DWolf600492 (Community Member) asked a question.
Difference of Sandbox with and without 'sandboxname' variable set?
Hello everyone,
for the integration of SCA and SAST scans, I try to set up a proper YAML file for a CI pipeline on GitHub. I have a few questions about this and hope you can give me some advice.
What is the difference between these actions, and when to use one over the other?
https://github.com/veracode/Veracode-pipeline-scan-action
https://github.com/veracode/veracode-uploadandscan-action
In the Sandbox-scan I also set up, I used the variables 'createsandbox: "true"' and 'sandboxname: "TestSandbox"'. When removing the 'sandboxname' variable, there still is an upload to Veracode, but it seems a different kind of scan is run. What are the differences to SAST and a Sandbox-scan without a set 'sandboxname' variable?
A snippet of my YAML file is attached for clarification.
Thank you in advance
.png){kind=logo}
Hi @DWolf600492 (Community Member) ,
Pipeline scans and 'uploadandscan' or Policy scans are both ways to scan using Veracode Static Analysis. The main difference between them is 'reporting'. The Pipeline scan skips reporting the flaws to the Veracode Platform and performing our 'flaw matching' functionality. This means it's faster, but at the cost of insight. It it typically a trade-off you would make for purposes of 'shifting left'. Pipeline scans work great on Merge Requests or frequent scans where you just want to know 'did I introduce a new flaw'. Policy scans however work better as a way to give your security team insight into the security status of an upcoming release.
Sandbox scans are identical to 'Policy' scans however they are not evaluated for Policy.
You can read more about this feature here: https://docs.veracode.com/r/c_about_sandbox .
Depending on your contract you may be entitled to work with a Veracode Customer Success Engineer who can help you with mapping our capabilities unto your development and deployment process. I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
Thank you,
Boy Baukema