KPandey873676 (Community Member) asked a question.
I want to use veracode pipeline scan in my ADO pipeline yml file. Is there a way we can do the Veracode pipeline scan with service connection instead of passing Api key and Secret. I am talking specifically for pipeline scan not full scan.
I got reference like this, but that needs Api Key and Secret to be provided. I don't wanna do that
verademo-dotnet/azure-pipelines.yml at main · veracode/verademo-dotnet · GitHub
.png){kind=logo}
Hello user, I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, and click on your user avatar.
2. Select Contact Support from the drop-down menu. Please open a support case and provide a detailed explanation of your query to facilitate better assistance from our engineers.
Regards,
Hariprasad
Veracode support
hello @KPandey873676 (Community Member)
Pipeline scan is a CLI tool which need the parameters to work correctly. The best practice is keep you API keys into ADO project Variables as a secret (padlock enabled to avoid leak credentials)
then, the scan would be:
java -jar pipeline-scan.jar -vid $(VERACODE_API_ID) -vkey $(VERACODE_API_KEY) --file /path_to_you_app