++
 ...Microsoft.ComponentDetection.Common.csproj |   1 +
 .../ComponentDetectionConfigFile.cs           |  16 +++
 ...rosoft.ComponentDetection.Contracts.csproj |   1 +
 .../Commands/BaseSettings.cs                  |   4 +
 .../Commands/ScanCommand.cs                   |   5 +
 .../Extensions/ServiceCollectionExtensions.cs |   1 +
 .../Commands/ScanCommandTests.cs              |   3 +
 9 files changed, 185 insertions(+)
 create mode 100644 src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs
 create mode 100644 src/Microsoft.ComponentDetection.Common/IComponentDetectionConfigFileService.cs
 create mode 100644 src/Microsoft.ComponentDetection.Contracts/ComponentDetectionConfigFile.cs

diff --git a/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs b/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs
new file mode 100644
index 000000000..ed9632dde
--- /dev/null
+++ b/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs
@@ -0,0 +1,129 @@
+namespace Microsoft.ComponentDetection.Common;
+
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using Microsoft.ComponentDetection.Contracts;
+using Microsoft.Extensions.Logging;
+using YamlDotNet.Serialization;
+
+/// <inheritdoc />
+public class ComponentDetectionConfigFileService : IComponentDetectionConfigFileService
+{
+    private const string ComponentDetectionConfigFileEnvVar = "ComponentDetection.ComponentDetectionConfigFile";
+    private readonly IFileUtilityService fileUtilityService;
+    private readonly IEnvironmentVariableService environmentVariableService;
+    private readonly IPathUtilityService pathUtilityService;
+    private readonly ComponentDetectionConfigFile componentDetectionConfig;
+    private readonly ILogger<FastDirectoryWalkerFactory> logger;
+    private bool serviceInitComplete;
+
+    public ComponentDetectionConfigFileService(
+        IFileUtilityService fileUtilityService,
+        IEnvironmentVariableService environmentVariableService,
+        IPathUtilityService pathUtilityService,
+        ILogger<FastDirectoryWalkerFactory> logger)
+    {
+        this.fileUtilityService = fileUtilityService;
+        this.pathUtilityService = pathUtilityService;
+        this.environmentVariableService = environmentVariableService;
+        this.logger = logger;
+        this.componentDetectionConfig = new ComponentDetectionConfigFile();
+        this.serviceInitComplete = false;
+    }
+
+    public ComponentDetectionConfigFile GetComponentDetectionConfig()
+    {
+        this.EnsureInit();
+        return this.componentDetectionConfig;
+    }
+
+    public async Task InitAsync(string explicitConfigPath, string rootDirectoryPath = null)
+    {
+        await this.LoadFromEnvironmentVariableAsync();
+        if (!string.IsNullOrEmpty(explicitConfigPath))
+        {
+            await this.LoadComponentDetectionConfigAsync(explicitConfigPath);
+        }
+
+        if (!string.IsNullOrEmpty(rootDirectoryPath))
+        {
+            await this.LoadComponentDetectionConfigFilesFromRootDirectoryAsync(rootDirectoryPath);
+        }
+
+        this.serviceInitComplete = true;
+    }
+
+    private async Task LoadComponentDetectionConfigFilesFromRootDirectoryAsync(string rootDirectoryPath)
+    {
+        var workingDir = this.pathUtilityService.NormalizePath(rootDirectoryPath);
+
+        var reportFile = new FileInfo(Path.Combine(workingDir, "ComponentDetection.yml"));
+        if (this.fileUtilityService.Exists(reportFile.FullName))
+        {
+            await this.LoadComponentDetectionConfigAsync(reportFile.FullName);
+        }
+    }
+
+    private async Task LoadFromEnvironmentVariableAsync()
+    {
+        if (this.environmentVariableService.DoesEnvironmentVariableExist(ComponentDetectionConfigFileEnvVar))
+        {
+            var possibleConfigFilePath = this.environmentVariableService.GetEnvironmentVariable(ComponentDetectionConfigFileEnvVar);
+            if (this.fileUtilityService.Exists(possibleConfigFilePath))
+            {
+                await this.LoadComponentDetectionConfigAsync(possibleConfigFilePath);
+            }
+        }
+    }
+
