We integrate Veracode into our GitLab CI/CD pipelines using:

• Auto-Packager
• Pipeline Scan (pipeline-scan.jar)
• Policy & Sandbox scans
• Agent-SCA

Challenge: Multiple Artifacts from Auto-Packager

When using auto-packager, it sometimes creates more than one package artifact. This causes issues for the downstream pipeline scan, as:

• You can’t point the scan at the entire auto-packager output directory.
• You can’t specify multiple files on the pipeline scan command line.

Our Approach

We iterate through the contents of the auto-packager output directory and invoke a separate pipeline scan for each artifact. So far, so good.

Integrating with GitLab Security Dashboard

To import results into the GitLab security dashboard, we use the --gl_vulnerability_generation flag. However:

• The GitLab vulnerability report filename is hardcoded in pipeline-scan.jar.
• There’s no command-line option to override it.

Solution: After each pipeline scan, we move and rename the GitLab vulnerability report to avoid overwriting. Simple enough.

Next Hurdle: GitLab Accepts Only One SAST Report per Job

GitLab only ingests one SAST report per job, so we needed a way to merge individual reports into a single file.

After some head-scratching and getting familiar with jq, I succeeded! So I thought I'd share the jq recipe for anyone in the same situation.

Have you solved this differently? Or faced other challenges using Veracode within GitLab? I’d love to hear your approach.

jq recipe to merge SAST reports:

- |

# Put merged file under gl-sast/

export SAST_REPORT_DIR="gl-sast"

# export SAST_MERGED_FILE="${SAST_REPORT_DIR}/gl-sast-report.json"

export SAST_MERGED_FILE="gl-sast-report.json"

echo "SAST_REPORT_DIR=${SAST_REPORT_DIR}"

echo "SAST_MERGED_FILE=${SAST_MERGED_FILE}"

echo "PWD=$(pwd)"

# Safer glob handling

shopt -s nullglob

files=( "${SAST_REPORT_DIR}"/gl-sast-report-*.json )

if (( ${#files[@]} )); then

echo "Found ${#files[@]} SAST JSON(s): ${files[*]}"

# Create parent dir just in case

# install -d -m 0775 "$(dirname "$SAST_MERGED_FILE")"

# Merge with jq (strict GitLab SAST; auto-parse stringified JSON)

# Notes:

# - use -s to slurp all files into a single array for reduce .[]

# - use try fromjson catch {} to safely parse strings

jq -sSe '

# Normalize one report into GitLab SAST shape

def norm($r):

# If top-level is a JSON string, parse it; otherwise use as-is

( if ($r | type) == "string"

then ( try ($r | fromjson) catch {} )

else $r

end

) as $doc

|

if ($doc | has("vulnerabilities")) then

{

version: ($doc.version // "15.0.0"),

scan: ($doc.scan // null),

vulnerabilities: (

$doc.vulnerabilities

| if (type == "array") then . else [] end

)

}

else

{ "__error__": "missing_vulnerabilities_key" }

end;

# Normalize all inputs (slurped into an array by -s)

[ .[] | norm(.) ] as $all

# Merge: skip invalid inputs; preserve first non-null version/scan; concat vulnerabilities

| {

version: (

($all | map(select(has("__error__")==false) | .version) | first)

// "15.0.0"

),

scan: (

$all | map(select(has("__error__")==false) | .scan) | first

),

vulnerabilities: (

$all

| map(select(has("__error__")==false) | .vulnerabilities)

| add

)

}

' "${files[@]}" >"$SAST_MERGED_FILE"