veracode-pipeline.yml

# *******************************************************************************
# Copyright (c) 2023 BMW AG
# Copyright (c) 2023 Contributors to the Eclipse Foundation
#
#   See the NOTICE file(s) distributed with this work for additional
#   information regarding copyright ownership.
#
#   This program and the accompanying materials are made available under the
#   terms of the Apache License, Version 2.0 which is available at
#   https://www.apache.org/licenses/LICENSE-2.0.
#
#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#   WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#   License for the specific language governing permissions and limitations
#   under the License.
#
#   SPDX-License-Identifier: Apache-2.0
#   ********************************************************************************

name: Veracode Static Analysis Pipeline Scan

on:
  push:
    branches: [ "main" ]
  schedule:
  # Once a day
    - cron: "0 0 * * *"
  workflow_dispatch:

jobs:
  build-and-pipeline-scan-backend:
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Set up JDK 17
        uses: actions/setup-java@v2
        with:
          java-version: 17
          distribution: adopt

      - name: Build with Maven
        run: mvn clean install

      - name: Zip application sources
        run: zip -r veracode-scan-target.zip ./

      - name: Run Veracode Upload And Scan
        uses: veracode/veracode-uploadandscan-action@0.2.4
        with:
          appname: "demand-capacity-mgmt-backend"
          createprofile: false
          filepath: "./veracode-scan-target.zip"
          vid: "${{ secrets.VERACODE_API_ID }}"
          vkey: "${{ secrets.VERACODE_API_KEY }}"

  build-and-pipeline-scan-frontend:
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Zip frontend
        run: zip -r veracode-scan-target-frontend.zip ./demand-capacity-mgmt-frontend

      - name: Run Veracode Upload And Scan
        uses: veracode/veracode-uploadandscan-action@0.2.4
        with:
          appname: "demand-capacity-mgmt-frontend"
          createprofile: false
          filepath: "./veracode-scan-target-frontend.zip"
          vid: "${{ secrets.VERACODE_API_ID }}"
          vkey: "${{ secrets.VERACODE_API_KEY }}"