+    private async Task LoadComponentDetectionConfigAsync(string configFile)
+    {
+        if (!this.fileUtilityService.Exists(configFile))
+        {
+            throw new InvalidOperationException($"Attempted to load non-existant ComponentDetectionConfig file: {configFile}");
+        }
+
+        var configFileInfo = new FileInfo(configFile);
+        var fileContents = await this.fileUtilityService.ReadAllTextAsync(configFileInfo);
+        var newConfig = this.ParseComponentDetectionConfig(fileContents);
+        this.MergeComponentDetectionConfig(newConfig);
+        this.logger.LogInformation("Loaded component detection config file from {ConfigFile}", configFile);
+    }
+
+    /// <summary>
+    /// Merges two component detection configs, giving precedence to values already set in the first file.
+    /// </summary>
+    /// <param name="newConfig">The new config file to be merged into the existing config set.</param>
+    private void MergeComponentDetectionConfig(ComponentDetectionConfigFile newConfig)
+    {
+        foreach ((var name, var value) in newConfig.Variables)
+        {
+            if (!this.componentDetectionConfig.Variables.ContainsKey(name))
+            {
+                this.componentDetectionConfig.Variables[name] = value;
+            }
+        }
+    }
+
+    /// <summary>
+    /// Reads the component detection config from a file path.
+    /// </summary>
+    /// <param name="configFileContent">The string contents of the config yaml file.</param>
+    /// <returns>The ComponentDetection config file as an object.</returns>
+    private ComponentDetectionConfigFile ParseComponentDetectionConfig(string configFileContent)
+    {
+        var deserializer = new DeserializerBuilder()
+            .IgnoreUnmatchedProperties()
+            .Build();
+        return deserializer.Deserialize<ComponentDetectionConfigFile>(new StringReader(configFileContent));
+    }
+
+    private void EnsureInit()
+    {
+        if (!this.serviceInitComplete)
+        {
+            throw new InvalidOperationException("ComponentDetection config files have not been loaded yet!");
+        }
+    }
+}
diff --git a/src/Microsoft.ComponentDetection.Common/IComponentDetectionConfigFileService.cs b/src/Microsoft.ComponentDetection.Common/IComponentDetectionConfigFileService.cs
new file mode 100644
index 000000000..09309fe25
--- /dev/null
+++ b/src/Microsoft.ComponentDetection.Common/IComponentDetectionConfigFileService.cs
@@ -0,0 +1,25 @@
+namespace Microsoft.ComponentDetection.Common;
+
+using System.Threading.Tasks;
+using Microsoft.ComponentDetection.Contracts;
+
+/// <summary>
+/// Provides methods for writing files.
+/// </summary>
+public interface IComponentDetectionConfigFileService
+{
+    /// <summary>
+    /// Initializes the Component detection config service.
+    /// Checks the following for the presence of a config file:
+    /// 1. The environment variable "ComponentDetection.ConfigFilePath" and the path exists
+    /// 2. If there is a file present at the root directory named "ComponentDetection.yml".
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    Task InitAsync(string explicitConfigPath, string rootDirectoryPath = null);
+
+    /// <summary>
+    /// Retrieves the merged config files.
+    /// </summary>
+    /// <returns>The ComponentDetection config file as an object.</returns>
+    ComponentDetectionConfigFile GetComponentDetectionConfig();
+}
diff --git a/src/Microsoft.ComponentDetection.Common/Microsoft.ComponentDetection.Common.csproj b/src/Microsoft.ComponentDetection.Common/Microsoft.ComponentDetection.Common.csproj
index cf206abea..424af33d6 100644
--- a/src/Microsoft.ComponentDetection.Common/Microsoft.ComponentDetection.Common.csproj
+++ b/src/Microsoft.ComponentDetection.Common/Microsoft.ComponentDetection.Common.csproj
@@ -5,6 +5,7 @@
         <PackageReference Include="Microsoft.Extensions.Logging" />
         <PackageReference Include="System.Reactive" />
         <PackageReference Include="System.Threading.Tasks.Dataflow" />
+        <PackageReference Include="yamldotnet" />
     </ItemGroup>
 
