Skip to content

Commit 522f0a2

Browse files
shailesh-veracodeshailesh-veracode
authored
Merge pull request #27 from veracode/develop
Release - 0.2.0 features
2 parents eb72c8a + 6acf0e6 commit 522f0a2

29 files changed

+1323
-197
lines changed

‎.github/workflows/binary-ready-veracode-sast-pipeline-scan.yml‎

Lines changed: 146 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ name: Binary Ready - Veracode Static Code Analysis
22

33
run-name: Binary Ready - Static Code Analysis - ${{ github.event.client_payload.repository.name }}
44

5+
concurrency:
6+
group: ${{ github.event.client_payload.event_type }}-${{ github.event.client_payload.repository.name }}-${{ github.event.client_payload.repository.branch }}
7+
cancel-in-progress: true
8+
59
on:
610
repository_dispatch:
711
types: [binary-ready-veracode-sast-pipeline-scan]
@@ -17,27 +21,148 @@ jobs:
1721
event_type: ${{ github.event.client_payload.event_type }}
1822
github_token: ${{ github.event.client_payload.token }}
1923
run_id: ${{ github.run_id }}
20-
21-
pipeline_scan:
24+
branch: ${{ github.event.client_payload.repository.branch }}
25+
26+
validations:
2227
needs: register
2328
runs-on: ubuntu-latest
29+
name: Validations
30+
steps:
31+
- name: Verify Veracode API credentials
32+
id: verify_api_creds
33+
uses: veracode/[email protected]
34+
with:
35+
action: validateVeracodeApiCreds
36+
token: ${{ github.event.client_payload.token }}
37+
vid: ${{ secrets.VERACODE_API_ID }}
38+
vkey: ${{ secrets.VERACODE_API_KEY }}
39+
appname: ${{ github.event.client_payload.user_config.profile_name }}
40+
source_repository: ${{ github.event.client_payload.repository.full_name }}
41+
check_run_id: ${{ needs.register.outputs.run_id }}
42+
43+
- name: Verify Policy name
44+
id: verify_policy_name
45+
if: success()
46+
uses: veracode/[email protected]
47+
with:
48+
action: validatePolicyName
49+
token: ${{ github.event.client_payload.token }}
50+
vid: ${{ secrets.VERACODE_API_ID }}
51+
vkey: ${{ secrets.VERACODE_API_KEY }}
52+
appname: ${{ github.event.client_payload.user_config.profile_name }}
53+
source_repository: ${{ github.event.client_payload.repository.full_name }}
54+
check_run_id: ${{ needs.register.outputs.run_id }}
55+
policyname: ${{ github.event.client_payload.policy_name }}
56+
path: ${{ github.event.client_payload.annotationObj.path }}
57+
start_line: ${{ github.event.client_payload.annotationObj.start_line }}
58+
end_line: ${{ github.event.client_payload.annotationObj.end_line }}
59+
break_build_invalid_policy: ${{github.event.client_payload.break_build_invalid_policy }}
60+
61+
pipeline_scan:
62+
needs: [register, validations]
63+
runs-on: ubuntu-latest
64+
steps:
65+
- name: Download artifact
66+
id: download-artifact
67+
uses: actions/download-artifact@v4
68+
with:
69+
github-token: ${{ github.event.client_payload.token }}
70+
repository: ${{ github.event.client_payload.repository.full_name }}
71+
run-id: ${{ github.event.client_payload.run_id }}
72+
73+
- name: Veracode Pipeline-Scan
74+
id: pipeline-scan
75+
uses: veracode/[email protected]
76+
with:
77+
vid: ${{ secrets.VERACODE_API_ID }}
78+
vkey: ${{ secrets.VERACODE_API_KEY }}
79+
veracode_policy_name: ${{ github.event.client_payload.policy_name }}
80+
file: ${{ github.event.client_payload.repository.artifact_file }}
81+
fail_build: ${{ github.event.client_payload.user_config.break_build_policy_findings }}
82+
use_upgraded_version: true
83+
84+
- name: Veracode Pipeline Results
85+
if: always()
86+
id: prepare-results
87+
uses: Veracode/[email protected]
88+
with:
89+
action: 'preparePipelineResults'
90+
token: ${{ github.event.client_payload.token }}
91+
check_run_id: ${{ needs.register.outputs.run_id }}
92+
vid: ${{ secrets.VERACODE_API_ID }}
93+
vkey: ${{ secrets.VERACODE_API_KEY }}
94+
appname: ${{ github.event.client_payload.user_config.profile_name }}
95+
source_repository: ${{ github.event.client_payload.repository.full_name }}
96+
fail_checks_on_policy: ${{ github.event.client_payload.user_config.break_build_policy_findings }}
97+
