Veracode Base Camp — Shuning, Veracode Community Manager (Veracode) asked a question.
Example: Implementing Veracode Static Analysis in a Large Azure Project
Hi everyone! If you’re implementing the Veracode Static Analysis in an Azure environment, this blog post from the Microsoft team may help you get started. Stephanie @SVisser067951 (Community Member), a software engineer at Microsoft leading this integration project, documented their process of implementing Veracode SAST into a large Azure DevOps pipeline for their customer. In her blog post, you will find:
- The scenario: a large Azure DevOps pipeline for an extensive mono-repository that spanned teams, projects, and languages and that needs to be integrated with Veracode.
- The four developer user stories identified for the different Static Scan types (IDE Scan, Pipeline Scan, Policy Scan, Sandbox Scan).
- How each scan type is used to address the four developer user stories.
- The main challenges and how those are resolved.
In this GitHub repo, you’ll also find the accompanying Azure DevOps pipeline YAML files that you can reference to get started with your own pipelines!
Questions, feedback for Stephanie? Post them in the comment section below 🙂👇
.png){kind=logo}
Hi @Shuning, Veracode Community Manager (Veracode) ,
Veracode Pipeline Scan yml file doesn't explain about Baseline file which is useful for referring the existing scan results in case if you have any mitigations or constraint for remediation in existing legacy flaws. So that Pipeline Scan evaluates only new flaws that do not exist in the baseline file.
Hope that helps to improve the content.
Thank you for the feedback @HemantShah (Community Member) 🙂 I will loop in @SVisser067951 (Community Member) who kindly shared the YAML files and get her thoughts on this.
Hi @SVisser067951 (Community Member), thanks again for sharing your Azure DevOps pipeline YAML files! Curious - how does your team make sure the pipeline Scan only evaluates new flaws that do not exist in the baseline file?
Are there example BaseLine files?
There is a document showing how baseline files can be used here which might help. Basically a baseline file is just a cut-down version of a Pipeline Scan results JSON file containing the findings you want to ignore.
Thanks @HemantShah (Community Member) and @Shuning, Veracode Community Manager (Veracode) ! We didn't use baseline files yet - we were working with an existing code base and are currently using Veracode to get out all already-introduced flaws. We are currently looking to introduce it later, and then I will update the github. Thank you!
@SVisser067951 (Community Member) , thanks for the update