ig596 (Community Member) asked a question.
Best Practices or Example for Pipeline Scans using Bitbucket Cloud Pipelines?
Hello, we are testing some CI/CD efforts using Bitbucket pipelines. Is there an integration for pipeline scans on bitbucket pipelines or an example configuration, as it is not listed on the site? Does anyone have any recommendations to avoid wasting the build minutes pulling the zip and unpacking the API wrapper every time?
.png){kind=logo}
Hello @ig596 (Community Member) ,
To avoid time pulling the zip and unpacking the API wrapper every time, you can use the Docker image or cache the API wrapper in a local artifact repo. There are also two sites that you can look over for additional information listed below:
If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.
Jason
Veracode Support Engineer
Hello @Jason M., Veracode Support (Veracode) . Thanks for the links. I had not seen the YAML one before, but both seem to be focused on SCA and Traditional Static Scans rather than Pipeline Scans. Are the guidance/steps the same?
Hi @ig596 (Community Member) , the principles are the same but the syntax in the YAML will be slightly different. But in both traditional static scans and Pipeline you are packaging the application and uploading it for scan, just using a different command line tool.
@Tim J (Veracode PM) (Veracode) Sorry it looks like I didn't reply properly or link you last time. Do you have any advice around working with Bitbucket Reporting on Pull Requests? What we are able to do with some of our other test suites/tools have the relevant results show up as details in the pull request. It looks like you support some more integrations with GitLab but any advice for GitHub or bitbucket to do similar. Here is the relevant functionality in bitbucket I believe that is leveraged by many other tools like SonarCloud and WhiteHat. https://support.atlassian.com/bitbucket-cloud/docs/code-insights/ This could apply to either type of scan results but was primarily looking to include the summary details and net changes as part of the merge request checks/reports.
Do you have any advice around working with Bitbucket Reporting on Pull Requests? what we are able to do with some of our other test suites/tools have the relevant results show up as details in the pull request. It looks like you support some more integrations with GitLab but any advice for GitHub or bitbucket to do similar. Here is the relevant functionality in bitbucket I believe that is leveraged by many other tools like SonarCloud and WhiteHat. https://support.atlassian.com/bitbucket-cloud/docs/code-insights/ This could apply to either type of scan results but was primarily looking to include the summary details and net changes as part of the merge request checks/reports.
@ig596 (Community Member) , apologies for not seeing the request before. We don't have an integration specifically with Bitbucket for a pull request workflow, but there is a community example for sending the output of Pipeline Scan to a GitHub pull request here: https://github.com/Lerer/veracode-pipeline-PR-comment
Hope this helps.