fail_checks_on_error: ${{ github.event.client_payload.user_config.break_build_on_error }}
98+
filter_mitigated_flaws: ${{ github.event.client_payload.user_config.filter_mitigated_flaws }}
99+
100+
code-scanning-alert:
101+
needs: pipeline_scan
102+
runs-on: ubuntu-latest
103+
if: ${{ github.event.client_payload.user_config.create_code_scanning_alert && always() }}
104+
name: Create code scanning alerts
105+
steps:
106+
- name: Get scan results
107+
uses: actions/download-artifact@v4
108+
with:
109+
name: "Veracode Pipeline-Scan Results - Mitigated findings"
110+
111+
- name: Convert pipeline scan output to SARIF format for Java language
112+
if: ${{ github.event.client_payload.repository.language == 'Java' }}
113+
uses: Veracode/[email protected]
114+
with:
115+
pipeline-results-json: filtered_results.json
116+
output-results-sarif: veracode-results.sarif
117+
repo_owner: ${{ github.event.client_payload.repository.owner }}
118+
repo_name: ${{ github.event.client_payload.repository.name }}
119+
commitSHA: ${{ github.event.client_payload.sha }}
120+
ref: ${{ github.event.client_payload.user_config.ref }}
121+
githubToken: ${{ github.event.client_payload.token }}
122+
source-base-path-1: 'com/:src/main/java/com/'
123+
source-base-path-2: 'WEB-INF:src/main/webapp/WEB-INF'
124+
125+
- name: Convert pipeline scan output to SARIF format for non Java language
126+
if: ${{ github.event.client_payload.repository.language != 'Java' }}
127+
uses: Veracode/[email protected]
128+
with:
129+
pipeline-results-json: filtered_results.json
130+
output-results-sarif: veracode-results.sarif
131+
repo_owner: ${{ github.event.client_payload.repository.owner }}
132+
repo_name: ${{ github.event.client_payload.repository.name }}
133+
commitSHA: ${{ github.event.client_payload.sha }}
134+
ref: ${{ github.event.client_payload.user_config.ref }}
135+
githubToken: ${{ github.event.client_payload.token }}
136+
137+
create-issues:
138+
needs: pipeline_scan
139+
runs-on: ubuntu-latest
140+
if: ${{ github.event.client_payload.user_config.create_issue && always() }}
141+
name: Create issues
24142
steps:
25-
- name: Download artifact
26-
id: download-artifact
27-
uses: dawidd6/action-download-artifact@v2
28-
with:
29-
github_token: ${{secrets.GITHUB_TOKEN}}
30-
run_id: ${{ github.event.client_payload.run_id }}
31-
repo: ${{ github.event.client_payload.repository.full_name }}
32-
- name: Get the name of the downloaded files
33-
run: |
34-
artifact_file=$(ls -1 ./veracode-artifact | head -n 1)
35-
echo "veracode_artifact=$artifact_file" >> $GITHUB_ENV
36-
- name: Veracode Pipeline-Scan
37-
id: pipeline-scan
38-
uses: veracode/[email protected]
39-
with:
40-
vid: ${{ secrets.VERACODE_API_ID }}
41-
vkey: ${{ secrets.VERACODE_API_KEY }}
42-
file: ./veracode-artifact/${{ env.veracode_artifact }}
43-
fail_build: true
143+
- name: Get scan results
144+
uses: actions/download-artifact@v4
145+
with:
146+
name: 'Veracode Pipeline-Scan Results - Mitigated findings'
147+
148+
- name: Create flaws as issues for Java language
149+
if: ${{ github.event.client_payload.repository.language == 'Java' }}
150+
uses: veracode/[email protected]
151+
with:
152+
scan-results-json: 'filtered_results.json'
153+
repo_owner: ${{ github.event.client_payload.repository.owner }}
154+
github-token: ${{ github.event.client_payload.token }}
155+
repo_name: ${{ github.event.client_payload.repository.name }}
156+
commitHash: ${{ github.event.client_payload.sha }}
157+
source_base_path_1: 'com/:src/main/java/com/'
158+
source_base_path_2: 'WEB-INF:src/main/webapp/WEB-INF'
159+
160+
- name: Create flaws as issues for non Java language
161+
if: ${{ github.event.client_payload.repository.language != 'Java' }}
162+
uses: veracode/[email protected]
163+
with:
164+
scan-results-json: 'filtered_results.json'
165+
repo_owner: ${{ github.event.client_payload.repository.owner }}
166+
github-token: ${{ github.event.client_payload.token }}
167+
repo_name: ${{ github.event.client_payload.repository.name }}
168+
commitHash: ${{ github.event.client_payload.sha }}

