Is it possible to show SCA findings in pipeline upload and scan, without putting SCA into the policy and failing on findings?

FGuerra553066 (Community Member) asked a question.

July 9, 2025 at 4:27 PM

We currently have upload and scan jobs in our Jenkins pipelines for all our applications. Our policy currently is set to fail on High and Very High static findings. We want our developers to start working on remediating SCA findings, but we don't want those findings failing our builds due to the volume of flaws. Is there a way to get the SCA findings to our developers, through email reports or pipeline output, without failing SCA in our policy?

Veracode Software Composition Analysis

SamHouston (Veracode)
a year ago
Hi @FGuerra553066 (Community Member) -

Yes, you can show SCA findings in your Jenkins pipeline without failing your builds due to policy violations. Here are some steps you can take:

Modify Your Policy: If possible, adjust your policy settings to exclude SCA findings from affecting the build status. This way, even if there are SCA findings, they won't fail the builds.
Use Veracode Jenkins Plugin: Ensure you are using the Veracode Jenkins Plugin, which allows you to configure how findings are reported. You can set it up to display SCA results in the pipeline output without failing the build.
Devs also have the ability to run SCA Agent scan locally

Expand Post