Ask search #436
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: veracode | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| merge_group: | |
| jobs: | |
| Veracode_SAST: | |
| runs-on: | |
| - ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4.2.2 | |
| - name: Zip Scannable Files | |
| run: > | |
| find . -path '*test*' -prune -o \( -name '*.py' -o -name '*.js' -o | |
| -name '*.ts' -o -name '*.htm*' -o -name '*.json' -o -name '*.yml' \) | |
| -print | zip cfgov-gha.zip -@ | |
| - name: See Included Files | |
| run: | | |
| ls -la | |
| - name: Setup Veracode | |
| run: | | |
| curl -fsS https://tools.veracode.com/veracode-cli/install | sh | |
| - name: Get baseline from private repo | |
| run: | | |
| gh api repos/cfpb/veracode-baselines/contents/cfgov/baseline.json \ | |
| --jq '.content' | base64 -d > baseline.json | |
| env: | |
| GH_TOKEN: ${{ secrets.VERACODE_PAT }} | |
| - name: Download Veracode Static Pipeline Scanner | |
| run: > | |
| curl | |
| https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip | |
| -o veracode.zip | |
| unzip -o veracode.zip | |
| - name: Verify No Secret Leak | |
| continue-on-error: true | |
| run: | | |
| echo ${{secrets.VERACODE_API_ID}} | |
| - name: Veracode Static Pipeline Scanner | |
| continue-on-error: true | |
| run: > | |
| java -jar pipeline-scan.jar --veracode_api_id | |
| "${{secrets.VERACODE_API_ID}}" --veracode_api_key | |
| "${{secrets.VERACODE_API_KEY}}" --file | |
| "./cfgov-gha.zip" --baseline_file baseline.json --app_id="cfgov" | |
| --fail_on_severity="Very High, High" --summary_output true | |
| - name: Archive Results.json & Results.txt from Veracode Static Pipeline Scanner | |
| uses: actions/upload-artifact@v4.6.2 | |
| with: | |
| name: Veracode SAST Pipeline Results | |
| path: results.* | |
| Veracode_SCA: | |
| runs-on: | |
| - ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4.2.2 | |
| - name: SCA Scan | |
| env: | |
| SRCCLR_API_TOKEN: ${{secrets.SRCCLR_API_TOKEN}} | |
| SRCCLR_REGION: FED | |
| working-directory: ./ | |
| run: > | |
| curl -sSL https://download.sourceclear.com/ci.sh | sh -s scan | |
| --json=SCA-App-Issues.json | |
| - name: Upload SCA issues artifact | |
| uses: actions/upload-artifact@v4.6.2 | |
| with: | |
| name: Veracode SCA Scan Results | |
| path: SCA-App-Issues.json |