Software Composition Analysis - example-javascript #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Veracode Software Composition Analysis | |
| run-name: Software Composition Analysis - ${{ github.event.client_payload.repository.name }} | |
| concurrency: | |
| group: ${{ github.event.client_payload.event_type }}-${{ github.event.client_payload.repository.name }}-${{ github.event.client_payload.repository.branch }} | |
| cancel-in-progress: true | |
| on: | |
| repository_dispatch: | |
| types: [veracode-sca-scan] | |
| jobs: | |
| cleanup: | |
| uses: ./.github/workflows/veracode-clean-up.yml | |
| with: | |
| runs_on: ${{ github.event.client_payload.user_config.default_runs_on }} | |
| register: | |
| uses: ./.github/workflows/veracode-check-run.yml | |
| with: | |
| check_run_name: ${{ github.workflow }} | |
| head_sha: ${{ github.event.client_payload.sha }} | |
| repositroy_owner: ${{ github.event.client_payload.repository.owner }} | |
| repositroy_name: ${{ github.event.client_payload.repository.name }} | |
| event_type: ${{ github.event.client_payload.event_type }} | |
| github_token: ${{ github.event.client_payload.token }} | |
| run_id: ${{ github.run_id }} | |
| branch: ${{ github.event.client_payload.repository.branch }} | |
| default_runs_on: ${{ github.event.client_payload.user_config.default_runs_on }} | |
| veracode-sca-scan: | |
| needs: [register] | |
| runs-on: ${{ fromJSON(github.event.client_payload.user_config.default_runs_on) }} | |
| name: Veracode Component Analysis | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: ${{ github.event.client_payload.repository.full_name }} | |
| ref: ${{ github.event.client_payload.repository.branch }} | |
| token: ${{ github.event.client_payload.token }} | |
| - uses: actions/checkout@v4 | |
| with: | |
| path: 'veracode-helper' | |
| - name: Detect workspace and generate lockfiles | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const fs = require('fs') | |
| const path = require('path') | |
| const { execSync } = require('child_process') | |
| const rootDir = '/home/runner/work/veracode/veracode' | |
| const packageJsonPath = path.join(rootDir, 'package.json') | |
| const pnpmLock = path.join(rootDir, 'pnpm-lock.yaml') | |
| const pnpmWorkspace = path.join(rootDir, 'pnpm-workspace.yaml') | |
| const owner = '${{ github.event.client_payload.repository.owner }}' | |
| const repo = '${{ github.event.client_payload.repository.name }}' | |
| const exists = p => fs.existsSync(p) | |
| if (exists(packageJsonPath) && exists(pnpmLock) && exists(pnpmWorkspace)) { | |
| core.info( | |
| '- The file package.json, pnpm-lock.yaml and pnpm-workspace.yaml exist. This looks like a PNPM workspace project.' | |
| ) | |
| const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')) | |
| if (pkg.workspaces) { | |
| core.info('-- The package.json file contains workspaces - running PNPM lockfile generator') | |
| execSync( | |
| `node veracode-helper/helper/pnpm-helper.js \ | |
| --folder "${rootDir}" \ | |
| --intRepoPrefix "${owner}" \ | |
| --repoName "${repo}"`, | |
| { stdio: 'inherit' } | |
| ) | |
| } else { | |
| core.warning('-- The package.json file does not contain workspace - this will fail') | |
| } | |
| } else if (exists(packageJsonPath) && !exists(pnpmLock) && !exists(pnpmWorkspace)) { | |
| const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')) | |
| if (pkg.workspaces) { | |
| core.info("- The package.json file exists, and it contains 'workspaces'.") | |
| const pkgText = fs.readFileSync(packageJsonPath, 'utf8') | |
| if (pkgText.includes('yarn')) { | |
| core.info('-- Yarn was identified on the package.json file') | |
| const match = pkgText.match(/yarn[^0-9]*([0-9]+)/) | |
| const version = match?.[1] | |
| if (!version) { | |
| core.warning('-- The yarn version could not be identified.') | |
| } else { | |
| core.info(`-- The yarn version is: ${version}`) | |
| if (Number(version) < 3) { | |
| core.info('---- Running v2 lockfile generator') | |
| execSync( | |
| `node veracode-helper/helper/yarn-lock-file-generator-v2.js --folder "${rootDir}"`, | |
| { stdio: 'inherit' } | |
| ) | |
| } else { | |
| core.info('---- Running v3 lockfile generator') | |
| execSync( | |
| `node veracode-helper/helper/yarn-lock-file-generator-v3.js --folder "${rootDir}"`, | |
| { stdio: 'inherit' } | |
| ) | |
| } | |
| } | |
| } else { | |
| core.info('- Yarn was not identified on the package.json file') | |
| } | |
| } else { | |
| core.info("- The package.json file exists, but it does not contain 'workspaces'.") | |
| } | |
| } else { | |
| core.info('The package.json file does not exist.') | |
| } | |
| // Cleanup | |
| fs.rmSync('veracode-helper', { recursive: true, force: true }) | |
| - name: Run Veracode SCA | |
| env: | |
| SRCCLR_API_TOKEN: ${{ secrets.VERACODE_AGENT_TOKEN }} | |
| JAVA_OPTS: -Xms2g -Xmx4g | |
| uses: veracode/[email protected] | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| create-issues: false | |
| recursive: true | |
| allow-dirty: true | |
| breakBuildOnPolicyFindings: ${{ github.event.client_payload.user_config.break_build_policy_findings }} |