Veracode-PipeValidacao.yml

# Node
trigger:
- master

pool:
  vmImage: ubuntu-latest

variables:
- group: Veracode

stages:
- stage: SAST
  displayName: SAST
  jobs:
  - job: PipelineScan
    steps: 
    - task: ArchiveFiles@2
      inputs:
        rootFolderOrFile: '$(Agent.BuildDirectory)'
        includeRootFolder: true
        archiveType: 'zip'
        archiveFile: '$(caminhoPacote)'
        replaceExistingArchive: true
      displayName: 'Criando pacote para analise'

    - script: |
        curl -O -L https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
      displayName: 'Download Pipeline Scanner'
    - task: ExtractFiles@1
      inputs:
        archiveFilePatterns: 'pipeline-scan-LATEST.zip'
        destinationFolder: '$(Build.ArtifactStagingDirectory)'
        cleanDestinationFolder: false
    - script: |
          java -jar $(Build.ArtifactStagingDirectory)/pipeline-scan.jar -vid $(APIID) -vkey $(APIKEY) --file '$(caminhoPacote)' --issue_details true --summary_output true --summary_output_file "SAST-results.txt"
      displayName: 'Veracode PipelineScan'
      continueOnError: true
      
    - task: PublishBuildArtifacts@1
      inputs:
        PathtoPublish: 'SAST-results.txt'
        ArtifactName: 'Veracode'
        publishLocation: 'Container'

- stage: SCA
  displayName: SCA
  dependsOn:
  jobs:
  - job: AgentBased
    steps: 
    - task: CmdLine@2
      inputs:
        script: |
          export SRCCLR_SCM_NAME=$(veracodeAppProfile)
          curl -sSL https://download.sourceclear.com/ci.sh | bash -s – scan --update-advisor --allow-dirty >> SCA-results.txt
      displayName: 'Veracode SCA'
      continueOnError: true
    
    - task: PublishBuildArtifacts@1
      inputs:
        PathtoPublish: 'SCA-results.txt'
        ArtifactName: 'Veracode'
        publishLocation: 'Container'