ACS-6305 Implement SAST Pipeline Scan

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ env:
   GITHUB_ACTIONS_DEPLOY_TIMEOUT: 60
 
 jobs:
-  veracode:
+  veracode_sca:
     name: "Veracode - Source Clear Scan (SCA)"
     runs-on: ubuntu-latest
     if: >
@@ -52,6 +52,55 @@ jobs:
         with:
           srcclr-api-token: ${{ secrets.SRCCLR_API_TOKEN }}
 
+  veracode_sast:
+    name: "Pipeline SAST Scan"
+    runs-on: ubuntu-latest
+    if: >
+      ((github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || github.event_name == 'pull_request')) &&
+      !contains(github.event.head_commit.message, '[skip build]')
+    steps:
+      - uses: actions/checkout@v3
+      - uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      - uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      - name: "Login to Docker Hub"
+        uses: docker/[email protected]
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: "Login to Quay.io"
+        uses: docker/[email protected]
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_PASSWORD }}
+      - name: "Build"
+        run: mvn -B -U install -DskipTests
+      - name: "Create zip"
+        run: zip -r to-scan.zip engines/aio/target/alfresco-transform-core-aio-*.jar engines/base/target/alfresco-base-t-engine-*.jar model/target/alfresco-transform-model-*.jar
+      - name: "Run SAST Scan"
+        id: scan
+        uses: veracode/[email protected]
+        with:
+          vid: '${{ secrets.VERACODE_API_ID }}'
+          vkey: '${{ secrets.VERACODE_API_KEY }}'
+          file: "to-scan.zip"
+          fail_build: true
+          project_name: alfresco-transform-core
+          issue_details: true
+          veracode_policy_name: Alfresco Default
+          summary_output: true
+          summary_output_file: readable_results.txt
+          summary_display: true
+      - name: Upload scan result
+        if: success() || failure()
+        run: zip readable_output.zip readable_results.txt
+      - name: Upload Artifact
+        if: success() || failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: Veracode Pipeline-Scan Results (Human Readable)
+          path: readable_output.zip
+
   build_and_test:
     name: "Core & Base Snapshot deployment"
     runs-on: ubuntu-latest
@@ -146,7 +195,7 @@ jobs:
   release:
     name: "Release"
     runs-on: ubuntu-latest
-    needs: [veracode, build_and_test, all_tests_matrix]
+    needs: [veracode_sca, build_and_test, all_tests_matrix]
     if: >
       !(failure() || cancelled()) &&
       contains(github.event.head_commit.message, '[release]') &&