WBradney035779 (Community Member) asked a question.
My static scan task from my Azure Devops pipeline uploads successfully, enters "Pre-scan Submitted" state, stays that way for 1-2 hours, then fails with a timeout:
2021-11-17T17:12:47.1660278Z [2021.11.17 09:49:51.901] Creating a new analysis with name "Release-21 Triggered by docEcIndexer 20211117.2.".
2021-11-17T17:12:47.1660995Z [2021.11.17 09:49:58.379]
2021-11-17T17:12:47.1661559Z [2021.11.17 09:49:58.379] The analysis id of the new analysis is "15219634".
2021-11-17T17:12:47.1663144Z [2021.11.17 09:49:58.379]
2021-11-17T17:12:47.1664257Z [2021.11.17 09:49:58.379] Uploading: D:\agent\_work\r1\a\EcIndexer\drop.zip\drop.zip
2021-11-17T17:12:47.1665314Z [2021.11.17 09:51:21.921]
2021-11-17T17:12:47.1666348Z [2021.11.17 09:51:21.921] Starting pre-scan verification for application "CDC EC Indexer" analysis "Release-21 Triggered by docEcIndexer 20211117.2.".
2021-11-17T17:12:47.1667420Z [2021.11.17 09:51:28.207]
2021-11-17T17:12:47.1670139Z [2021.11.17 09:51:28.207] Scan polling interval is set to the default of 120 seconds.
2021-11-17T17:12:47.1670846Z [2021.11.17 09:51:28.207]
2021-11-17T17:12:47.1672146Z [2021.11.17 09:51:28.207] Application "CDC EC Indexer" analysis "Release-21 Triggered by docEcIndexer 20211117.2." will be automatically submitted for scanning if the pre-scan verification is successful.
2021-11-17T17:12:47.1673073Z [2021.11.17 09:51:29.011]
2021-11-17T17:12:47.1673612Z [2021.11.17 09:51:29.011] The status of the new analysis is "Pre-Scan Submitted".
2021-11-17T17:12:47.1674316Z [2021.11.17 09:51:29.011] Requesting analysis info again in 120 seconds.
2021-11-17T17:12:47.1674854Z [2021.11.17 09:53:32.703]
2021-11-17T17:12:47.1676858Z [2021.11.17 09:53:32.703] The status of the new analysis is "Pre-Scan Submitted".
2021-11-17T17:12:47.1677556Z [2021.11.17 09:53:32.703] Requesting analysis info again in 120 seconds.
2021-11-17T17:12:47.1678077Z [2021.11.17 09:55:35.156]
...
2021-11-17T17:13:03.4699376Z ##errorBuild Failed : Build failed because Veracode did not return results within the scan timeout period.
2021-11-17T17:13:03.4784413Z (node:16728) UnhandledPromiseRejectionWarning: Unhandled promise rejection (rejection id: 1): Error: Exiting from Veracode Scan Task
Meanwhile, the scan on the server appears to complete just fine (from the Activity Log):
Scan PublishSystem
Static Scan results published for scan "Release-21 Triggered by docEcIndexer 20211117.2."
17 Nov 2021 @ 12:27 pm ESTScan startedSystem
Static Scan started for scan "Release-21 Triggered by docEcIndexer 20211117.2."
17 Nov 2021 @ 12:15 pm ESTPrescan completeSystem
Static prescan verification complete for "CDC EC Indexer Release-21 Triggered by docEcIndexer 202...
17 Nov 2021 @ 12:15 pm ESTScan SubmittedWayne Bradney
Scan "Release-21 Triggered by docEcIndexer 20211117.2." submitted for Static Scan
17 Nov 2021 @ 12:15 pm ESTPrescan startedSystem
Static prescan verification started for "CDC EC Indexer Release-21 Triggered by docEcIndexer 2021...
Static prescan verification started for "CDC EC Indexer Release-21 Triggered by docEcIndexer 20211117.2."
17 Nov 2021 @ 10:59 am ESTScan Upload completeWayne Bradney
File upload complete for scan "Release-21 Triggered by docEcIndexer 20211117.2."