‎.github/workflows/binary-ready-veracode-sast-policy-scan.yml‎

Lines changed: 158 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ name: Binary Ready - Veracode Static Code Analysis
22

33
run-name: Binary Ready - Static Code Analysis - ${{ github.event.client_payload.repository.name }}
44

5+
concurrency:
6+
group: ${{ github.event.client_payload.event_type }}-${{ github.event.client_payload.repository.name }}-${{ github.event.client_payload.repository.branch }}
7+
cancel-in-progress: true
8+
59
on:
610
repository_dispatch:
711
types: [binary-ready-veracode-sast-policy-scan]
@@ -17,33 +21,171 @@ jobs:
1721
event_type: ${{ github.event.client_payload.event_type }}
1822
github_token: ${{ github.event.client_payload.token }}
1923
run_id: ${{ github.run_id }}
24+
branch: ${{ github.event.client_payload.repository.branch }}
2025

21-
policy_scan:
26+
validations:
2227
needs: register
2328
runs-on: ubuntu-latest
29+
name: Validations
30+
steps:
31+
- name: Verify Veracode API credentials
32+
id: verify_api_creds
33+
uses: veracode/[email protected]
34+
with:
35+
action: validateVeracodeApiCreds
36+
token: ${{ github.event.client_payload.token }}
37+
vid: ${{ secrets.VERACODE_API_ID }}
38+
vkey: ${{ secrets.VERACODE_API_KEY }}
39+
appname: ${{ github.event.client_payload.user_config.profile_name }}
40+
source_repository: ${{ github.event.client_payload.repository.full_name }}
41+
check_run_id: ${{ needs.register.outputs.run_id }}
42+
43+
- name: Verify Policy name
44+
id: verify_policy_name
45+
if: success()
46+
uses: veracode/[email protected]
47+
with:
48+
action: validatePolicyName
49+
token: ${{ github.event.client_payload.token }}
50+
vid: ${{ secrets.VERACODE_API_ID }}
51+
vkey: ${{ secrets.VERACODE_API_KEY }}
52+
appname: ${{ github.event.client_payload.user_config.profile_name }}
53+
source_repository: ${{ github.event.client_payload.repository.full_name }}
54+
check_run_id: ${{ needs.register.outputs.run_id }}
55+
policyname: ${{ github.event.client_payload.policy_name }}
56+
path: ${{ github.event.client_payload.annotationObj.path }}
57+
start_line: ${{ github.event.client_payload.annotationObj.start_line }}
58+
end_line: ${{ github.event.client_payload.annotationObj.end_line }}
59+
break_build_invalid_policy: ${{github.event.client_payload.break_build_invalid_policy }}
60+
61+
policy_scan:
62+
needs: [register, validations]
63+
runs-on: ubuntu-latest
2464
steps:
2565
- name: Download artifact
2666
id: download-artifact
27-
uses: dawidd6/action-download-artifact@v2
28-
with:
29-
github_token: ${{ github.event.client_payload.token }}
30-
run_id: ${{ github.event.client_payload.run_id }}
31-
repo: ${{ github.event.client_payload.repository.full_name }}
32-
- name: Get the name of the downloaded files
33-
run: |
34-
artifact_file=$(ls -1 ./veracode-artifact | head -n 1)
35-
echo "veracode_artifact=$artifact_file" >> $GITHUB_ENV
