From 1a37cd53451ca29b380e72f0f307050d81f9d589 Mon Sep 17 00:00:00 2001 From: anaarmas <54946499+anaarmas@users.noreply.github.com> Date: Fri, 19 Nov 2021 16:42:04 +0100 Subject: [PATCH 1/3] add veracode workflow --- .../properties/veracode.properties.json | 7 ++ code-scanning/veracode.yml | 66 +++++++++++++++++++ icons/veracode.svg | 1 + 3 files changed, 74 insertions(+) create mode 100644 code-scanning/properties/veracode.properties.json create mode 100644 code-scanning/veracode.yml create mode 100644 icons/veracode.svg diff --git a/code-scanning/properties/veracode.properties.json b/code-scanning/properties/veracode.properties.json new file mode 100644 index 0000000..e42ac9f --- /dev/null +++ b/code-scanning/properties/veracode.properties.json @@ -0,0 +1,7 @@ +{ + "name": "Veracode Static Analysis", + "creator": "Veracode", + "description": "Get fast feedback on flaws with Veracode Static Analysis and the pipeline scan. Break the build based on flaw severity and CWE category.", + "iconName": "veracode", + "categories": ["Code Scanning", "javascript", "python", "java", "php", "c#", "c", "c++", "ruby", "swift", "go", "kotlin", "scala", "groovy", "tsql", "plsql", "perl", "cobol"] +} \ No newline at end of file diff --git a/code-scanning/veracode.yml b/code-scanning/veracode.yml new file mode 100644 index 0000000..31fa989 --- /dev/null +++ b/code-scanning/veracode.yml @@ -0,0 +1,66 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert + +name: Veracode Static Analysis Pipeline Scan + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ $default-branch ] + schedule: + - cron: $cron-weekly + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter + build-and-pipeline-scan: + # The type of runner that the job will run on + runs-on: ubuntu-latest + steps: + + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps + - uses: actions/checkout@v2 + with: + repository: '' + + - uses: vimtor/action-zip@5f1c4aa587ea41db1110df6a99981dbe19cee310 + with: + files: / + recursive: true + dest: veracode-pipeline-scan-results-to-sarif.zip + + - uses: actions/upload-artifact@v1 + with: + name: my-artifact + path: veracode-pipeline-scan-results-to-sarif.zip + + # download the Veracode Static Analysis Pipeline scan jar + - uses: wei/curl@012398a392d02480afa2720780031f8621d5f94c + with: + args: -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip + - run: unzip -o pipeline-scan-LATEST.zip + + - uses: actions/setup-java@v1 + with: + java-version: 1.8 + - run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-pipeline-scan-results-to-sarif.zip + continue-on-error: true + - uses: actions/upload-artifact@v1 + with: + name: ScanResults + path: results.json + - name: Convert pipeline scan output to SARIF format + id: convert + uses: veracode/veracode-pipeline-scan-results-to-sarif@ff08ae5b45d5384cb4679932f184c013d34da9be + with: + pipeline-results-json: results.json + - uses: github/codeql-action/upload-sarif@v1 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: veracode-results.sarif diff --git a/icons/veracode.svg b/icons/veracode.svg new file mode 100644 index 0000000..6c70e79 --- /dev/null +++ b/icons/veracode.svg @@ -0,0 +1 @@ + \ No newline at end of file From b6299984305a9e6dfa939d1691051301339ed1d2 Mon Sep 17 00:00:00 2001 From: anaarmas <54946499+anaarmas@users.noreply.github.com> Date: Tue, 30 Nov 2021 09:56:40 +0100 Subject: [PATCH 2/3] replace unnecessary actions with shell commands --- code-scanning/veracode.yml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/code-scanning/veracode.yml b/code-scanning/veracode.yml index 31fa989..64c732f 100644 --- a/code-scanning/veracode.yml +++ b/code-scanning/veracode.yml @@ -29,11 +29,7 @@ jobs: with: repository: '' - - uses: vimtor/action-zip@5f1c4aa587ea41db1110df6a99981dbe19cee310 - with: - files: / - recursive: true - dest: veracode-pipeline-scan-results-to-sarif.zip + - run: zip -r veracode-pipeline-scan-results-to-sarif.zip ./ - uses: actions/upload-artifact@v1 with: @@ -41,9 +37,7 @@ jobs: path: veracode-pipeline-scan-results-to-sarif.zip # download the Veracode Static Analysis Pipeline scan jar - - uses: wei/curl@012398a392d02480afa2720780031f8621d5f94c - with: - args: -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip + - run: curl --silent --show-error --fail -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip - run: unzip -o pipeline-scan-LATEST.zip - uses: actions/setup-java@v1 From 1c56988c5df7b85a0d1fbcbb4a2d6dcee44b7b51 Mon Sep 17 00:00:00 2001 From: anaarmas <54946499+anaarmas@users.noreply.github.com> Date: Tue, 7 Dec 2021 11:35:26 +0100 Subject: [PATCH 3/3] remove unnecessary uses of the upload-artifact action and improve input file name --- code-scanning/veracode.yml | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/code-scanning/veracode.yml b/code-scanning/veracode.yml index 64c732f..e38fffd 100644 --- a/code-scanning/veracode.yml +++ b/code-scanning/veracode.yml @@ -29,12 +29,7 @@ jobs: with: repository: '' - - run: zip -r veracode-pipeline-scan-results-to-sarif.zip ./ - - - uses: actions/upload-artifact@v1 - with: - name: my-artifact - path: veracode-pipeline-scan-results-to-sarif.zip + - run: zip -r veracode-scan-target.zip ./ # download the Veracode Static Analysis Pipeline scan jar - run: curl --silent --show-error --fail -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip @@ -43,12 +38,8 @@ jobs: - uses: actions/setup-java@v1 with: java-version: 1.8 - - run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-pipeline-scan-results-to-sarif.zip + - run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-scan-target.zip continue-on-error: true - - uses: actions/upload-artifact@v1 - with: - name: ScanResults - path: results.json - name: Convert pipeline scan output to SARIF format id: convert uses: veracode/veracode-pipeline-scan-results-to-sarif@ff08ae5b45d5384cb4679932f184c013d34da9be