Skip to content

Commit ede909d

Browse files
veraakarthikbharadwajveraakarthikbharadwaj
committed
Support multiple artifacts in pipeline scan
1 parent 8c8cf56 commit ede909d

9 files changed

+207
-211
lines changed

‎.github/workflows/binary-ready-veracode-sast-pipeline-scan.yml‎

Lines changed: 96 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
steps:
3131
- name: Verify Veracode API credentials
3232
id: verify_api_creds
33-
uses: veracode/[email protected].5
33+
uses: veracode/[email protected].6
3434
with:
3535
action: validateVeracodeApiCreds
3636
token: ${{ github.event.client_payload.token }}
@@ -43,7 +43,7 @@ jobs:
4343
- name: Verify Policy name
4444
id: verify_policy_name
4545
if: success()
46-
uses: veracode/[email protected].5
46+
uses: veracode/[email protected].6
4747
with:
4848
action: validatePolicyName
4949
token: ${{ github.event.client_payload.token }}
@@ -58,9 +58,13 @@ jobs:
5858
end_line: ${{ github.event.client_payload.annotationObj.end_line }}
5959
break_build_invalid_policy: ${{github.event.client_payload.break_build_invalid_policy }}
6060

61-
pipeline_scan:
62-
needs: [register, validations]
61+
prepare_pipeline_scan:
6362
runs-on: ubuntu-latest
63+
needs: [register, validations]
64+
name: prepare pipeline scan
65+
outputs:
66+
matrix_files: ${{ steps.get-files.outputs.matrix_files }}
67+
6468
steps:
6569
- name: Download artifact
6670
id: download-artifact
@@ -69,21 +73,71 @@ jobs:
6973
github-token: ${{ github.event.client_payload.token }}
7074
repository: ${{ github.event.client_payload.repository.full_name }}
7175
run-id: ${{ github.event.client_payload.run_id }}
76+
name: ${{ github.event.client_payload.repository.artifact_file }}
77+
path: ./veracode_artifact_directory
7278

79+
- name: Get list of files for matrix
80+
id: get-files
81+
run: |
82+
files=$(ls -1 veracode_artifact_directory | jq -R . | jq -s .)
83+
echo "Files for matrix: $files"
84+
files=$(echo $files | jq -c .) # Compact the JSON array to a single line
85+
echo "matrix_files=$files" >> $GITHUB_OUTPUT
86+
shell: bash
87+
88+
pipeline_scan:
89+
runs-on: ubuntu-latest
90+
needs: [register, validations, prepare_pipeline_scan]
91+
strategy:
92+
matrix:
93+
file: ${{fromJson(needs.prepare_pipeline_scan.outputs.matrix_files)}}
94+
95+
steps:
96+
- name: checkout repo
97+
uses: actions/checkout@v4
98+
with:
99+
repository: ${{ github.event.client_payload.repository.owner }}/${{ github.event.client_payload.repository.name }}
100+
ref: ${{ github.event.client_payload.user_config.ref }}
101+
token: ${{ github.event.client_payload.token }}
102+
103+
- name: Download artifact
104+
uses: actions/download-artifact@v4
105+
with:
106+
github-token: ${{ github.event.client_payload.token }}
107+
repository: ${{ github.event.client_payload.repository.full_name }}
108+
run-id: ${{ github.event.client_payload.run_id }}
109+
name: ${{ github.event.client_payload.repository.artifact_file }}
110+
path: ./veracode_artifact_directory
111+
112+
- name: Debug Matrix Content
113+
run: |
114+
echo "Raw matrix files: ${{ needs.prepare_pipeline_scan.outputs.matrix_files }}"
115+
echo "Current Matrix: ${{ matrix }}"
116+
echo "Current File: ${{ matrix.file }}"
117+
118+
# run the pipeline scan action
73119
- name: Veracode Pipeline-Scan
120+
if: always()
74121
id: pipeline-scan
75-
uses: veracode/[email protected].16
122+
uses: veracode/[email protected].17
76123
with:
77124
vid: ${{ secrets.VERACODE_API_ID }}
78125
vkey: ${{ secrets.VERACODE_API_KEY }}
79126
veracode_policy_name: ${{ github.event.client_payload.policy_name }}
80-
file: ${{ github.event.client_payload.repository.artifact_file }}
127+
file: ./veracode_artifact_directory/${{ matrix.file }}
81128
fail_build: ${{ github.event.client_payload.user_config.break_build_policy_findings }}
82-
129+
summary_output: true
130+
summary_output_file: ${{ strategy.job-index }}-results.txt
131+
json_output: true
132+
json_output_file: ${{ strategy.job-index }}-results.json
133+
filtered_json_output_file: ${{ strategy.job-index }}-filtered_results.json
134+
artifact_name: ${{ matrix.file }}
135+
debug: 1
136+
83137
- name: Veracode Pipeline Results
84138
if: always()
85139
id: prepare-results
86-
uses: Veracode/[email protected].5
140+
uses: veracode/[email protected].6
87141
with:
88142
action: 'preparePipelineResults'
89143
token: ${{ github.event.client_payload.token }}
@@ -95,73 +149,52 @@ jobs:
95149
fail_checks_on_policy: ${{ github.event.client_payload.user_config.break_build_policy_findings }}
96150
fail_checks_on_error: ${{ github.event.client_payload.user_config.break_build_on_error }}
97151
filter_mitigated_flaws: ${{ github.event.client_payload.user_config.filter_mitigated_flaws }}
152+
filtered_results_file: ${{ strategy.job-index }}-filtered_results.json
98153