     <ItemGroup Label="Package References">
diff --git a/src/Microsoft.ComponentDetection.Contracts/ComponentDetectionConfigFile.cs b/src/Microsoft.ComponentDetection.Contracts/ComponentDetectionConfigFile.cs
new file mode 100644
index 000000000..fa62cdfc7
--- /dev/null
+++ b/src/Microsoft.ComponentDetection.Contracts/ComponentDetectionConfigFile.cs
@@ -0,0 +1,16 @@
+namespace Microsoft.ComponentDetection.Contracts;
+
+using System.Collections.Generic;
+using YamlDotNet.Serialization;
+
+/// <summary>
+/// Represents the ComponentDetection.yml config file.
+/// </summary>
+public class ComponentDetectionConfigFile
+{
+    /// <summary>
+    /// Gets or sets a value indicating whether the detection should be stopped.
+    /// </summary>
+    [YamlMember(Alias = "variables")]
+    public Dictionary<string, string> Variables { get; set; } = [];
+}
diff --git a/src/Microsoft.ComponentDetection.Contracts/Microsoft.ComponentDetection.Contracts.csproj b/src/Microsoft.ComponentDetection.Contracts/Microsoft.ComponentDetection.Contracts.csproj
index d7aab1c0a..a573a7279 100644
--- a/src/Microsoft.ComponentDetection.Contracts/Microsoft.ComponentDetection.Contracts.csproj
+++ b/src/Microsoft.ComponentDetection.Contracts/Microsoft.ComponentDetection.Contracts.csproj
@@ -8,6 +8,7 @@
         <PackageReference Include="Microsoft.Extensions.Logging" />
         <PackageReference Include="Newtonsoft.Json" />
         <PackageReference Include="packageurl-dotnet" />
+        <PackageReference Include="yamldotnet" />
         <PackageReference Include="System.Memory" />
         <PackageReference Include="System.Reactive" />
         <PackageReference Include="System.Text.Json" />
diff --git a/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs b/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs
index eec348e92..3b22fc207 100644
--- a/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs
+++ b/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs
@@ -37,6 +37,10 @@ public abstract class BaseSettings : CommandSettings
     [CommandOption("--Output")]
     public string Output { get; set; }
 
+    [Description("File path for a ComponentDetection.yml config file with more instructions for detection")]
+    [CommandOption("--ComponentDetectionConfigFile")]
+    public string ComponentDetectionConfigFile { get; set; }
+
     /// <inheritdoc />
     public override ValidationResult Validate()
     {
diff --git a/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs b/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs
index e2d7d39e0..6b42c03bc 100644
--- a/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs
+++ b/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs
@@ -18,6 +18,7 @@ public sealed class ScanCommand : AsyncCommand<ScanSettings>
     private const string ManifestRelativePath = "ScanManifest_{timestamp}.json";
     private readonly IFileWritingService fileWritingService;
     private readonly IScanExecutionService scanExecutionService;
+    private readonly IComponentDetectionConfigFileService componentDetectionConfigFileService;
     private readonly ILogger<ScanCommand> logger;
 
     /// <summary>
@@ -25,14 +26,17 @@ public sealed class ScanCommand : AsyncCommand<ScanSettings>
     /// </summary>
     /// <param name="fileWritingService">The file writing service.</param>
     /// <param name="scanExecutionService">The scan execution service.</param>
+    /// <param name="componentDetectionConfigFileService">The component detection config file service.</param>
     /// <param name="logger">The logger.</param>
     public ScanCommand(
         IFileWritingService fileWritingService,
         IScanExecutionService scanExecutionService,
+        IComponentDetectionConfigFileService componentDetectionConfigFileService,
         ILogger<ScanCommand> logger)
     {
         this.fileWritingService = fileWritingService;
         this.scanExecutionService = scanExecutionService;
+        this.componentDetectionConfigFileService = componentDetectionConfigFileService;
         this.logger = logger;
     }
 
