julz0815/Veracode Flaw Importer

Import flaws from Veracode Platform and create work items in Azure DevOps

Trust Signals

workflow.ymlSHA-pinned

uses: julz0815/ado-workitems-action@1f0c8783998417d078d6c79ffd995139efa491c6 # no releases — HEAD as of 2026-07-11

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
ado-token	Azure DevOps Personal Access Token (PAT) with Work Items Read & Write permissions	yes	—
ado-org	Azure DevOps organization name	yes	—
ado-project	Azure DevOps project name	yes	—
veracode-api-id	Veracode API ID	yes	—
veracode-api-key	Veracode API Key	yes	—
veracode-app-profile	Application Name in Veracode Platform	yes	—
sandbox-name	Sandbox Name (optional)	no	—
scan-type	Scan Type	yes	Static Analysis
import-type	Import Type	yes	All Unmitigated Flaws Violating Policy
work-item-type	Work Item Type	yes	Bug
open-state	State to use when opening/creating work items	no	New
close-state	State to use when closing work items	no	Closed
reopen-state	State to use when reopening work items	no	New
area-path	Area Path	yes	—
overwrite-area-path	Overwrite Area Path in Work Items on Import	yes	false
iteration-path	Iteration Path	yes	—
overwrite-iteration-path	Overwrite Iteration Path in Work Items on Import	yes	false
flaw-import-limit	Flaw Import Limit	yes	1000
add-cwe-as-tag	Add CWE as a Tag	no	true
add-cve-as-tag	Add CVE as a Tag	no	true
add-custom-tag	Add Custom Tag	no	—
add-build-id-as-tag	Add Build ID as a Tag	no	true
add-scan-name-as-tag	Add Scan Name as a Tag	no	true
add-scan-type-tag	Add Scan Type as a Tag	no	true
add-severity-tag	Add Severity as a Tag	no	true
add-due-date-tag	Add Due Date as a Tag	no	true
custom-fields	Custom Fields (key:value pairs, one per line)	no	—
proxy-settings	Proxy Settings	no	—
fail-on-error	Fail action if flaw importer fails	no	true
debug	Enable debug logging	no	false

no outputs