cosval (Community Member) asked a question.
Hi all.
I'm trying to integrate an agent-based SCA scan in our Bitbucket pipelines. However, we get this error:
This project does not seem to build.
Because of this, Veracode SCA agent cannot scan it. Please ensure that the project compiles prior to scanning.
Most probably, the reason is that ci.sh (or better the srcclr tool) does not access the appropriate Maven repository (in our case our Artifactory installation). The mvn command is:
/usr/bin/mvn compile -Dcheckstyle.skip=true -e -DskipTests -DskipITs -Dmaven.test.skip=true --fail-fast --nsu -Denforcer.skip=true com.srcclr:srcclr-maven-plugin:3.1.21:scan --batch-mode -DheadlessOutputFile=/tmp/graph-16272972738394018409.json
And the maven repository it tries to access is:
http://repo.maven.apache.org/maven2
It fails with 501, because this is not HTTPS, but in any case our artifacts (and 3rd party libraries) are not located there. The proper Maven repositories are included in the Maven settings.xml file which exists in the roor directory of the Bitbucket repository.
The question is how can we pass to the "mvn compile" command the option:
--settings
which designates the location of the Maven settings.xml file?
Many thanks in advance!
Costas.
.png){kind=logo}
Hello @cosval (Community Member) ,
Thank you for reaching out to the Community.
With this issue, I would recommend opening an Integrations support ticket. You can open a support ticket within the Community. Simply click on your profile on the top right side of the screen and select "Contact Support". Or click on the link below.
https://community.veracode.com/s/contact-support
I would suggest adding any error screenshots, as well as logs to help troubleshoot this issue.
Kind regards,
Steven
Veracode Support Engineer
Hello @cosval (Community Member) ,
I just wanted to post the solution here in the Community from your support ticket.
Your configuration is correct. As a test, can you please create a new sandbox, perform the initial scan manually with manual module selection and then run the scan using the Veracode Jenkins plugin with scanIncludesPattern.
Kind regards,
Steven
Veracode Support Engineer
for coming back to me. I’ll perform the test you described and let you know.
Regards,
Costas.