99-
code-scanning-alert:
100-
needs: pipeline_scan
101-
runs-on: ubuntu-latest
102-
if: ${{ github.event.client_payload.user_config.create_code_scanning_alert && always() }}
103-
name: Create code scanning alerts
104-
steps:
105-
- name: Get scan results
106-
uses: actions/download-artifact@v4
107-
with:
108-
name: "Veracode Pipeline-Scan Results - Mitigated findings"
109-
110-
- name: Convert pipeline scan output to SARIF format for Java language
111-
if: ${{ github.event.client_payload.repository.language == 'Java' }}
112-
uses: Veracode/[email protected]
154+
- name: Convert pipeline scan output to SARIF format
155+
if: ${{ github.event.client_payload.user_config.create_code_scanning_alert && always() }}
156+
uses: Veracode/[email protected]
113157
with:
114-
pipeline-results-json: filtered_results.json
158+
pipeline-results-json: mitigated_${{ strategy.job-index }}-filtered_results.json
115159
output-results-sarif: veracode-results.sarif
116160
repo_owner: ${{ github.event.client_payload.repository.owner }}
117161
repo_name: ${{ github.event.client_payload.repository.name }}
118162
commitSHA: ${{ github.event.client_payload.sha }}
119163
ref: ${{ github.event.client_payload.user_config.ref }}
120164
githubToken: ${{ github.event.client_payload.token }}
121-
source-base-path-1: 'com/:src/main/java/com/'
122-
source-base-path-2: 'WEB-INF:src/main/webapp/WEB-INF'
123165

124-
- name: Convert pipeline scan output to SARIF format for non Java language
125-
if: ${{ github.event.client_payload.repository.language != 'Java' }}
126-
uses: Veracode/veracode-pipeline-scan-results-to-sarif@v2.0.3
166+
- name: Create flaws as issues
167+
if: ${{ github.event.client_payload.user_config.create_issue && always() }}
168+
uses: veracode/veracode-flaws-to-issues@v2.2.25
127169
with:
128-
pipeline-results-json: filtered_results.json
129-
output-results-sarif: veracode-results.sarif
130-
repo_owner: ${{ github.event.client_payload.repository.owner }}
131-
repo_name: ${{ github.event.client_payload.repository.name }}
132-
commitSHA: ${{ github.event.client_payload.sha }}
133-
ref: ${{ github.event.client_payload.user_config.ref }}
134-
githubToken: ${{ github.event.client_payload.token }}
135-
136-
create-issues:
137-
needs: pipeline_scan
138-
runs-on: ubuntu-latest
139-
if: ${{ github.event.client_payload.user_config.create_issue && always() }}
140-
name: Create issues
141-
steps:
142-
- name: Get scan results
143-
uses: actions/download-artifact@v4
144-
with:
145-
name: 'Veracode Pipeline-Scan Results - Mitigated findings'
146-
147-
- name: Create flaws as issues for Java language
148-
if: ${{ github.event.client_payload.repository.language == 'Java' }}
149-
uses: veracode/[email protected]
150-
with:
151-
scan-results-json: 'filtered_results.json'
170+
scan-results-json: mitigated_${{ strategy.job-index }}-filtered_results.json
152171
repo_owner: ${{ github.event.client_payload.repository.owner }}
153172
github-token: ${{ github.event.client_payload.token }}
154173
repo_name: ${{ github.event.client_payload.repository.name }}
155174
commitHash: ${{ github.event.client_payload.sha }}
156-
source_base_path_1: 'com/:src/main/java/com/'
157-
source_base_path_2: 'WEB-INF:src/main/webapp/WEB-INF'
158175