@@ -40,6 +44,7 @@ public ScanCommand(
     public override async Task<int> ExecuteAsync(CommandContext context, ScanSettings settings)
     {
         this.fileWritingService.Init(settings.Output);
+        await this.componentDetectionConfigFileService.InitAsync(settings.ComponentDetectionConfigFile, settings.SourceDirectory.FullName);
         var result = await this.scanExecutionService.ExecuteScanAsync(settings);
         this.WriteComponentManifest(settings, result);
         return 0;
diff --git a/src/Microsoft.ComponentDetection.Orchestrator/Extensions/ServiceCollectionExtensions.cs b/src/Microsoft.ComponentDetection.Orchestrator/Extensions/ServiceCollectionExtensions.cs
index 029ce096d..23e208de0 100644
--- a/src/Microsoft.ComponentDetection.Orchestrator/Extensions/ServiceCollectionExtensions.cs
+++ b/src/Microsoft.ComponentDetection.Orchestrator/Extensions/ServiceCollectionExtensions.cs
@@ -46,6 +46,7 @@ public static IServiceCollection AddComponentDetection(this IServiceCollection s
         services.AddSingleton<IEnvironmentVariableService, EnvironmentVariableService>();
         services.AddSingleton<IObservableDirectoryWalkerFactory, FastDirectoryWalkerFactory>();
         services.AddSingleton<IFileUtilityService, FileUtilityService>();
+        services.AddSingleton<IComponentDetectionConfigFileService, ComponentDetectionConfigFileService>();
         services.AddSingleton<IDirectoryUtilityService, DirectoryUtilityService>();
         services.AddSingleton<IFileWritingService, FileWritingService>();
         services.AddSingleton<IGraphTranslationService, DefaultGraphTranslationService>();
diff --git a/test/Microsoft.ComponentDetection.Orchestrator.Tests/Commands/ScanCommandTests.cs b/test/Microsoft.ComponentDetection.Orchestrator.Tests/Commands/ScanCommandTests.cs
index c2c8f7154..47bb64a6c 100644
--- a/test/Microsoft.ComponentDetection.Orchestrator.Tests/Commands/ScanCommandTests.cs
+++ b/test/Microsoft.ComponentDetection.Orchestrator.Tests/Commands/ScanCommandTests.cs
@@ -19,6 +19,7 @@ public class ScanCommandTests
 {
     private Mock<IFileWritingService> fileWritingServiceMock;
     private Mock<IScanExecutionService> scanExecutionServiceMock;
+    private Mock<IComponentDetectionConfigFileService> componentDetectionConfigFileServiceMock;
     private Mock<ILogger<ScanCommand>> loggerMock;
     private ScanCommand command;
 
@@ -27,11 +28,13 @@ public void TestInitialize()
     {
         this.fileWritingServiceMock = new Mock<IFileWritingService>();
         this.scanExecutionServiceMock = new Mock<IScanExecutionService>();
+        this.componentDetectionConfigFileServiceMock = new Mock<IComponentDetectionConfigFileService>();
         this.loggerMock = new Mock<ILogger<ScanCommand>>();
 
         this.command = new ScanCommand(
             this.fileWritingServiceMock.Object,
             this.scanExecutionServiceMock.Object,
+            this.componentDetectionConfigFileServiceMock.Object,
             this.loggerMock.Object);
     }
 

From 793e54db4d9a9e9d047767ffcde4640ac819c5af Mon Sep 17 00:00:00 2001
From: Fernando Rojo <ferojo@microsoft.com>
Date: Fri, 25 Oct 2024 17:28:48 -0700
Subject: [PATCH 2/3] remove variable and build arg paths

