From 1f60d34b2fa1d9dc2172c1885d56cf1610bcc2f3 Mon Sep 17 00:00:00 2001 From: Tim Jarrett Date: Tue, 8 Sep 2026 10:28:26 -0400 Subject: [PATCH 1/5] Remap CWE 95 to 94 --- .../owasp/benchmarkutils/score/parsers/VeracodeReader.java | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/VeracodeReader.java b/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/VeracodeReader.java index 67c937ca..b28c18a4 100644 --- a/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/VeracodeReader.java +++ b/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/VeracodeReader.java @@ -17,19 +17,14 @@ */ package org.owasp.benchmarkutils.score.parsers; -import java.io.FileInputStream; import java.text.SimpleDateFormat; import java.util.List; -import javax.xml.parsers.DocumentBuilder; -import javax.xml.parsers.DocumentBuilderFactory; import org.owasp.benchmarkutils.score.BenchmarkScore; import org.owasp.benchmarkutils.score.ResultFile; import org.owasp.benchmarkutils.score.TestCaseResult; import org.owasp.benchmarkutils.score.TestSuiteResults; -import org.w3c.dom.Document; import org.w3c.dom.Node; import org.w3c.dom.NodeList; -import org.xml.sax.InputSource; public class VeracodeReader extends Reader { @@ -46,7 +41,6 @@ public boolean canRead(ResultFile resultFile) { @Override public TestSuiteResults parse(ResultFile resultFile) throws Exception { - TestSuiteResults tr = new TestSuiteResults("Veracode SAST", true, TestSuiteResults.ToolType.SAST); @@ -135,6 +129,7 @@ private int translate(int cwe) { if (cwe == 80) return 79; if (cwe == 331) return 330; if (cwe == 91) return 643; + if (cwe == 95) return 94; return cwe; } } From d4480e45b0513a1a47c291b5cb1fdbdae59955e8 Mon Sep 17 00:00:00 2001 From: Tim Jarrett Date: Thu, 17 Sep 2026 09:25:39 -0400 Subject: [PATCH 2/5] Create sca.yml --- .github/workflows/sca.yml | 42 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/sca.yml diff --git a/.github/workflows/sca.yml b/.github/workflows/sca.yml new file mode 100644 index 00000000..55c589c6 --- /dev/null +++ b/.github/workflows/sca.yml @@ -0,0 +1,42 @@ +# This workflow will initiate a Veracode SCA Scan. Requires the following secrets: +# SRCCLR_API_TOKEN - generated when creating a new integration under the Agents tab +# SCM_GITHUB - https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token +# USER_EMAIL - email address, used in pull requests +# USER_NAME - username, used in pull requests + +name: Veracode SCA Scan + +# Controls when the action will run. Triggers the workflow on push or pull request +# events but only for the master branch +on: + workflow_dispatch: + push: + branches: + - master + - main + pull_request: + branches: + - master + - main + +jobs: + opensource-scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: SCA Agent scan + env: # Set the secret as an input + SRCCLR_API_TOKEN: ${{ secrets.SRCCLR_API_TOKEN }} + SRCCLR_SCM_TYPE: GITHUB + SRCCLR_SCM_TOKEN: ${{ secrets.SCM_GITHUB }} + SRCCLR_PR_ON: methods + SRCCLR_NO_BREAKING_UPDATES: true + SRCCLR_IGNORE_CLOSED_PRS: true + SRCCLR_SCM_URL: https://github.com/$GITHUB_REPOSITORY + VERACODE_API_KEY_ID: ${{ secrets.VERACODE_API_ID}} + VERACODE_API_KEY_SECRET: ${{ secrets.VERACODE_API_KEY }} + EXTRA_ARGS: '--update-advisor --pull-request --unmatched --appname="${{ github.event.repository.name }}"' + run: | + git config --global user.email "${{ secrets.USER_EMAIL }}" + git config --global user.name "${{ secrets.USER_NAME }}" + curl -sSL https://download.sourceclear.com/ci.sh | sh -s -- scan $EXTRA_ARGS From 6d197b220012dc3b99c3d6a1e796991db375e017 Mon Sep 17 00:00:00 2001 From: Tim Jarrett Date: Thu, 17 Sep 2026 09:38:56 -0400 Subject: [PATCH 3/5] Update sca.yml --- .github/workflows/sca.