AReemal315338 (Community Member) asked a question.
A pipeline scan for a Java project that outputs a jar file doesn't show any vulnerabilities in the output whereas the same jar file shows multiple vulnerabilities when scanned with upload and scan
I have a Java application configured for both Upload and Scan and Pipeline scan, done through GitHub workflows. The pipeline scan is done through Veracode's GitHub action and the Upload and Scan is done through a script that uses the wrapper API.
upload and scan command is as follows
sh veracode-upload-scan.sh BTS_SFP false <jar file name> <version> "${{secrets.VID}}" "${{secrets.VKEY}}" false
Pipeline scan command is as follows
What could be the reason for this inconsistency in the reported results when using these 2 methods.
.png){kind=logo}
hello @AReemal315338 (Community Member)
What is the output from pipeline scan action? Is something like "No issues found" ?
You can test using CLI wrapper of Pipeline scan instead of Action to see if the same problem occur.
Basically, you can download, unzip and scan, or use the Pipeline Scan docker image. Bellow there are some examples to use
Let me see if the tests worked
Here's the output when using the GitHub action
I see @AReemal315338 (Community Member) yes make sense to use action if you could open issues on Github.
Maybe could be a good test if you change the version of pipelines-can action (from veracode/Veracode-pipeline-scan-action@v1.0.9 to veracode/Veracode-pipeline-scan-action@v1.0.8) and see if the scan works.
let me know if worked