JCulver409436 (Community Member) asked a question.

May 2, 2024 at 6:58 PM
Pipeline scans are completing and uploading, but no results in console.

I am running pipeline scans in gitlab, and the scans are running OK as per the console. I can see scan results in JSON format when I download them from pipeline artifacts.

 

However, there are no results in the Veracode console.

 

I generated a new set of id/secret key and tried with those, and the same thing is happening.

 

Here is the general script I am using to run the pipeline scan:

 

Veracode Scan:

...

image: veracode/pipeline-scan:latest

script:

- java -jar /opt/veracode/pipeline-scan.jar

-vid $V_ID -vkey $V_SECRET_KEY

--timeout 180

--project_name "${CI_PROJECT_PATH}"

--project_url "${CI_REPOSITORY_URL}"

--project_ref "${CI_COMMIT_REF_NAME}"

--gl_vulnerability_generation="true"

--issue_details "true"

--summary_output "true"

--file ../my-zipped-app.zip

--fail_on_severity="Very High, High"

--verbose true

  • 2 answers
  • 352 views
lucas.ferreira likes this.

  • JCulver409436 (Community Member)

    I also tried manually uploading via curl like this, in the pipeline:

     

    curl --http1.1 -X POST "https://analysiscenter.veracode.com/api/5.0/uploadfile.do"

    -H "Authorization: Basic $(echo -n '${V_ID}:${V_SECRET_KEY}' | base64)"

    -F "file=@${CI_PROJECT_DIR}/results.json"

    -F "app_id=${V_APP_ID}"

     

    I added app id to the scan step of the pipeline as well, and no change

    Expand Post

    • lucas.ferreira (M3Corp)

      Hello @JCulver409436 (Community Member)​ 

       

      This behaviour is expected because pipeline scan doesn't upload reports to platform.

       

      The parameters which you declare into your yml configuration, will generate some metadata will appear inside of Veracode Platform > Analytics > Explore your Data > IDE & Pipeline Scans

       

      You can use 2 options to see reports in a graphical manner:

       

      1. Uploading the pipeline scan json results as gitlab issues. You can look some examples using docs: Pipeline Scan example for GitLab and Gradle with automatic vulnerability generation using a built-in policy | Veracode Docs
      2. You can use a sandbox scan for your branch in parallel pipeline scan or (after or before, since if will be the same app and exactly same scan) to leverage the quick results from pipeline scan and the graphical results using pipeline.
        1. You'll need to configure a step using api wrapper from veracode and declaring -createsandbox and sandboxname like the example bellow:

      veracode_sast_sandbox_scan:

      image: veracode/api-wrapper-java

      stage: veracode_sast_sandbox_scan

      script:

      - >

      - java -jar /opt/veracode/api-wrapper.jar

      -action UploadAndScan

      -appname verademo-dotnetcore

      -createprofile false

      -vid "${VERACODE_API_ID}"

      -vkey "${VERACODE_API_KEY}"

      -sandboxname $CI_COMMIT_REF_NAME

      -createsandbox true

      -filepath upload_app

      -version "job ${CI_JOB_ID}"

      Expand Post

Topics (4)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.