azure-pipelines.yml

# Node
trigger:
- master

pool:
  vmImage: ubuntu-latest

variables:
  veracodeAppProfile: AzDevOps.$(Build.DefinitionName)
  caminhoPacote: $(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip

steps:
- task: CmdLine@2
  inputs:
    script: 'npm install'
  displayName: 'NPM'
- task: ArchiveFiles@2
  inputs:
    rootFolderOrFile: '$(Agent.BuildDirectory)'
    includeRootFolder: true
    archiveType: 'zip'
    archiveFile: '$(caminhoPacote)'
    replaceExistingArchive: true
  displayName: 'Criando pacote para analise'

- script: |
    curl -O -L https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
  displayName: 'Download Pipeline Scanner'
- task: ExtractFiles@1
  inputs:
    archiveFilePatterns: 'pipeline-scan-LATEST.zip'
    destinationFolder: '$(Build.ArtifactStagingDirectory)'
    cleanDestinationFolder: false
- script: |
      java -jar $(Build.ArtifactStagingDirectory)/pipeline-scan.jar -vid $(APIID) -vkey $(APIKEY) --file '$(caminhoPacote)' --issue_details true 
  displayName: 'Veracode PipelineScan'
  continueOnError: true

- task: CmdLine@2
  inputs:
    script: |
      export SRCCLR_SCM_NAME=$(veracodeAppProfile)
      curl -sSL https://download.sourceclear.com/ci.sh | bash -s – scan --update-advisor --allow-dirty
  displayName: 'Veracode SCA'
  continueOnError: true
  
- task: Veracode@3
  inputs:
    ConnectionDetailsSelection: 'Credentials'
    apiId: '$(APIID)'
    apiKey: '$(APIKEY)'
    veracodeAppProfile: '$(veracodeAppProfile)'
    version: '$(build.buildNumber)'
    filepath: '$(caminhoPacote)'
    createSandBox: false
    createProfile: true
    failTheBuildIfVeracodeScanDidNotInitiate: false
    scanStatusCheckInterval: '60'
    importResults: true
    failBuildOnPolicyFail: false
  displayName: 'Veracode SAST'

- task: Veracode Flaw Importer@3
  inputs:
    ConnectionDetailsSelection: 'Credentials'
    apiId: '$(APIID)'
    apiKey: '$(APIKEY)'
    veracodeAppProfile: '$(veracodeAppProfile)'
    sandboxName: 
    importType: 'All Flaws'
    workItemType: 'Issue'
    area: '$(system.teamProject)'
    addCustomTag: '$(build.buildNumber)'
    flawImportLimit: '1000'
  displayName: 'Veracode importando falhas'