Skip to content

Releases: veracode/veracode-uploadandscan-action

Adding file path wildcards

11 Nov 08:19
ddca86b

Choose a tag to compare

Adding support for file path wildcard configuration, like /folder/*war

Rewrite action to TypeScript and remove Docker requirements

07 Nov 20:09
4e085f4

Choose a tag to compare

Summary
Rewrote the GitHub Action from a Docker-based implementation to a pure TypeScript/JavaScript implementation. This removes the Docker dependency and enables the action to run on all systems that support Node.js and Java.

Changes

Removed Docker dependency: The action no longer requires Docker, eliminating compatibility issues on runners without Docker (e.g., macOS runners)
TypeScript implementation: Rewrote the shell script logic in TypeScript for better maintainability and type safety
Same functionality: All existing functionality is preserved - downloads the Veracode Java API wrapper, builds the command with all parameters, and executes it securely
Secure execution: Uses Node.js spawn for secure command execution without shell interpretation
Benefits

Broader compatibility: Can now run on all GitHub-hosted runners (including macOS) and self-hosted runners with Node.js and Java installed
No Docker required: Eliminates the need for Docker installation and configuration
Faster execution: No Docker image build/pull overhead
Better maintainability: TypeScript provides better error checking and code organization
Backward Compatibility

All parameters remain unchanged - The action accepts the same inputs as before:
Required parameters: appname, createprofile, filepath, version, vid, vkey
All optional parameters work exactly as before
No changes needed to existing workflows using this action
Technical Details

Uses node20 runtime instead of Docker
Downloads Veracode Java API wrapper from Maven Central (same as before)
Executes Java commands using spawn for secure process execution
All validation logic and parameter conflict checks preserved
⚠️ Migration
Runner Requirements: The action now requires a runner with:

Node.js 20+ (automatically available on GitHub-hosted runners)
Java (required to execute the Veracode Java API wrapper)
For GitHub-hosted runners: No changes needed - all GitHub-hosted runners (ubuntu-latest, windows-latest, macos-latest) support Node.js and Java.

For self-hosted runners: Ensure your runner has Node.js 20+ and Java installed. If your current runner doesn't have these, you'll need to either:

Install Node.js and Java on your existing runner, or
Switch to a runner that supports Node.js and Java
Workflow changes: No changes needed to your workflow YAML files - all parameters and usage remain identical.

Note: The Dockerfile and entrypoint.sh files have been removed as they are no longer needed.

Update Dockerfile

04 Nov 12:27
1194f1d

Choose a tag to compare

Update Dockerfile base image and add curl to the image

Updates

24 Jun 22:27
9be5978

Choose a tag to compare

Use artifact action v4
adding policy parameter

Update for dependabot

07 Jun 15:30
f7e1fbf

Choose a tag to compare

Update for dependabot

Initial Release of a Veracode action to perform an Upload and Scan

26 Aug 14:26
f7e1fbf

Choose a tag to compare

Initial release of a Veracode action that performs an Upload and Scan using the Veracode Java API wrapper, this can be used to perform a Veracode Static Analysis, as a policy scan, sandbox scan and to scan for software composition analysis.

Added new option for includenewmodules

02 May 02:52
98e2a29

Choose a tag to compare

Added new option for includenewmodules

Minor release: adding "scanpollinginterval" parameter

17 Feb 08:20

Choose a tag to compare

adding "scanpollinginterval" parameter
Interval, in seconds, to poll for the status of a running scan. Value range is 30 to 120 (two minutes). Default is 120.

Minor release: typo fix

30 Jun 14:41
35794da

Choose a tag to compare

What's Changed

Full Changelog: 0.2.3...0.2.4

Minor release: add debug function

22 Jun 14:36
4cd3f8b

Choose a tag to compare

This release adds two optional parameters that allow pinning the version of the Veracode Java API Wrapper used by the action, and setting the debug parameter to generate additional troubleshooting output from the action.

What's Changed

Full Changelog: 0.2.2...0.2.3