|
| 1 | +# This workflow uses actions that are not certified by GitHub. |
| 2 | +# They are provided by a third-party and are governed by |
| 3 | +# separate terms of service, privacy policy, and support |
| 4 | +# documentation. |
| 5 | + |
| 6 | +# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert |
| 7 | + |
| 8 | +name: Veracode Static Analysis Pipeline Scan |
| 9 | + |
| 10 | +on: |
| 11 | + workflow_dispatch: |
| 12 | + inputs: |
| 13 | + configuration: |
| 14 | + description: 'Build project configuration (options:Release|Debug)' |
| 15 | + default: 'Release' |
| 16 | + options: |
| 17 | + - Release |
| 18 | + - Debug |
| 19 | + push: |
| 20 | + branches: [ main ] |
| 21 | + #schedule: |
| 22 | + # - cron: '44 4 * * 5' |
| 23 | + |
| 24 | +# A workflow run is made up of one or more jobs that can run sequentially or in parallel |
| 25 | +permissions: |
| 26 | + contents: read |
| 27 | + |
| 28 | +jobs: |
| 29 | + # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter |
| 30 | + build-and-pipeline-scan: |
| 31 | + env: |
| 32 | + ZipFilename: netClassesForScan.zip |
| 33 | + |
| 34 | + # The type of runner that the job will run on |
| 35 | + permissions: |
| 36 | + contents: read # for actions/checkout to fetch code |
| 37 | + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results |
| 38 | + |
| 39 | + runs-on: windows-latest |
| 40 | + |
| 41 | + steps: |
| 42 | + |
| 43 | + - name: Checkout repository |
| 44 | + uses: actions/checkout@v2 |
| 45 | + with: |
| 46 | + repository: '' |
| 47 | + |
| 48 | + - name: Set build configuration from dispatch |
| 49 | + if: ${{ github.event.inputs.configuration != '' }} |
| 50 | + run: | |
| 51 | + $configuration = '${{github.event.inputs.configuration}}' |
| 52 | + echo "BuildConfiguration=$configuration" >> $env:GITHUB_ENV |
| 53 | + - name: Set default build configuration |
| 54 | + if: ${{ github.event.inputs.configuration == '' }} |
| 55 | + run: echo "BuildConfiguration=Release" >> $env:GITHUB_ENV |
| 56 | + |
| 57 | + - uses: actions/setup-dotnet@v1 |
| 58 | + with: |
| 59 | + source-url: https://nuget.pkg.github.com/genexuslabs/index.json |
| 60 | + env: |
| 61 | + NUGET_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}} |
| 62 | + |
| 63 | + - name: Build |
| 64 | + run: | |
| 65 | + $veracodesolution = "VeracodeSolution" |
| 66 | + dotnet new sln --name $veracodesolution --output dotnet --force |
| 67 | + dotnet msbuild dotnet\DotNetStandardClasses.sln /t:DumpProjects -p:DumpSolutionName=$veracodesolution /m:1 |
| 68 | + dotnet msbuild dotnet\Directory.Build.targets /t:PublishForAnalyzer -p:DumpSolutionName=$veracodesolution |
| 69 | +
|
| 70 | + - name: Create package for Veracode scan |
| 71 | + shell: powershell |
| 72 | + run: Compress-Archive .out\*.* $env:ZipFilename |
| 73 | + |
| 74 | + - name: Download Veracode Static Analysis Pipeline scan jar |
| 75 | + shell: powershell |
| 76 | + run: | |
| 77 | + Invoke-WebRequest -Uri "https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip" -OutFile "pipeline-scan.zip" |
| 78 | + Expand-Archive "pipeline-scan.zip" -DestinationPath ".veracode" -Force |
| 79 | +
|
| 80 | + - name: Upload package for scan |
| 81 | + uses: actions/setup-java@v1 |
| 82 | + with: |
| 83 | + java-version: 1.8 |
| 84 | + - name: Execute scan |
| 85 | + run: java -jar ".veracode\pipeline-scan.jar" --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file $env:ZipFilename |
| 86 | + continue-on-error: true |
| 87 | + - name: Convert pipeline scan output to SARIF format |
| 88 | + id: convert |
| 89 | + uses: veracode/veracode-pipeline-scan-results-to-sarif@ff08ae5b45d5384cb4679932f184c013d34da9be |
| 90 | + with: |
| 91 | + pipeline-results-json: results.json |
| 92 | + source-base-path-1: "^.*/${{ github.event.repository.name }}/dotnet/:dotnet/" |
| 93 | + #source-base-path-1: "^.*/${{ github.event.repository.name }}/dotnet/:blob/main/dotnet/" |
| 94 | + |
| 95 | + - uses: github/codeql-action/upload-sarif@v1 |
| 96 | + with: |
| 97 | + # Path to SARIF file relative to the root of the repository |
| 98 | + sarif_file: veracode-results.sarif |
| 99 | + |
| 100 | + - uses: actions/upload-artifact@v3 |
| 101 | + with: |
| 102 | + name: veracode_json_and_sarif_results |
| 103 | + path: | |
| 104 | + results.json |
| 105 | + veracode-results.sarif |
| 106 | + retention-days: 15 |
0 commit comments