1
Fork 0
mirror of https://gitea.com/actions/upload-artifact.git synced 2024-11-10 02:35:58 +01:00

Create veracode-analysis.yml

This commit is contained in:
Juri Burakov 2021-10-05 18:52:29 +03:00 committed by GitHub
parent 0262880861
commit ed87561059
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

61
.github/workflows/veracode-analysis.yml vendored Normal file
View file

@ -0,0 +1,61 @@
# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert
name: Veracode Static Analysis Pipeline Scan
on:
push:
branches: [ main, upload-artifact ]
pull_request:
# The branches below must be a subset of the branches above
branches: [ main ]
schedule:
- cron: '15 12 * * 3'
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
# This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter
build-and-pipeline-scan:
# The type of runner that the job will run on
runs-on: ubuntu-latest
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps
- uses: actions/checkout@v2
with:
repository: ''
- uses: papeloto/action-zip@v1
with:
files: /
recursive: true
dest: veracode-pipeline-scan-results-to-sarif.zip
- uses: actions/upload-artifact@v1
with:
name: my-artifact
path: veracode-pipeline-scan-results-to-sarif.zip
# download the Veracode Static Analysis Pipeline scan jar
- uses: wei/curl@master
with:
args: -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
- run: unzip -o pipeline-scan-LATEST.zip
- uses: actions/setup-java@v1
with:
java-version: 1.8
- run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-pipeline-scan-results-to-sarif.zip
continue-on-error: true
- uses: actions/upload-artifact@v1
with:
name: ScanResults
path: results.json
- name: Convert pipeline scan output to SARIF format
id: convert
uses: veracode/veracode-pipeline-scan-results-to-sarif@master
with:
pipeline-results-json: results.json
- uses: github/codeql-action/upload-sarif@v1
with:
# Path to SARIF file relative to the root of the repository
sarif_file: veracode-results.sarif