hi,

so as the title suggests, we are running a pipeline SAST scan using the java pipline scan with out dotnet project on github. like so:

- name: Download Veracode SAST Scanner jar

run:

curl https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip -L -o pipeline-scan-LATEST.zip

- run: java -jar ./pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_KEY_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY_SECRET}}" --fail_on_severity="Very High, High" --file to-scan.zip --app_id "Veracode_Scanner X" --project_name "${{ github.event.repository.name }}" --project_url "${{ github.event.repository.html_url }}" --verbose true --issue_details true

continue-on-error: false

- name: Convert pipeline scan output to SARIF format

id: convert

uses: veracode/veracode-pipeline-scan-results-to-sarif@master

with:

pipeline-results-json: results.json

output-results-sarif: veracode-results.sarif

finding-rule-level: "4:1:0"

- uses: github/codeql-action/upload-sarif@v2

with:

sarif_file: veracode-results.sarif

appears to work fine and certainly adds code scanning alerts into github, but the paths in the sarif file (and initially generated file from the scan itself) are incorrectly reported

1. actual path is incorrect
2. the casing of the actual filenames is in lowercase, but the repo uses PascalCase for filenames

this results in the code scanning alerts in GitHub, not highlighting the file in question, as I assume it thinks it cant find it.

if there a flag (cant see one in the docs for the command line args) that will maintain the casing of the files in the sarif? or some other way to get GitHub to report it correctly

thanks