veracode/Veracode Static Analysis Pipeline Scan and SARIF import
Initiate a Veracode Static Analysis Pipeline Scan and convert the results file to a valid SARIF file
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-type | The scan type for which a SARIF report needs to be generated can be either a pipeline scan or a policy scan | yes | pipeline |
| results-json | The location of the JSON result file for the policy or pipeline | yes | filtered_results.json |
| pipeline-results-json | location of the pipeline json result file | yes | results.json |
| output-results-sarif | the path to the SARIF file as an output of the transformation | yes | veracode-results.sarif |
| source-base-path-1 | a path prefix conversion before publish in the SARIF file | no | "" |
| source-base-path-2 | a path prefix conversion before publish in the SARIF file | no | "" |
| source-base-path-3 | a path prefix conversion before publish in the SARIF file | no | "" |
| finding-rule-level | The conversion rule of Veracode findings to GitHub level | yes | 4:3:0 |
| repo_owner | The account owner of the repository. The name is not case sensitive. | no | — |
| repo_name | The name of the repository without the .git extension. The name is not case sensitive. | no | — |
| githubToken | GitHub token is a secure token that allows the workflow to interact with the GitHub API and perform actions on behalf of the repository or user | yes | ${{ github.token }} |
| ref | The full Git reference | yes | ${{ github.ref }} |
| commitSHA | The SHA of the commit to which the analysis you are uploading relates. | yes | ${{ github.sha }} |
| noupload | Do not upload the SARIF file to the GitHub repository | no | false |
Outputs
no outputs