KK595849 (Community Member) asked a question.
Error in VSTS when uploading the code
I am using VSTS with veracode extention. When I try to upload the code as part of my pipeline. I get a message
* App not in state where new builds are allowed.
2018-09-26T18:15:47.7768097Z Build ID:2871527End Obtaining Build Info
2018-09-26T18:15:47.7915876Z ##errorBuild Failed : Exit From Scan Inspection Process , Cannot Find New Scan Build ID
2018-09-26T18:15:47.7924863Z (node:3444) UnhandledPromiseRejectionWarning: Unhandled promise rejection (rejection id: 1): Error: Exiting from Veracode Scan Task
Any ideas?
.png){kind=logo}
Hi @KK595849 (Community Member) - this error comes back from the APIs when you submit a scan request when there's a scan already running for the application (or sandbox), or one that failed for some reason.
There are some recommendations on how to deal with this in the troubleshooting guide:
https://help.veracode.com/r/c_troubleshooting
Same issue here but the link is broken.
We're having to manually delete requests that end up in an "Incomplete" state for some reason. This is unacceptable.
How can we automate our pipelines so that we don't have to constantly be taking manual intervention steps to get scans to start?
Hi @WBradney035779 (Community Member) - I wanted to let you know that we have been researching and developing a plan to help with scans that appear to be "stuck" or in an incomplete state. It turns out there are a number of scenarios that may cause a scan to appear stuck so we need to be careful to not delete any scans that are just taking longer than expected. We are in the process of grooming the stories now so help is definitely on the roadmap!
@Gail (Veracode PM) (Veracode, Inc.)
Below is an example from our logs. This appears to be a simple failure to communicate with the server that left the Azure Devops pipeline in a failed state, but the Veracode scan in an "incomplete" state. Further attempts to scan this application by the Azure Devops pipeline always receive the "App not in state where new builds are allowed" error, and someone has to sign in to Veracode to delete the request. It would be better to have an option for the Veracode scan to fail after a certain configurable time period if the server doesn't see any further activity on the job.
A similar issue exists whereby the scan is "Waiting for module selection" if there's some doubt over the scannable modules, requiring a human to sign in simply click "Start Scan". I would propose an option to eg "Always continue scan if there are module issues", or "Fail the scan if there are module issues", rather than require human intervention.
2021-02-06T16:25:37.3344340Z Start Obtaining Build Info
2021-02-06T16:25:37.3406419Z [command]"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -jar D:\agent\_work\_tasks\Veracode_6292a058-d4f5-407b-b6c6-815df9ee59d6\2.9.0\VeracodeJavaAPI.jar -action getbuildinfo -appid 1071078 -vid *** -vkey *** -useragent "VeracodeVSTSExtension/2.9.0 (Node/v6.17.1)"
2021-02-06T16:25:39.3208024Z <?xml version="1.0" encoding="UTF-8" standalone="no"?>
2021-02-06T16:25:39.3209380Z <buildinfo xmlns="https://analysiscenter.veracode.com/schema/4.0/buildinfo" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" account_id="50291" app_id="1071078" build_id="10685183" buildinfo_version="1.5" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/4.0/buildinfo https://analysiscenter.veracode.com/resource/4.0/buildinfo.xsd">
2021-02-06T16:25:39.3211572Z <build build_id="10685183" grace_period_expired="false" legacy_scan_engine="false" lifecycle_stage="Not Specified" platform="Not Specified" policy_compliance_status="Not Assessed" policy_name="TXM OWASP Policy" policy_version="11" results_ready="false" rules_status="Not Assessed" scan_overdue="false" submitter="Wayne Bradney" version="Release-2 Triggered by docUtilitiesApi 20201208.1.">
2021-02-06T16:25:39.3212828Z <analysis_unit analysis_type="Static" status="Incomplete"/>
2021-02-06T16:25:39.3213146Z </build>
2021-02-06T16:25:39.3213359Z </buildinfo>
2021-02-06T16:25:39.3213507Z
2021-02-06T16:25:39.3213758Z Build ID:10685183End Obtaining Build Info
2021-02-06T16:25:39.3219480Z Start Obtaining Scan
2021-02-06T16:26:39.3408201Z Scan Status as At : 10:26:39 AM
2021-02-06T16:26:39.3417558Z [command]"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -jar D:\agent\_work\_tasks\Veracode_6292a058-d4f5-407b-b6c6-815df9ee59d6\2.9.0\VeracodeJavaAPI.jar -action getbuildinfo -appid 1071078 -buildid 10685183 -vid *** -vkey *** -useragent "VeracodeVSTSExtension/2.9.0 (Node/v6.17.1)"
2021-02-06T16:26:41.4827123Z <?xml version="1.0" encoding="UTF-8" standalone="no"?>
2021-02-06T16:26:41.4828668Z <buildinfo xmlns="https://analysiscenter.veracode.com/schema/4.0/buildinfo" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" account_id="50291" app_id="1071078" build_id="10685183" buildinfo_version="1.5" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/4.0/buildinfo https://analysiscenter.veracode.com/resource/4.0/buildinfo.xsd">
2021-02-06T16:26:41.4830765Z <build build_id="10685183" grace_period_expired="false" legacy_scan_engine="false" lifecycle_stage="Not Specified" platform="Not Specified" policy_compliance_status="Not Assessed" policy_name="TXM OWASP Policy" policy_version="11" results_ready="false" rules_status="Not Assessed" scan_overdue="false" submitter="Wayne Bradney" version="Release-2 Triggered by docUtilitiesApi 20201208.1.">
2021-02-06T16:26:41.4832002Z <analysis_unit analysis_type="Static" status="Incomplete"/>
2021-02-06T16:26:41.4832339Z </build>
2021-02-06T16:26:41.4832531Z </buildinfo>
2021-02-06T16:26:41.4832679Z
2021-02-06T16:26:41.4873065Z ##errorBuild Failed : Scan Failed
2021-02-06T16:26:41.4887497Z Error Occurred While Obtaining Build Information
2021-02-06T16:26:41.4888129Z Veracode Upload and Scan task End
2021-02-06T16:26:41.4981086Z ##sectionFinishing: Upload and scan: D:\agent\_work\r11\a/UtilitiesApi