MFall894850 (Community Member) asked a question.
I've configured a Github Action to run pipeline scan and SCA on my Python codebase.
I've packaged a zip file as suggested in the documentation (including requirements.txt), and uploaded it using corresponding Veracode Github Actions.
The scan is successful, however when I check the report, the most libraries listed in my requirements.txt file are not present, which makes me think that my dependencies are not being scanned. What strikes me is that the dependencies listed seems to come from a dev-requirements.txt file that is not even included in the package.
Below are the parameters passed to the Github Action:
Is the SCA scan directly reading from the Github repo, instead of the packaged zip file?
Also, I'm using poetry on my project, so I'm generating the requirements.txt dynamically in my Github Action, only to include it in the zip. But if the SCA doesn't use the zip, how can I provide this requirements.txt file?
.png){kind=logo}
hello @MFall894850 (Community Member)
SCA agent-based scan needs to look at you requeriments.txt or de-requeriments.txt or requeriments-dev.txt. SCA can look for pipfile.lock or setup.py too.
You doesn't need to point SCA to you .ZIP file to be able to scan your libraries, SCA will perform looking into you directory structure (default start point is the currenct directory ".")
I recommend to run your scan with the flag allow-dirty with false and recursive false and then pointing to requeriments.txt into your directory which have requeriments.txt
You can perform a on-demand test with SCA agent-based directly from you workstation via CLI following this instruction: https://docs.veracode.com/r/t_sc_cli_agent (Linux and MacOS) or Windows (https://docs.veracode.com/r/Install_the_Veracode_SCA_Agent_with_PowerShell)