17 Nov 2021 @ 10:51 am ESTScan File uploadedWayne Bradney
Uploaded file "drop.zip"
17 Nov 2021 @ 10:51 am EST
My task is configured like this:
steps:
- task: Veracode.veracode-vsts-build-extension.veracode-scanner-task.Veracode@3
displayName: 'Upload and scan: $(System.ArtifactsDirectory)/$(Release.TriggeringArtifact.Alias)'
inputs:
AnalysisService: 'CDC Veracode'
veracodeAppProfile: '$(Release.DefinitionName)'
version: '$(Release.ReleaseName) $(Release.ReleaseDescription)'
filepath: '$(System.ArtifactsDirectory)/$(Release.TriggeringArtifact.Alias)/drop.zip'
optargs: '-deleteincompletescan true'
createProfile: true
failBuildIfUploadAndScanBuildStepFails: true
importResults: true
failBuildOnPolicyFail: true
So I assume the pertinent timeout parameters assume the defaults:
maximumWaitTime: 360
timeoutInMinutes: 0
Which would imply either 6 hours or infinite. I'm not sure which one takes precedence but both are greater than 1-2 hours.
What's going on here?
.png){kind=logo}
Hello @WBradney035779 (Community Member) ,
Thank you for reaching out to the Community.
Please try to run a Pre-scan Verification (A manual scan thru the platform) with Auto Sac set to off. This will rule out the Azure Ext. https://docs.veracode.com/r/Understanding_Prescan_Verification
docs.veracode.com
Understanding Prescan Verification
Veracode performs a prescan verification after uploading your application for static analysis. The prescan verification performs an initial analysis of the application to verify you have packaged the application correctly.
If this is an Azure Ext issue, I would recommend opening a ticket with our Integration team. Including all logs and zip files.
Best regards,
Steven
Veracode Support Engineer
The scan completes successfully in Veracode (obviously including the pre-scan part).
@WBradney035779 (Community Member) ,
It appear that you have "Import Results upon Scan Completion" turned ON. In that state Pipeline is going to wait until the Scan gets over to import the results. In this secnario your pipeline timeout reach and fails the pipeline execution.
Yes, I'm aware of that. We want the pipeline to wait for the results to be available and fail the step if the scan does not pass. The scan in Veracode completes but the pipeline task is timing out so on the Azure side it looks like it failed when in fact it succeeded. Here's the YAML - how do we prevent it from timing out while waiting for the scan to complete?
steps:
- task: Veracode.veracode-vsts-build-extension.veracode-scanner-task.Veracode@3
displayName: 'Upload and scan: $(System.ArtifactsDirectory)/$(Release.TriggeringArtifact.Alias)'
inputs:
AnalysisService: 'CDC Veracode'
veracodeAppProfile: '$(Release.DefinitionName)'
version: '$(Release.ReleaseName) $(Release.ReleaseDescription)'
filepath: '$(System.ArtifactsDirectory)/$(Release.TriggeringArtifact.Alias)/drop'
optargs: '-deleteincompletescan true'
createProfile: true
failBuildIfUploadAndScanBuildStepFails: true
importResults: true
failBuildOnPolicyFail: true
@WBradney035779 (Community Member) ,
Ideally this is not the correct approach in terms of cost or availablity of agent for other pipelines/tasks, you will be keep running the agent more than expected.
However if that is what you are looking, try the following.
Can you try to modify "timeoutInMinutes" and set the values greater than the scan time?
pool:
name: Azure Pipelines
demands:
- msbuild
- visualstudio
timeoutInMinutes: 120
What did change this time is that the scan job in Veracode got stuck "Waiting for module selection", and after I simply clicked the button to start the scan, it proceeded just fine.
Ironically, and to your first point about the "correct approach", if were _not_ waiting for the scan to finish in Azure Devops, the pipeline would have show green there, giving us no indication of a problem on the Veracode side.
This product really is a mess from an automation perspective.
I know how mess it is. I've some example where the Veracode takes more than 8 hours to complete the scan.
However, see if you can make use of Pipeline scanner to evaluate the issues before your actual static scan.
https://docs.veracode.com/r/c_about_pipeline_scan