---
 .../ComponentDetectionConfigFileService.cs    | 38 -------------------
 .../Commands/BaseSettings.cs                  |  4 --
 .../Commands/ScanCommand.cs                   |  2 +-
 3 files changed, 1 insertion(+), 43 deletions(-)

diff --git a/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs b/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs
index ed9632dde..0c4551207 100644
--- a/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs
+++ b/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs
@@ -10,9 +10,7 @@ namespace Microsoft.ComponentDetection.Common;
 /// <inheritdoc />
 public class ComponentDetectionConfigFileService : IComponentDetectionConfigFileService
 {
-    private const string ComponentDetectionConfigFileEnvVar = "ComponentDetection.ComponentDetectionConfigFile";
     private readonly IFileUtilityService fileUtilityService;
-    private readonly IEnvironmentVariableService environmentVariableService;
     private readonly IPathUtilityService pathUtilityService;
     private readonly ComponentDetectionConfigFile componentDetectionConfig;
     private readonly ILogger<FastDirectoryWalkerFactory> logger;
@@ -20,13 +18,11 @@ public class ComponentDetectionConfigFileService : IComponentDetectionConfigFile
 
     public ComponentDetectionConfigFileService(
         IFileUtilityService fileUtilityService,
-        IEnvironmentVariableService environmentVariableService,
         IPathUtilityService pathUtilityService,
         ILogger<FastDirectoryWalkerFactory> logger)
     {
         this.fileUtilityService = fileUtilityService;
         this.pathUtilityService = pathUtilityService;
-        this.environmentVariableService = environmentVariableService;
         this.logger = logger;
         this.componentDetectionConfig = new ComponentDetectionConfigFile();
         this.serviceInitComplete = false;
@@ -40,12 +36,6 @@ public ComponentDetectionConfigFile GetComponentDetectionConfig()
 
     public async Task InitAsync(string explicitConfigPath, string rootDirectoryPath = null)
     {
-        await this.LoadFromEnvironmentVariableAsync();
-        if (!string.IsNullOrEmpty(explicitConfigPath))
-        {
-            await this.LoadComponentDetectionConfigAsync(explicitConfigPath);
-        }
-
         if (!string.IsNullOrEmpty(rootDirectoryPath))
         {
             await this.LoadComponentDetectionConfigFilesFromRootDirectoryAsync(rootDirectoryPath);
@@ -65,18 +55,6 @@ private async Task LoadComponentDetectionConfigFilesFromRootDirectoryAsync(strin
         }
     }
 
-    private async Task LoadFromEnvironmentVariableAsync()
-    {
-        if (this.environmentVariableService.DoesEnvironmentVariableExist(ComponentDetectionConfigFileEnvVar))
-        {
-            var possibleConfigFilePath = this.environmentVariableService.GetEnvironmentVariable(ComponentDetectionConfigFileEnvVar);
-            if (this.fileUtilityService.Exists(possibleConfigFilePath))
-            {
-                await this.LoadComponentDetectionConfigAsync(possibleConfigFilePath);
-            }
-        }
-    }
-
     private async Task LoadComponentDetectionConfigAsync(string configFile)
     {
         if (!this.fileUtilityService.Exists(configFile))
@@ -87,25 +65,9 @@ private async Task LoadComponentDetectionConfigAsync(string configFile)
         var configFileInfo = new FileInfo(configFile);
         var fileContents = await this.fileUtilityService.ReadAllTextAsync(configFileInfo);
         var newConfig = this.ParseComponentDetectionConfig(fileContents);
-        this.MergeComponentDetectionConfig(newConfig);
         this.logger.LogInformation("Loaded component detection config file from {ConfigFile}", configFile);
     }
 
