veracode-analysis.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert

name: Veracode Static Analysis Pipeline Scan

on:
  push:
    branches: [ master ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]
  schedule:
    - cron: '35 1 * * 5'

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
permissions:
  contents: read

jobs:
  # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter
  build-and-pipeline-scan:
    # The type of runner that the job will run on
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    runs-on: ubuntu-latest
    steps:

    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps
    - name: Harden Runner
      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
      with:
        egress-policy: audit

    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        repository: ''

    - run: zip -r veracode-scan-target.zip ./

    # download the Veracode Static Analysis Pipeline scan jar
    - run: curl --silent --show-error --fail -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
    - run: unzip -o pipeline-scan-LATEST.zip

    - uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # main
      with:
        java-version: 8
        distribution: 'temurin'
    - run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-scan-target.zip
      continue-on-error: true
    - name: Convert pipeline scan output to SARIF format
      id: convert
      uses: veracode/veracode-pipeline-scan-results-to-sarif@37a60a38fedd7712b5e7bdfd41cc6bf5843a6791
      with:
        pipeline-results-json: results.json
    - uses: github/codeql-action/upload-sarif@2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f # v2.23.2
      with:
        # Path to SARIF file relative to the root of the repository
        sarif_file: veracode-results.sarif