Victor (Community Member) asked a question.
Hello friends
I wonder if you guys use Veracode with GitHooks?
more specifically the Precommit hook.
Have you already used this approach? if yes, how was the experience?
Below is the way I'm doing it is very simple, Returns 0 or 1 according to the PipelineScan response.
#!/bin/sh
# Check if this is the initial commit
if git rev-parse --verify HEAD >/dev/null 2>&1
then
against=HEAD
else
# Initial commit: diff against an empty tree object
against=$(git hash-object -t tree /dev/null)
fi
zip -r upload.zip .
curl -sSO https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
unzip pipeline-scan-LATEST.zip
java -jar pipeline-scan.jar --file upload.zip --issue_details true --policy_name="Veracode Recommended Low"
retVal=$?
if [ $retVal -ne 0 ]; then
rm upload.zip
rm pipeline-scan-LATEST.zip
rm pipeline-scan.jar
exit 1
fi
rm upload.zip
rm pipeline-scan-LATEST.zip
rm pipeline-scan.jar
exit $retVal
.png){kind=logo}
That would be a great feature but VeraCode is a bit slow for this right now.
A good approach would be to implement Repeatable Builds on the development side. VC could then use a delta approach (just check which code has changed compared to the last check) which should be much faster.