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sca.yml b/.github/workflows/sca.yml index 55c589c6..23eb9488 100644 --- a/.github/workflows/sca.yml +++ b/.github/workflows/sca.yml @@ -23,7 +23,7 @@ jobs: opensource-scan: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v5 - name: SCA Agent scan env: # Set the secret as an input SRCCLR_API_TOKEN: ${{ secrets.SRCCLR_API_TOKEN }} From b8ffe08bda5f6eb4ebf68a2c501d20cd1a424258 Mon Sep 17 00:00:00 2001 From: Tim Jarrett Date: Thu, 17 Sep 2026 09:42:18 -0400 Subject: [PATCH 4/5] Update sca.yml fix appname --- .github/workflows/sca.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sca.yml b/.github/workflows/sca.yml index 23eb9488..c8f9d467 100644 --- a/.github/workflows/sca.yml +++ b/.github/workflows/sca.yml @@ -35,8 +35,8 @@ jobs: SRCCLR_SCM_URL: https://github.com/$GITHUB_REPOSITORY VERACODE_API_KEY_ID: ${{ secrets.VERACODE_API_ID}} VERACODE_API_KEY_SECRET: ${{ secrets.VERACODE_API_KEY }} - EXTRA_ARGS: '--update-advisor --pull-request --unmatched --appname="${{ github.event.repository.name }}"' + EXTRA_ARGS: '--update-advisor --pull-request --unmatched' run: | git config --global user.email "${{ secrets.USER_EMAIL }}" git config --global user.name "${{ secrets.USER_NAME }}" - curl -sSL https://download.sourceclear.com/ci.sh | sh -s -- scan $EXTRA_ARGS + curl -sSL https://download.sourceclear.com/ci.sh | sh -s -- scan --appname=${{ github.event.repository.name }} $EXTRA_ARGS From 1bdc37cad5ac0b4c7321b938340fc0c7cb9b7f92 Mon Sep 17 00:00:00 2001 From: Tim Jarrett Date: Thu, 17 Sep 2026 09:46:36 -0400 Subject: [PATCH 5/5] Create policyscan-java.yml --- .github/workflows/policyscan-java.yml | 58 +++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 .github/workflows/policyscan-java.yml diff --git a/.github/workflows/policyscan-java.yml b/.github/workflows/policyscan-java.yml new file mode 100644 index 00000000..e67ce806 --- /dev/null +++ b/.github/workflows/policyscan-java.yml @@ -0,0 +1,58 @@ +# Veracode Policy Scan workflow. Requires the following secrets: +# VERACODE_API_ID - https://help.veracode.com/r/t_create_api_creds +# VERACODE_API_KEY - https://help.veracode.com/r/t_create_api_creds + +name: Veracode Policy Scan + +# Controls when the action will run. Triggers the workflow on push or pull request +# events but only for the master branch +on: + workflow_dispatch: + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "build" + build-and-policy-scan: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it + - uses: actions/checkout@v5 + - uses: actions/setup-java@v1 # Make java accessible on path so the uploadandscan action can run. + with: + java-version: '11' + + - name: Check for Maven build + id: check_maven + uses: andstor/file-existence-action@v2 + with: + files: "pom.xml" + + - name: Check for Gradle build + id: check_gradle + uses: andstor/file-existence-action@v2 + with: + files: "*/build.gradle" + + - name: Build application with mvn + if: steps.check_maven.outputs.files_exists == 'true' + run: mvn -B package --file pom.xml + + - name: Build application with gradle + if: steps.check_gradle.outputs.files_exists == 'true' + run: gradle clean build + + - uses: actions/upload-artifact@v4 # Copy files from repository to docker container so the next uploadandscan action can access them. + with: + path: '**/*.[jw]ar' # Wildcards can be used to filter the files copied into the container. See: https://github.com/actions/upload-artifact + + - uses: veracode/veracode-uploadandscan-action@master # Run the uploadandscan action. Inputs are described above. + with: + appname: '${{ github.event.repository.name }}' + filepath: '**/*.[jw]ar' + vid: '${{ secrets.VERACODE_API_ID }}' + vkey: '${{ secrets.VERACODE_API_KEY }}' + scantimeout: 15 + createprofile: false