67+
uses: actions/download-artifact@v4
68+
with:
69+
github-token: ${{ github.event.client_payload.token }}
70+
repository: ${{ github.event.client_payload.repository.full_name }}
71+
run-id: ${{ github.event.client_payload.run_id }}
72+
3673
- name: Veracode Upload and Scan Action Step
37-
uses: veracode/uploadandscan-action@main
74+
uses: veracode/uploadandscan-action@v0.1.4
3875
id: upload_and_scan
3976
with:
4077
vid: '${{ secrets.VERACODE_API_ID }}'
4178
vkey: '${{ secrets.VERACODE_API_KEY }}'
42-
appname: ${{ github.event.client_payload.profile_name }}
79+
appname: ${{ github.event.client_payload.user_config.profile_name }}
4380
createprofile: true
4481
version: '${{ github.run_id }}'
45-
filepath: ./veracode-artifact/${{ env.veracode_artifact }}
46-
include: ${{ github.event.client_payload.modules_to_scan }}
47-
policy: VeraDemo Policy
82+
filepath: ${{ github.event.client_payload.repository.artifact_file }}
83+
# include: ${{ github.event.client_payload.modules_to_scan }}
84+
policy: ${{ github.event.client_payload.policy_name }}
4885
scantimeout: 15
49-
failbuild: true
86+
failbuild: ${{ github.event.client_payload.user_config.break_build_policy_findings }}
87+
use_upgraded_version: true
88+
89+
- name: Veracode Policy Results
90+
id: prepare-results
91+
if: always()
92+
uses: Veracode/[email protected]
93+
with:
94+
action: 'preparePolicyResults'
95+
token: ${{ github.event.client_payload.token }}
96+
check_run_id: ${{ needs.register.outputs.run_id }}
97+
vid: ${{ secrets.VERACODE_API_ID }}
98+
vkey: ${{ secrets.VERACODE_API_KEY }}
99+
appname: ${{ github.event.client_payload.user_config.profile_name }}
100+
source_repository: ${{ github.event.client_payload.repository.full_name }}
101+
fail_checks_on_policy: ${{ github.event.client_payload.user_config.break_build_policy_findings }}
102+
fail_checks_on_error: ${{ github.event.client_payload.user_config.break_build_on_error }}
103+
filter_mitigated_flaws: ${{ github.event.client_payload.user_config.filter_mitigated_flaws }}
104+
105+
veracode-remove-sandbox:
106+
needs: policy_scan
107+
runs-on: ubuntu-latest
108+
if: ${{ github.event.client_payload.user_config.sandbox_scan.execute_remove_sandbox_action && always() }}
109+
name: Remove Sandbox
110+
steps:
111+
- uses: veracode/[email protected]
112+
with:
113+
action: 'removeSandbox'
114+
vid: ${{ secrets.VERACODE_API_ID }}
115+
vkey: ${{ secrets.VERACODE_API_KEY }}
116+
appname: ${{ github.event.client_payload.user_config.profile_name }}
117+
sandboxname: GitHub App Scans-${{ github.event.client_payload.user_config.sandbox_scan.branch }}
118+
119+
code-scanning-alert:
120+
needs: policy_scan
121+
runs-on: ubuntu-latest
122+
if: ${{ github.event.client_payload.user_config.create_code_scanning_alert && always() }}
123+
name: Create code scanning alerts
124+
steps:
125+
- name: Get scan results
126+
