SAlspach987951 (Community Member) asked a question.
The flaw importer seems to find our custom process and work item type, as well as logs the flaws from the scans in the pipeline, but nothing is created at the end, and the last line is:
##debugClass Name : WorkItemCreatoroAuth , Method Name : warnAndExit
This is the yaml for the task:
- task: Veracode Flaw Importer@3
inputs:
ConnectionDetailsSelection: Credentials
apiId: $(APIID)
apiKey: $(APIKey)
proxySettings: -phost $(PHost) -pport $(PPort)
veracodeAppProfile: $(appName)
importType: All Unmitigated Flaws Violating Policy
area: $(System.TeamProject)
tfspassword: $(password)
flawImportLimit: 1000
workItemType: Issue
Since the class refers to OAuth, I suspect the issue is from the 'tfspassword' property, but in the docs say "Do not change this value from the default of $(password)."
.png){kind=logo}
Hello @SAlspach987951 (Community Member) ,
I see that you contacted our Support team and after sending them the ADO log file, they found that it was not importing anything because flaws did not match the import filter and the task was set up to import "All Unmitigated Flaws Violating Policy". Also, they noted that the two flaws found in the static scan were not policy-violating flaws.
Jason
Veracode Support Engineer
Yes, I changed it to "All Unmitigated Flaws" and it worked. I guess I didn't realize the flaws Veracode reports are not dictated by the policy.