-    /// <summary>
-    /// Merges two component detection configs, giving precedence to values already set in the first file.
-    /// </summary>
-    /// <param name="newConfig">The new config file to be merged into the existing config set.</param>
-    private void MergeComponentDetectionConfig(ComponentDetectionConfigFile newConfig)
-    {
-        foreach ((var name, var value) in newConfig.Variables)
-        {
-            if (!this.componentDetectionConfig.Variables.ContainsKey(name))
-            {
-                this.componentDetectionConfig.Variables[name] = value;
-            }
-        }
-    }
-
     /// <summary>
     /// Reads the component detection config from a file path.
     /// </summary>
diff --git a/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs b/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs
index 3b22fc207..eec348e92 100644
--- a/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs
+++ b/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs
@@ -37,10 +37,6 @@ public abstract class BaseSettings : CommandSettings
     [CommandOption("--Output")]
     public string Output { get; set; }
 
-    [Description("File path for a ComponentDetection.yml config file with more instructions for detection")]
-    [CommandOption("--ComponentDetectionConfigFile")]
-    public string ComponentDetectionConfigFile { get; set; }
-
     /// <inheritdoc />
     public override ValidationResult Validate()
     {
diff --git a/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs b/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs
index 6b42c03bc..6fc2a35f7 100644
--- a/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs
+++ b/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs
@@ -44,7 +44,7 @@ public ScanCommand(
     public override async Task<int> ExecuteAsync(CommandContext context, ScanSettings settings)
     {
         this.fileWritingService.Init(settings.Output);
-        await this.componentDetectionConfigFileService.InitAsync(settings.ComponentDetectionConfigFile, settings.SourceDirectory.FullName);
+        await this.componentDetectionConfigFileService.InitAsync(settings.SourceDirectory.FullName);
         var result = await this.scanExecutionService.ExecuteScanAsync(settings);
         this.WriteComponentManifest(settings, result);
         return 0;

From 0c3e44885097c3531c545ed5a6001daca0f290c8 Mon Sep 17 00:00:00 2001
From: Fernando Rojo <ferojo@microsoft.com>
Date: Fri, 25 Oct 2024 18:35:38 -0700
Subject: [PATCH 3/3] Revert "remove variable and build arg paths"

This reverts commit 793e54db4d9a9e9d047767ffcde4640ac819c5af.
---
 .../ComponentDetectionConfigFileService.cs    | 38 +++++++++++++++++++
 .../Commands/BaseSettings.cs                  |  4 ++
 .../Commands/ScanCommand.cs                   |  2 +-
 3 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs b/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs
index 0c4551207..ed9632dde 100644
--- a/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs
+++ b/src/Microsoft.ComponentDetection.Common/ComponentDetectionConfigFileService.cs
@@ -10,7 +10,9 @@ namespace Microsoft.ComponentDetection.Common;
 /// <inheritdoc />
 public class ComponentDetectionConfigFileService : IComponentDetectionConfigFileService
 {
+    private const string ComponentDetectionConfigFileEnvVar = "ComponentDetection.ComponentDetectionConfigFile";
     private readonly IFileUtilityService fileUtilityService;
+    private readonly IEnvironmentVariableService environmentVariableService;
     private readonly IPathUtilityService pathUtilityService;
     private readonly ComponentDetectionConfigFile componentDetectionConfig;
     private readonly ILogger<FastDirectoryWalkerFactory> logger;
@@ -18,11 +20,13 @@ public class ComponentDetectionConfigFileService : IComponentDetectionConfigFile
 
     public ComponentDetectionConfigFileService(
         IFileUtilityService fileUtilityService,
+        IEnvironmentVariableService environmentVariableService,
         IPathUtilityService pathUtilityService,
         ILogger<FastDirectoryWalkerFactory> logger)
     {
         this.fileUtilityService = fileUtilityService;
         this.pathUtilityService = pathUtilityService;
+        this.environmentVariableService = environmentVariableService;
         this.logger = logger;
         this.componentDetectionConfig = new ComponentDetectionConfigFile();
         this.serviceInitComplete = false;
@@ -36,6 +40,12 @@ public ComponentDetectionConfigFile GetComponentDetectionConfig()
 
