forked from VictorM3/Verademo
-
Notifications
You must be signed in to change notification settings - Fork 9
/
Copy pathazure-pipelines.yml
78 lines (70 loc) · 2.35 KB
/
azure-pipelines.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# Maven
# Build your Java project and run tests with Apache Maven.
# Add steps that analyze code, save build artifacts, deploy, and more:
# https://docs.microsoft.com/azure/devops/pipelines/languages/java
pool:
vmImage: ubuntu-latest
variables:
- group: Veracode
- name: caminhoPacote
value: target/verademo.war
steps:
- task: Maven@3
inputs:
mavenPomFile: 'pom.xml'
mavenOptions: '-Xmx3072m'
javaHomeOption: 'JDKVersion'
jdkVersionOption: '1.8'
jdkArchitectureOption: 'x64'
publishJUnitResults: true
testResultsFiles: '**/surefire-reports/TEST-*.xml'
goals: 'package'
- task: CmdLine@2
inputs:
script: |
export SRCCLR_SCM_NAME=$(veracodeAppProfile)
curl -sSL https://download.sourceclear.com/ci.sh | bash -s – scan --update-advisor --allow-dirty
displayName: 'Veracode SCA'
continueOnError: true
- script: |
curl -O -L https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
displayName: 'Download Pipeline Scanner'
- task: ExtractFiles@1
inputs:
archiveFilePatterns: 'pipeline-scan-LATEST.zip'
destinationFolder: '$(Build.ArtifactStagingDirectory)'
cleanDestinationFolder: false
- script: |
java -jar $(Build.ArtifactStagingDirectory)/pipeline-scan.jar -vid $(APIID) -vkey $(APIKEY) --file '$(caminhoPacote)' --issue_details true
displayName: 'Veracode PipelineScan'
continueOnError: true
- task: Veracode@3
inputs:
ConnectionDetailsSelection: 'Endpoint'
AnalysisService: 'veracode-evento'
veracodeAppProfile: '$(veracodeAppProfile)'
version: '$(build.buildNumber)'
filepath: '$(caminhoPacote)'
createProfile: true
importResults: true
maximumWaitTime: '360'
displayName: 'Veracode SAST'
- task: Veracode Flaw Importer@3
inputs:
ConnectionDetailsSelection: 'Endpoint'
AnalysisService: 'veracode-evento'
veracodeAppProfile: '$(veracodeAppProfile)'
sandboxName:
scanType: 'Dynamic, Static, and Software Composition Analysis'
importType: 'All Unmitigated Flaws Violating Policy'
workItemType: 'Issue'
area: '$(system.teamProject)'
overwriteAreaPathInWorkItemsOnImport: true
flawImportLimit: '1000'
displayName: 'Veracode importando falhas'
- task: PublishBuildArtifacts@1
inputs:
PathtoPublish: '$(caminhoPacote)'
ArtifactName: 'drop'
publishLocation: 'Container'
displayName: 'Publica o artefato'