Sohlae (Community Member) asked a question.
Azure DevOps - Does the Veracode@3 Task Work on an Angular Codebase?
I'm currently using the Veracode@3 task in our Azure DevOps pipeline, and although it runs successfully, I am not sure if it is actually scanning anything. I say this because the score of the static scan is always 100 and when I actually downloaded the last report, it shows that it only scanned the .zip file and some .js.map files.
The .zip file contains the files generated when the ng build command is executed so there are no .ts files.
What should I do so that the Veracode@3 task scans the codebase itself?
.png){kind=logo}
Hi @Sohlae (Community Member) ,
For an Angular app we would expect to see a "JS files within ....zip" module as the primary module (note it says "JS" but this includes TypeScript).
Please do note that the presence of .map files indicates that concatenation and/or minification happened on JavaScript / TypeScript.
We recommend against providing us concatenated, minified or transpiled JavaScript. Instead we recommend running `veracode package --trust` on the source code repository and uploading the resulting archive. You can find more information on this here: https://docs.veracode.com/r/veracode_package .
Hi @Boy, Security Consultant (Veracode), it is not possible for us to use the Veracode CLI because our repository is a private one, that is, an identity needs to be authenticated before it can access our codebase.
Hi @Sohlae (Community Member) ,
Sorry for the late reply, unfortunately, with email notifications not available, it's difficult to see replies.
You should be able to clone the repo to a directory using your credentials and then package the directory on a CI machine?
We are currently working on the package command and would very much like to hear more about your use case and/or help you get set up. I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
Thank you,
Boy Baukema