uses: actions/download-artifact@v4
127+
with:
128+
name: policy-flaws
129+
path: /tmp
130+
131+
- name: Convert policy scan output to SARIF format for Java language
132+
if: ${{ github.event.client_payload.repository.language == 'Java' }}
133+
uses: Veracode/[email protected]
134+
with:
135+
scan-type: policy
136+
results-json: '/tmp/policy_flaws.json'
137+
output-results-sarif: veracode-results.sarif
138+
repo_owner: ${{ github.event.client_payload.repository.owner }}
139+
repo_name: ${{ github.event.client_payload.repository.name }}
140+
commitSHA: ${{ github.event.client_payload.sha }}
141+
ref: ${{ github.event.client_payload.user_config.ref }}
142+
githubToken: ${{ github.event.client_payload.token }}
143+
source-base-path-1: 'com/:src/main/java/com/'
144+
source-base-path-2: 'WEB-INF:src/main/webapp/WEB-INF'
145+
146+
- name: Convert policy scan output to SARIF format for non Java language
147+
if: ${{ github.event.client_payload.repository.language != 'Java' }}
148+
uses: Veracode/[email protected]
149+
with:
150+
scan-type: policy
151+
results-json: '/tmp/policy_flaws.json'
152+
output-results-sarif: veracode-results.sarif
153+
repo_owner: ${{ github.event.client_payload.repository.owner }}
154+
repo_name: ${{ github.event.client_payload.repository.name }}
155+
commitSHA: ${{ github.event.client_payload.sha }}
156+
ref: ${{ github.event.client_payload.user_config.ref }}
157+
githubToken: ${{ github.event.client_payload.token }}
158+
159+
create-issues:
160+
needs: policy_scan
161+
if: ${{ github.event.client_payload.user_config.create_issue && always() }}
162+
runs-on: ubuntu-latest
163+
name: Create issues
164+
steps:
165+
- name: Get flaw file
166+
uses: actions/download-artifact@v4
167+
with:
168+
name: 'policy-flaws'
169+
path: /tmp
170+
171+
- name: Create flaws as issues for Java language
172+
if: ${{ github.event.client_payload.repository.language == 'Java' }}
173+
uses: veracode/[email protected]
174+
with:
175+
scan-results-json: '/tmp/policy_flaws.json'
176+
repo_owner: ${{ github.event.client_payload.repository.owner }}
177+
github-token: ${{ github.event.client_payload.token }}
178+
repo_name: ${{ github.event.client_payload.repository.name }}
179+
commitHash: ${{ github.event.client_payload.sha }}
180+
source_base_path_1: 'com/:src/main/java/com/'
181+
source_base_path_2: 'WEB-INF:src/main/webapp/WEB-INF'
182+
183+
- name: Create flaws as issues for non Java language
184+
if: ${{ github.event.client_payload.repository.language != 'Java' }}
185+
uses: veracode/[email protected]
186+
with:
187+
scan-results-json: '/tmp/policy_flaws.json'
188+
repo_owner: ${{ github.event.client_payload.repository.owner }}
189+
github-token: ${{ github.event.client_payload.token }}
190+
repo_name: ${{ github.event.client_payload.repository.name }}
191+
commitHash: ${{ github.event.client_payload.sha }}

0 commit comments

Comments
 (0)