159-
- name: Create flaws as issues for non Java language
160-
if: ${{ github.event.client_payload.repository.language != 'Java' }}
161-
uses: veracode/[email protected]
162-
with:
163-
scan-results-json: 'filtered_results.json'
164-
repo_owner: ${{ github.event.client_payload.repository.owner }}
165-
github-token: ${{ github.event.client_payload.token }}
166-
repo_name: ${{ github.event.client_payload.repository.name }}
167-
commitHash: ${{ github.event.client_payload.sha }}
176+
update-checks-status:
177+
runs-on: ubuntu-latest
178+
needs: pipeline_scan
179+
if: always()
180+
steps:
181+
- name: Update cxheck
182+
id: update_check_status
183+
shell: bash
184+
run: |
185+
# Convert JSON string to a proper format for jq processing
186+
echo '${{ toJSON(needs) }}' | jq -c 'to_entries[]' | while read -r job; do
187+
status=$(echo "$job" | jq -r '.value.result')
188+
if [ "$status" = "success" ]; then
189+
echo "Job scuccess no need to update"
190+
success_count=$((success_count + 1))
191+
elif [ "$status" = "failure" ]; then
192+
echo "Jobs failed - need checks update"
193+
echo '{"status": "completed", "conclusion": "failure"}' > payload.txt
194+
curl -X PATCH \
195+
-H "Authorization: Bearer ${{ github.event.client_payload.token }}" \
196+
-H "Accept: application/vnd.github+json" \
197+
https://api.github.com/repos/${{ github.event.client_payload.repository.owner }}/${{ github.event.client_payload.repository.name }}/check-runs/${{ needs.register.outputs.run_id }} \
198+
-d @"payload.txt"
199+
fi
200+
done

‎.github/workflows/binary-ready-veracode-sast-policy-scan.yml‎

Lines changed: 13 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
steps:
3131
- name: Verify Veracode API credentials
3232
id: verify_api_creds
33-
uses: veracode/[email protected].5
33+
uses: veracode/[email protected].6
3434
with:
3535
action: validateVeracodeApiCreds
3636
token: ${{ github.event.client_payload.token }}
@@ -43,7 +43,7 @@ jobs:
4343
- name: Verify Policy name
4444
id: verify_policy_name
4545
if: success()
46-
uses: veracode/[email protected].5
46+
uses: veracode/[email protected].6
4747
with:
4848
action: validatePolicyName
4949
token: ${{ github.event.client_payload.token }}
@@ -69,6 +69,8 @@ jobs:
6969
github-token: ${{ github.event.client_payload.token }}
7070
repository: ${{ github.event.client_payload.repository.full_name }}
7171
run-id: ${{ github.event.client_payload.run_id }}
72+
name: ${{ github.event.client_payload.repository.artifact_file }}
73+
path: ./veracode_artifact_directory
7274

7375
- name: Veracode Upload and Scan Action Step
7476
uses: veracode/[email protected]
@@ -79,16 +81,16 @@ jobs:
7981
appname: ${{ github.event.client_payload.user_config.profile_name }}
8082
createprofile: true
8183
version: '${{ github.run_id }}'
82-
filepath: ${{ github.event.client_payload.repository.artifact_file }}
84+
filepath: ./veracode_artifact_directory/
8385
# include: ${{ github.event.client_payload.modules_to_scan }}
8486
policy: ${{ github.event.client_payload.policy_name }}
85-
scantimeout: 15
87+
scantimeout: 30
8688
failbuild: ${{ github.event.client_payload.user_config.break_build_policy_findings }}
8789

8890
- name: Veracode Policy Results
8991
id: prepare-results
9092
if: always()
91-
uses: Veracode/[email protected].5
93+
uses: veracode/[email protected].6
9294
with:
9395
action: 'preparePolicyResults'
9496
token: ${{ github.event.client_payload.token }}
@@ -107,7 +109,7 @@ jobs:
107109
if: ${{ github.event.client_payload.user_config.sandbox_scan.execute_remove_sandbox_action && always() }}
108110
name: Remove Sandbox
109111
steps:
110-
- uses: veracode/[email protected].5
112+
- uses: veracode/[email protected].6
111113
with:
112114
action: 'removeSandbox'
113115
vid: ${{ secrets.VERACODE_API_ID }}
@@ -127,24 +129,8 @@ jobs:
127129
name: policy-flaws
128130
path: /tmp
129131

