Veracode #186
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Veracode | |
| on: | |
| schedule: | |
| - cron: '30 14 * * *' # 8:00 PM IST (2:30 PM UTC) | |
| permissions: | |
| contents: read | |
| jobs: | |
| scan-build: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: dev | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'zulu' | |
| java-version: '17' | |
| - name: 'Update settings.xml with server configuration' | |
| run: | | |
| echo '<settings> | |
| <servers> | |
| <server> | |
| <id>maven-internal</id> | |
| <username>${{ secrets.PACKAGES_AUTH_USER }}</username> | |
| <password>${{ secrets.PACKAGES_AUTH_TOKEN }}</password> | |
| </server> | |
| </servers> | |
| </settings>' > ~/.m2/settings.xml | |
| - name: Configure Additional Registries | |
| working-directory: nuxeo-admin-console-web/angular-app | |
| run: | | |
| echo "//npm.pkg.github.com/:_authToken=${{ secrets.GIT_TOKEN }}" >> .npmrc | |
| - name: Cache node modules | |
| id: cache-npm | |
| uses: actions/cache@v4 | |
| env: | |
| cache-name: cache-node-modules | |
| with: | |
| # npm cache files are stored in `~/.npm` on Linux/macOS | |
| path: ~/.npm | |
| key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }} | |
| restore-keys: | | |
| ${{ runner.os }}-build-${{ env.cache-name }}- | |
| ${{ runner.os }}-build- | |
| ${{ runner.os }}- | |
| - if: ${{ steps.cache-npm.outputs.cache-hit != 'true' }} | |
| name: List the state of node modules | |
| continue-on-error: true | |
| run: npm list | |
| - name: Install Angular CLI | |
| run: npm install -g @angular/cli | |
| - name: Install Dependencies | |
| working-directory: nuxeo-admin-console-web/angular-app | |
| run: npm install | |
| - name: Delete Node Modules | |
| working-directory: nuxeo-admin-console-web/angular-app | |
| run: rm -rf node_modules | |
| - name: Install zip | |
| run: sudo apt-get install zip | |
| - name: Zip nuxeo-admin-console | |
| working-directory: nuxeo-admin-console-web/angular-app | |
| run: zip -r nuxeo-admin-console-ui.zip * | |
| - name: Upload ZIP as artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: nuxeo-admin-console-ui | |
| path: nuxeo-admin-console-web/angular-app/nuxeo-admin-console-ui.zip | |
| scan: | |
| needs: scan-build | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Download artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: nuxeo-admin-console-ui | |
| path: . | |
| - name: Veracode Upload And Scan | |
| uses: veracode/[email protected] | |
| with: | |
| appname: 'nuxeo-admin-console-ui' | |
| createprofile: false | |
| filepath: 'nuxeo-admin-console-ui.zip' | |
| vid: '${{ secrets.VERACODE_SECRET_API_ID }}' | |
| vkey: '${{ secrets.VERACODE_SECRET_KEY }}' | |
| sandboxname: 'master' | |
| scantimeout: 600 | |
| include: '*.war, *.zip, *.js, *.html, *.css, *.json' | |
| criticality: 'High' | |
| includenewmodules: 'true' |