JHyun398998 (Community Member) asked a question.

October 14, 2020 at 3:00 AM
Does the Agent based SCA (Software Composition Analysis) scan support having multiple projects within a single repository?

I have a single git repo with multiple, separate, Maven (Java) projects. However, I noticed the Agent SCA workspace's notion of a project appears to be an entire repo. If I scan one Maven project in the repo, say project A, and then scan Maven project B, will they be considered different SCA scan projects? Or will Maven project B's scan results overwrite project A's scan results? Or will it merge the results? E.g. If project A has flaw ABC and project B has flaw XYZ, will I see both ABC and XYZ flaws or just XYZ since it thinks flaw ABC is no longer present? The Maven projects are built and scanned in separate build jobs so they will have different build times, git tags, etc.

  • 4 answers
  • 924 views

  • Jason M., Veracode Support (Veracode)

    Morning @JHyun398998 (Community Member)​ ,

     

    If you are going into the root of each of the sub folders within the project and scanning them individually, it should show them up as different projects within the UI. It'd show it as ProjectName/Foldername.

     

    If all the scans are done in the root folder and only the build commands are changing to specify which project, then yes, the results would be overridden within the same project within the UI.

     

    Jason

    Community Support Engineer

    Expand Post
    Selected as Best

  • Jason M., Veracode Support (Veracode)

    Hello @JHyun398998 (Community Member)​ ,

     

    If the pom.xml files aren't connected you will have to CD into each root folder of the individual sub project and scan them (or use recursive but especially with large Java projects that's not recommended because it is way more likely to cause Out of Memory issues).

     

    Also, if the projects are connected by a single pom.xml the agent will automagically scan them all (like they are sub projects of a parent). 

     

    If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well. Thanks!

     

    Jason

    Community Support Engineer

    Expand Post

    • JHyun398998 (Community Member)

      Hi, sorry, this doesn't answer the question. My Maven projects are separate / disjoint / independent from one another, but in the same git repo. They are not part of a single multi-module build. I know how to scan each of the projects individually. This is not the problem. The problem is how the results of the scan get rolled up into the Veracode user interface.

       

      It appears that each project scan is identified by its git repository URI. However, if multiple Maven projects exist in the same repo they will have the same URI and may be considered the same Agent SCA project. If this is the case the results of different project scans may overwrite one another. The scans of other modules will get lost and the only results showing will be the most recently scanned module.

      Expand Post

      • Jason M., Veracode Support (Veracode)

        Morning @JHyun398998 (Community Member)​ ,

         

        If you are going into the root of each of the sub folders within the project and scanning them individually, it should show them up as different projects within the UI. It'd show it as ProjectName/Foldername.

         

        If all the scans are done in the root folder and only the build commands are changing to specify which project, then yes, the results would be overridden within the same project within the UI.

         

        Jason

        Community Support Engineer

        Expand Post
        Selected as Best

      • JHyun398998 (Community Member)

        Ok, great! This is the answer I am looking for.

Topics (2)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.