Product Announcements — Tim J (Veracode PM) (Veracode) asked a question.
Hi Community members, @Tim J (Veracode PM) (Veracode) here with an update about Pipeline Scan and an opportunity to win some great Veracode swag!
We've been posting a lot about Pipeline Scan this year. We launched the Pipeline Scan tool in February to provide a DevOps friendly way to scan your entire application quickly in the pipeline and catch issues before they become security fire drills at release time.
Now we want to hear from you!
We’d love to see examples of how you use Pipeline Scan in your own pipeline! That’s why we’re giving away an exclusively designed pair of Veracode-branded socks as a prize for the first 50 participants who share a screenshot or code snippet that shows how Pipeline Scan is integrated into your CI pipeline! Share your examples and we’ll send you a pair of socks – it’s that simple! We’d like to use these examples to show other users in the community how to integrate, so you’ll be helping fellow developers in addition to getting a cool giveaway.
The fine print: You must conduct at least one pipeline scan and provide an illustration of your pipeline via a screenshot or code sample to be eligible. Please take care not to expose sensitive information such as API keys when sharing information. Void where prohibited by law. (etc.) Participants must be 18 years of age or older in the United States.
Helpful Resources
.png){kind=logo}
Hey everyone! I'm so excited about this contest.
Here is an example of what we are looking for in your comment. Although, before sharing anything, make sure you don't have any private information in the file.
To show us your YAML, simply share a screenshot, copy your code into the comment box, or attach the file itself. Other developers might actually benefit from seeing how you've done this in your environments.
Have fun!!
sample_YAML
//I love the pipeline-scan tool!
Two implementations here.
First, Integrated into a jenkins build job via execute shell build step from the build agent, after the build script executes. Also using the SCA agent scan.
- name: Download the Pipeline Scanner
run: curl -O -L https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
- name: Unzip the Pipeline Scanner
run: unzip -o pipeline-scan-LATEST.zip
- name: Run Pipeline Scanner
run: -Dpipeline.debug=true -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --file "sample.jar" --fail_on_severity="Very High, High"
continue-on-error: false
- uses: actions/upload-artifact@v1
with:
name: ScanResults
path: results.json
- name: Convert pipeline scan output to SARIF format
id: convert
uses: Veracode/veracode-pipeline-scan-results-to-sarif@master
with:
pipeline-results-json: results.json
finding-rule-level: "3:1:0"
- uses: github/codeql-action/upload-sarif@v1
with:
# Path to SARIF file relative to the root of the repository
sarif_file: veracode-results.sarif
Thanks @JH (Community Member) ! Love that you're using it in two environments!
Simple 😀
Thanks @JH (Community Member) for detailed steps. I am using GitHub as source code repository and Jenkins as CI tool. I have followed the above First method to run the pipeline scan for every pull request and using GitHub API to post the scan results as pull request comments.
The results in PR comments are not really in user friendly manner, now I would like to use GitHub actions.
Could you please suggest the best way to implement the pipeline scan using GitHub and Jenkins and post back the results in well defined format. Kindly note, we have limitations to avoid libs (jars) in GitHub. Alternatively we can use Artifactory.
Thanks for your reply @LI516386 (Community Member) . Any particular reason you are tied to Jenkins as a CI tool. Your source code is in GitHub, why not just use GH for ci as well?
I'm not familiar with an existing solution for packaging the results from a pipeline scan and sending them to GH, similar to what CodeQL is doing in GH. Perhaps the Veracode Community has found a solution i'm not aware of yet. It is definitely possible, if you wanted to create a custom workflow that parses the json output from the pipeline scan results and creates issues (I don't think creating code scanning alerts is possible without CodeQL) in the repo with gh cli.
However, another methodology rhetorical question might be; aren't we using the pipeline scan to break builds and prevent introducing flaws into source? So why the need to create issues from pipeline scan flaws ? Shouldn't the flaws be remediated by the dev in order to get a working ci build?
I have since updated our implementation of the pipeline scan to only fail the build for any NEW flaws (as compared to the baseline file), so maybe creating issues for the flaws that are in the baseline file might be relevant. The idea is that it will prevent devs from committing any NEW flaws to source. For the flaws that already exist, I currently use a GH action to promote a sandbox scan, it executes a py script that gets the latest scan results and creates issues in the repo.
Hi @JH (Community Member) , the plan is to break the build also. Unfortunately we are not using GitHub for CI, and dev team will not have access to Jenkins console.
As of now my initial plan is to post the results back to GitHub PR comments. Unfortunately the Pipeline scan results in PR comments are not user friendly for our dev team.
Looking for experts suggestions on the same.
We have implemented this in AzureDevOps and are very happy with how well it has integrated into our CICD pipelines
Thanks @TWilliams358532 (Community Member) ! Glad to see that this is working well for you!
Out of curiosity, this looks like you're doing a policy scan. Have you had an opportunity to try the Veracode Pipeline Scan tool in your environment?
We are using the Veracode tasks on our classic editor pipelines in Azure DevOps, and also taking advantage of the Import Flaws task to create bugs directly on our scrum board when vulnerabilities are found.