MClarkson676368 (Community Member) asked a question.
Agent SCA Pull Requests in GitLab
Can anyone share a working gitlab-ci.yml file that is successfully creating PR's for vulnerable components?
So far I've not being successful receiving everything from Detached HEAD to Error pushing new branch to remote. (Return code: 128) messages.
I followed the instructions on help.veracode.com and all looks to be in order.
I assume I'm missing some git magic sauce, any hints, tips would be greatly appreciated.
.png){kind=logo}
Using a Project Access Token in CI/CD variables still fails 😢
2021-05-14/10:25:06.178 com.sourceclear.engine.pullrequests.git.RepositoryModifier DEBUG pushing to upstream branch: sourceclear-fix-20210514-102504.994
2021-05-14/10:25:06.178 com.sourceclear.engine.pullrequests.git.RepositoryModifier DEBUG launching git process with command: git push -u https://********************@gitlab-demo.devops.XXXX.com/demo/dockerized-example-java-maven sourceclear-fix-20210514-102504.994
2021-05-14/10:25:06.629 com.sourceclear.engine.pullrequests.git.RepositoryModifier DEBUG return code: 128
2021-05-14/10:25:06.629 com.sourceclear.engine.pullrequests.git.RepositoryModifier DEBUG output: [fatal: could not read Username for 'https://gitlab-demo.devops.XXXX.com': No such device or address]
I did get it working successfully using SSH: Public Key as project deploy key, Private key in script.
The crucial piece though was supplying the GIT_SSH_COMMAND with alternate port number:
export GIT_SSH_COMMAND="ssh -o Port=2222"
Simply adding the port when setting the git remote failed with the srcclr agent trying to push to an incorrect project name of 2222/$CI_PROJECT_PATH.git i.e.
git remote set-url origin "git@gitlab-demo.devops.XXXX.com:2222/$CI_PROJECT_PATH.git"
Does anyone now how I can prevent the Agent SCA push from triggering the CI pipeline again?
before_script:
- 'which ssh-agent || ( apt-get update -y && apt-get install openssh-client -y )'
- eval $(ssh-agent -s)
- echo "$SCA_PRIV" | tr -d '\r' | ssh-add -
- git config --global user.email "AppSecBot@noreply.com"
- git config --global user.name "Sir Fix-a-Bot"
- mkdir -p ~/.ssh
script:
- |
if [[ $CI_BUILD_REF_NAME = dev ]]; then
[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config
export GIT_TRACE=1
git checkout -b $CI_BUILD_REF_NAME
git remote set-url origin "git@gitlab-demo.devops.XXXX.com:$CI_PROJECT_PATH.git"
export GIT_SSH_COMMAND="ssh -oPort=2222"
export SRCCLR_PR_ON=low
export SRCCLR_NO_BREAKING_UPDATES=true
export SRCCLR_IGNORE_CLOSED_PRS=true
export SRCCLR_SCM_TYPE=GITLAB
export EXTRA_ARGS='--update-advisor --pull-request'
export DEBUG=1
fi
- VERBOSE=true curl -sSL https://download.sourceclear.com/ci.sh | sh -s -- scan $EXTRA_ARGS
I am facing the same error in enterprise GitHub .. Any help is appreciated
Hi @vsankar821763 (Community Member) ,
I'm afraid I haven't tried with GitHub as we use GitLab for our development, but I would double check that you have an access token set that has repo permissions, see - Creating a personal access token - GitHub Docs
I've just come across this, that may be of some use to you: GitHub - Lerer/veracode-sca: Veracode Software Composition Analysis Scaning
Hope that helps.
thanks @MClarkson676368 (Community Member) for the update . I believe the access token that i have has right permission , i even tried with all permissions enabled same result . Regarding the github actions link you share that was helpful but they are creating github issue not PR . And i am trying to do this in Jenkins
Hi @vsankar821763 (Community Member) ,
For PR/MR with Gitlan I need to use SSH by creating a key pair and then having the public key as a gitlab project deplolyment key and the private key as a CI/CD variable that I used within the CI job script. See my second post above.
i assume you've followed the instructions here and set the correct scm vars: https://help.veracode.com/r/t_configure_pr_github
Hi @MClarkson676368 (Community Member) ,
I will try the SSH approach you quoted . yes i have mentioned proper SCM and i believe the SCM info are picked, if i give something wrong , it is giving an error . I am using GitHub Enterprise ... I do have a separate thread created for this ....
https://community.veracode.com/s/question/0D53n00008Br2qaCAB/agent-based-scan-in-jenkins-using-powershell-sca-scan-is-getting-successfull-and-data-is-getting-posted-to-veracode-but-pr-is-not-getting-generated