Package: security-scan-invoker
security-scan-invokerA python module to submit and monitor scan statuses for static security scanning platformsCurrently Supported IntegrationsVeracodePrerequisitesInstall MakeFor Mac users, you can useHomebrewbrew install makeFor Windows users, you can useChocolateychoco install makeProject InitializationSetup Virtual Environmentmake initActivate venvMacsource venv/bin/activateWindows.\venv\Scripts\activateYou’ll know the venv is activated since you’ll see (venv) in the terminalTo deactivate venv, simply typedeactivatein the terminalRun Tox from the Makefilemake verifyAuto format Python files to PEP8make fixClean up Python virtual environmentsmake cleanSupported Python VersionsExplicitly tested and supported Python versions can be found in thetox.inifile, but
generally this will be the latest 3 versions of Python.UsageGitHub Action-name:Veracode upload for analysisuses:JohnDeere/security-scan-invoker@{VERSION}with:veracode_secret_id:${{ secrets.VERACODE_ACCESS_KEY_ID }}veracode_secret_key:${{ secrets.VERACODE_SECRET_ACCESS_KEY }}package_to_scan:veracode-scanner.zipveracode_project_name:"Your_Project_name"CLI usage:security_scan_invoker --vid <ID> --vkey <KEY> --appname <APPNAME> --filepath <FILEPATH> --version <VERSION>CLI with optional arguments included:security_scan_invoker --vid <ID> --vkey <KEY> --appname <APPNAME> --filepath <FILEPATH> --version <VERSION> --allow_rescan <True> --select_previous_modules <True>Python module import usage:fromsecurity_scan_invoker.mainimportrun_veracode_scanner_appfromsecurity_scan_invoker.scanner_argsimportScannerArgsargs={"vid":"<VID>","vkey":"<VKEY>","appname":"<APPNAME>","filepath":"<FILEPATH>","version":"<UNIQUE_VERSION>","allow_rescan":"<ALLOW_RESCAN>","select_previous_modules":"<SELECT_PREVIOUS_MODULES>",}exit_code:int=run_veracode_scanner_app(ScannerArgs(args))Note:versionmust be unique. One possible way to maintain uniqueness is by setting the
version tocommit hash + job number.Build Actions and ResultsPrevious scan statusNew version?ALLOW_RESCANActionBuild statusResults ReadyYN/ASubmit new scanBased on submit responseResults ReadyNfalseSkip scanPassResults ReadyNtrueSubmit RescanBased on submit responseScan in ProgressY/NN/ASkip scanPassPre-Scan SubmittedY/NN/ASkip scanPassPre-Scan SuccessY/NN/ASkip scanPassNot Submitted to EngineY/NN/ASkip scanPassSubmitted to EngineY/NN/ASkip scanPassPending Internal ReviewY/NN/ASkip scanPassIncompleteYN/ADelete Previous Scan and Submit New ScanBased on submit responseIncompleteNN/AFail buildFailScan CanceledYN/ADelete Previous Scan and Submit New ScanBased on submit responseScan CanceledNN/AFail buildFailNo Modules DefinedYN/ADelete Previous Scan and Submit New ScanBased on submit responseNo Modules DefinedNN/AFail buildFailPre-scan CanceledYN/ADelete Previous Scan and Submit New ScanBased on submit responsePre-scan CanceledNN/AFail buildFailPre-scan FailedYN/ADelete Previous Scan and Submit New ScanBased on submit responsePre-scan FailedNN/AFail buildFailFAQ and Common ErrorsQ: I got an error sayingERROR: Get app list returned status_code: 401A:This means the passed API credentials don't have access to the Veracode App ProfileThis could be due to any of the following:Veracode credentials aren't properly passed into the build (from GitHub secrets, for instance)Veracode credentials are expired and need to be regenerated. By default, credentials are valid
for 1 year.The Veracode credentials don't have access to the app profile.Note: Sometimes Veracode returns 401 errors for unknown reasons. This is rare, but may coincide
with a problem in their platform. Check theVeracode status pageto
check the health of their services.Q: I got an error
sayingERROR: Can't find app called ______ in any of the _____ apps associated with your ID and KeyA:This means that your Veracode credentials were recognized by Veracode but the app wasn't in
the list of apps tied to your credentials.This could be due to any of the following:The specified app profile doesn't exist in Veracode.Your credentials don't have access to the app.Q: I got an error sayingERROR: The following build status is not handled: ______A:This means the previous scan failed and is in a state that needs investigation. It is not
handled automatically by veracode-scanner.
Pleasecreate an issueon this repository.Q:I got an error
sayingERROR: You are trying to scan version ______, which is the same version as the previous scan, and it is in a bad state: ______A:This means that you are re-executing a scan with the same commit as the previous scan, which
is in a bad state. Follow these steps:Scan with a new commit. veracode-scanner will delete the previous bad scan and start a scan on
the new commit.Q:I got an error
sayingERROR: We found an issue in deleting the previous scan, which is in a bad stateA:This means veracode-scanner failed to automatically delete the previous scan. Ensure that
your Veracode credentials haveDelete Scansaccess.Q: I found a bug. What do I do?A:Submit bug reports and feature requests as
anissueon the veracode-scanner repo