ALogan051856 (Community Member) asked a question.

What is the proper way to add modules (--include) to an AzureDevOps pipeline scan?

We are setting up pipeline scans in Azure Devops. The scan is working correctly without module selection (--include) but I have not been able to get it to work when adding a module. The result is "SCAN_MESSAGE: No modules matched user criteria". I have tried including the full path as seen in the logs and various other things.

 

Example:

 

Found Scannable modules:

home/vsts/work/1/a/veracode/my.dll

 

PIPELINE-SCAN ERROR: No modules matched your selection: /home/vsts/work/1/a/veracode/my.dll

 

I realize one has the initial forward slash (/). That is from AzureDevOps $ArtifactStagingDirectory And I am pretty sure I tried hardcoding the full path as a test.

 

I tested this locally from command line it does work but of course the path is different.

 

==========================

Found 2 Scannable modules.

==========================

publish/my.dll

publish/other.dll

 

===================

Analyzed 1 modules.

===================

publish/my.dll

 

----

In this case I used --include publish/my.dll


  • ALogan051856 (Community Member)

    I have a solution. A rather simple one at that. had to add a but of scripting to remove the first slash. Seems odd that the scanner matched module names doesn't use the same variable for the ArtifactStagingDirectory.

     

    Thanks.

  • SamHouston (Veracode)

    Hi @ALogan051856 (Community Member)​ - We have a description of the --include parameter on this page: https://docs.veracode.com/r/r_uploadandscan#parameters

     

    • Case-sensitive, comma-separated list of module name patterns that represent the names of modules to scan as top-level modules. The * wildcard matches 0 or more characters. The ? wildcard matches exactly one character.

     

    You may be able to use *my.dll

     

    We also have more docs on Static scans here, https://docs.veracode.com/r/veracode_static_scan

    Expand Post

Topics (5)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.