azure-pipelines.yml

# Maven
# Build your Java project and run tests with Apache Maven.
# Add steps that analyze code, save build artifacts, deploy, and more:
# https://docs.microsoft.com/azure/devops/pipelines/languages/java
# This is an example of using VeraDemo Java test application with the Veracode Static Pipeline scanner.  A Veracode subscription is required.


trigger:
- none

pool:
  vmImage: 'ubuntu-latest'

steps:
- task: Maven@3
  displayName: Build with Maven
  inputs:
    mavenPomFile: 'app/pom.xml'
    goals: 'package'

#- task: Veracode@3
#  displayName: Veracode Static Scan 
#  inputs:
#    ConnectionDetailsSelection: 'Credentials'
#    apiId: '$(API_ID)'
#    apiKey: '$(API_KEY)'
#    veracodeAppProfile: 'VeraDemo'
#    version: 'ADO_$(build.buildNumber)'
#    filepath: '$(Build.Repository.LocalPath)/app/target/verademo.war'
#    createProfile: false
#    importResults: false
#    failBuildOnPolicyFail: false

- task: Bash@3
  displayName: Veracode Static Pipeline Scan
  inputs:
    targetType: 'inline'
    script: |
      curl -sSO https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
      unzip -o pipeline-scan-LATEST.zip
      java -jar pipeline-scan.jar -vid $(API_ID) -vkey $(API_KEY) -f $(System.DefaultWorkingDirectory)/app/target/verademo.war || true

- task: Bash@3
  displayName: Commit results.json to GitHub repo
  inputs:
    targetType: 'inline'
    script: |
      git config --global user.email "staghizadehmoghadam@veracode.com"
      git config --global user.name "Sina T"
      git checkout -b main
      git add results.json
      git commit -m "Updating results.json file with results from ADO Build $(build.buildNumber)"
      git push https://$(GITHUB_PAT)@github.com/sinat101/verademo.git main

- publish: $(System.DefaultWorkingDirectory)/results.json
  artifact: Pipeline Scan Results