Hello @EGertis462759 (Community Member)​ ,

For what it sounds like you are trying to accomplish, I would look into the scantimeout parameter, which can be found in this Help Center article Using Composite Actions in the API Wrappers. Another suggestion is looking at our Docker images (CI/CD With Veracode Docker Images) to see if anything fits with what you are trying to do. Hopefully this information helps you out.

Jason

Veracode Support Engineer

Hi @[EGertis462759]​ ,

You have indeed run into this situation and I have developed a solution to check for that before submitting a scan. You can actually check to see what progress the build is in before you submit one. I have a way to check if it is a policy scan or a sandbox scan as well.

For example:

If you want to submit a policy scan, you will need to check the latest scan of policy to see what state it is in first.

Using the wrapper like you are using you can do this by doing the following steps:

sh "java -jar /VeracodeJavaAPI.jar -action getbuildinfo -appid ${appId} -vid ${VERACODE_USR} -vkey ${VERACODE_PSW}

The XML that is returned has the information you need to make a decision: here is an example and I starred out sensitive information

The true status of the latest policy scan will be found under <analysis_unit> section and the property is "status". This will indicate at what stage the scan is in like "Incomplete", "Submitted", etc

Also you can use the property "results_ready" and if it is true then you are good to submit scan, but if it is false then it is not.

-<buildinfo build_id="*&*^*&*" app_id="&^&%&&" account_id="42791" buildinfo_version="1.5" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/4.0/buildinfo https://analysiscenter.veracode.com/resource/4.0/buildinfo.xsd" xmlns="https://analysiscenter.veracode.com/schema/4.0/buildinfo" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

-<build build_id="11490823" legacy_scan_engine="false" scan_overdue="false" grace_period_expired="false" rules_status="Did Not Pass" policy_updated_date="2021-04-02T15:05:47-04:00" policy_compliance_status="Conditional Pass" policy_version="8" policy_name="YourPolicyName" results_ready="true" lifecycle_stage="Internal or Alpha Testing" platform="Not Specified" submitter="********" version="*************">

<analysis_unit engine_version="20210318134539" status="Results Ready" published_date_sec="1617390292" published_date="2021-04-02T15:04:52-04:00" analysis_type="Static"/>

</build>

</buildinfo>

For sandboxes:

If you want to check the same before scanning in a sandbox, you will need to do the following:

//Call this method to get a list of sandboxes to retrieve the sandbox_id

sh "java -jar /VeracodeJavaAPI.jar -action getsandboxlist -appid ${appId} -vid ${VERACODE_USR} -vkey ${VERACODE_PSW}

//Call this to get a list of builds in the specific sandbox_id and loop through to grab the very latest one and save the buildID in a variable to use

sh "java -jar /VeracodeJavaAPI.jar -action getbuildlist -appid ${appId} -sandBoxID ${sandBoxID} -vid ${VERACODE_USR} -vkey ${VERACODE_PSW}

//call this method much like above to grab information for the sandbox build and use the status mentioned above to evaluate before submitting a scan.

sh "java -jar /VeracodeJavaAPI.jar -action getbuildinfo -appid ${appId} -buildID ${buildID} -vid ${VERACODE_USR} -vkey ${VERACODE_PSW}

This should get you everything that you are trying to do. Please do not hesitate to ask additional questions regarding this or anything else as I am happy to help.

Thanks,

Jason

Lead Cyber Security Engineer