130-
- name: Convert policy scan output to SARIF format for Java language
131-
if: ${{ github.event.client_payload.repository.language == 'Java' }}
132-
uses: Veracode/[email protected]
133-
with:
134-
scan-type: policy
135-
results-json: '/tmp/policy_flaws.json'
136-
output-results-sarif: veracode-results.sarif
137-
repo_owner: ${{ github.event.client_payload.repository.owner }}
138-
repo_name: ${{ github.event.client_payload.repository.name }}
139-
commitSHA: ${{ github.event.client_payload.sha }}
140-
ref: ${{ github.event.client_payload.user_config.ref }}
141-
githubToken: ${{ github.event.client_payload.token }}
142-
source-base-path-1: 'com/:src/main/java/com/'
143-
source-base-path-2: 'WEB-INF:src/main/webapp/WEB-INF'
144-
145-
- name: Convert policy scan output to SARIF format for non Java language
146-
if: ${{ github.event.client_payload.repository.language != 'Java' }}
147-
uses: Veracode/[email protected]
132+
- name: Convert policy scan output to SARIF format
133+
uses: Veracode/[email protected]
148134
with:
149135
scan-type: policy
150136
results-json: '/tmp/policy_flaws.json'
@@ -167,24 +153,11 @@ jobs:
167153
name: 'policy-flaws'
168154
path: /tmp
169155

170-
- name: Create flaws as issues for Java language
171-
if: ${{ github.event.client_payload.repository.language == 'Java' }}
172-
uses: veracode/[email protected]
173-
with:
174-
scan-results-json: '/tmp/policy_flaws.json'
175-
repo_owner: ${{ github.event.client_payload.repository.owner }}
176-
github-token: ${{ github.event.client_payload.token }}
177-
repo_name: ${{ github.event.client_payload.repository.name }}
178-
commitHash: ${{ github.event.client_payload.sha }}
179-
source_base_path_1: 'com/:src/main/java/com/'
180-
source_base_path_2: 'WEB-INF:src/main/webapp/WEB-INF'
181-
182-
- name: Create flaws as issues for non Java language
183-
if: ${{ github.event.client_payload.repository.language != 'Java' }}
184-
uses: veracode/[email protected]
156+
- name: Create flaws as issues
157+
uses: veracode/[email protected]
185158
with:
186159
scan-results-json: '/tmp/policy_flaws.json'
187160
repo_owner: ${{ github.event.client_payload.repository.owner }}
188161
github-token: ${{ github.event.client_payload.token }}
189162
repo_name: ${{ github.event.client_payload.repository.name }}
190-
commitHash: ${{ github.event.client_payload.sha }}
163+
commitHash: ${{ github.event.client_payload.sha }}

‎.github/workflows/binary-ready-veracode-sast-sandbox-scan.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ jobs:
2121
github-token: ${{ github.event.client_payload.token }}
2222
repository: ${{ github.event.client_payload.repository.full_name }}
2323
run-id: ${{ github.event.client_payload.run_id }}
24+
name: ${{ github.event.client_payload.repository.artifact_file }}
25+
path: ./veracode_artifact_directory
2426

2527
- name: Veracode Upload and Scan Action Step
2628
id: upload_and_scan
@@ -30,10 +32,10 @@ jobs:
3032
createprofile: true
3133
policy: ${{ github.event.client_payload.policy_name }}
3234
version: '${{ github.run_id }}'
33-
filepath: ${{ github.event.client_payload.repository.artifact_file }}
35+
filepath: ./veracode_artifact_directory/
3436
vid: '${{ secrets.VERACODE_API_ID }}'
3537
vkey: '${{ secrets.VERACODE_API_KEY }}'
3638
createsandbox: true
3739
sandboxname: GitHub App Scans-${{ github.event.client_payload.repository.branch }}
3840
# include: ${{ github.event.client_payload.modules_to_scan }}
39-
failbuild: ${{ github.event.client_payload.user_config.break_build_policy_findings }}
41+
failbuild: ${{ github.event.client_payload.user_config.break_build_policy_findings }}

‎.github/workflows/template-register.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
steps:
1515
- name: Register build
1616
id: register-build
17-
uses: veracode/[email protected].5
17+
uses: veracode/[email protected].6
1818
with:
1919
action: registerBuild
2020
token: ${{ github.event.client_payload.token }}

‎.github/workflows/veracode-code-analysis.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ jobs:
5252
steps:
5353
- name: Verify Veracode API credentials
5454
id: verify_api_creds
55-
uses: veracode/[email protected].5
55+
uses: veracode/[email protected].6
5656
with:
5757
action: validateVeracodeApiCreds
5858
token: ${{ github.event.client_payload.token }}
@@ -65,7 +65,7 @@ jobs:
6565
- name: Verify Policy name
6666
id: verify_policy_name
6767
if: success()
68-
uses: veracode/[email protected].5
68+
uses: veracode/[email protected].6
6969
with:
7070
action: validatePolicyName
7171
token: ${{ github.event.client_payload.token }}

‎.github/workflows/veracode-iac-secrets-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
steps:
3131
- name: Verify Veracode API credentials
3232
id: verify_api_creds
33-
uses: veracode/[email protected].5
33+
uses: veracode/[email protected].6
3434
with:
3535
action: validateVeracodeApiCreds
3636
token: ${{ github.event.client_payload.token }}

0 commit comments

Comments
 (0)