     public async Task InitAsync(string explicitConfigPath, string rootDirectoryPath = null)
     {
+        await this.LoadFromEnvironmentVariableAsync();
+        if (!string.IsNullOrEmpty(explicitConfigPath))
+        {
+            await this.LoadComponentDetectionConfigAsync(explicitConfigPath);
+        }
+
         if (!string.IsNullOrEmpty(rootDirectoryPath))
         {
             await this.LoadComponentDetectionConfigFilesFromRootDirectoryAsync(rootDirectoryPath);
@@ -55,6 +65,18 @@ private async Task LoadComponentDetectionConfigFilesFromRootDirectoryAsync(strin
         }
     }
 
+    private async Task LoadFromEnvironmentVariableAsync()
+    {
+        if (this.environmentVariableService.DoesEnvironmentVariableExist(ComponentDetectionConfigFileEnvVar))
+        {
+            var possibleConfigFilePath = this.environmentVariableService.GetEnvironmentVariable(ComponentDetectionConfigFileEnvVar);
+            if (this.fileUtilityService.Exists(possibleConfigFilePath))
+            {
+                await this.LoadComponentDetectionConfigAsync(possibleConfigFilePath);
+            }
+        }
+    }
+
     private async Task LoadComponentDetectionConfigAsync(string configFile)
     {
         if (!this.fileUtilityService.Exists(configFile))
@@ -65,9 +87,25 @@ private async Task LoadComponentDetectionConfigAsync(string configFile)
         var configFileInfo = new FileInfo(configFile);
         var fileContents = await this.fileUtilityService.ReadAllTextAsync(configFileInfo);
         var newConfig = this.ParseComponentDetectionConfig(fileContents);
+        this.MergeComponentDetectionConfig(newConfig);
         this.logger.LogInformation("Loaded component detection config file from {ConfigFile}", configFile);
     }
 
+    /// <summary>
+    /// Merges two component detection configs, giving precedence to values already set in the first file.
+    /// </summary>
+    /// <param name="newConfig">The new config file to be merged into the existing config set.</param>
+    private void MergeComponentDetectionConfig(ComponentDetectionConfigFile newConfig)
+    {
+        foreach ((var name, var value) in newConfig.Variables)
+        {
+            if (!this.componentDetectionConfig.Variables.ContainsKey(name))
+            {
+                this.componentDetectionConfig.Variables[name] = value;
+            }
+        }
+    }
+
     /// <summary>
     /// Reads the component detection config from a file path.
     /// </summary>
diff --git a/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs b/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs
index eec348e92..3b22fc207 100644
--- a/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs
+++ b/src/Microsoft.ComponentDetection.Orchestrator/Commands/BaseSettings.cs
@@ -37,6 +37,10 @@ public abstract class BaseSettings : CommandSettings
     [CommandOption("--Output")]
     public string Output { get; set; }
 
+    [Description("File path for a ComponentDetection.yml config file with more instructions for detection")]
+    [CommandOption("--ComponentDetectionConfigFile")]
+    public string ComponentDetectionConfigFile { get; set; }
+
     /// <inheritdoc />
     public override ValidationResult Validate()
     {
diff --git a/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs b/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs
index 6fc2a35f7..6b42c03bc 100644
--- a/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs
+++ b/src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanCommand.cs
@@ -44,7 +44,7 @@ public ScanCommand(
     public override async Task<int> ExecuteAsync(CommandContext context, ScanSettings settings)
     {
         this.fileWritingService.Init(settings.Output);
-        await this.componentDetectionConfigFileService.InitAsync(settings.SourceDirectory.FullName);
+        await this.componentDetectionConfigFileService.InitAsync(settings.ComponentDetectionConfigFile, settings.SourceDirectory.FullName);
         var result = await this.scanExecutionService.ExecuteScanAsync(settings);
         this.WriteComponentManifest(settings, result);
         return 0;