Veracode CI

Goal: Provide a command-line tool to use in NPM scripts for triggering Veracode scans in a CI/CD setting.

Usage

Prerequisites

• Have VERA_ID and VERA_KEY environment variables defined with valid Veracode API Credentials

Setup in NPM Project

1. Install as a dev dependency

   npm i -D veracode-ci

2. In the scripts block of your package.json, add a veracode script

   {
       ...
       "scripts": {
           ...
           "veracode": "veracode --sandbox --appName=<your-veracode-app-name>"
       },
       ...
   }

3. Run the veracode script

   npm run veracode

Excluding Folders/Files

Additionally, you can specify your own excludes. By default, this package zips up everything in the current-working-directory of your project (where the package.json is) excluding the node_modules folder. You can overwrite this excludes by adding a comma-delimited value like so:

veracode --sandbox --appName=<your-veracode-app-name> --excludes='node_modules/**/*,lib/**/*'

Command-line Options

FLAG	VALUE	DESCRIPTION
sandbox	none	Trigger a veracode scan in a sandbox under a provided (existing) app
excludes	comma-delimited string	Override what folders/files are excluded from the project for scanning. Defaults to node_modules/**/*.
appId	integer	Veracode App ID to run the scans under. Must have appId OR appName specified
appName	string	Veracode App Name to run the scans under. Must have appId OR appName specified
scanAllNonfatalTopLevelModules	true or false	See Veracode doc for beginprescan.do
autoScan	true or false	See Veracode doc for beginprescan.do

Useful Resources

• Veracode API Doc
• Veracode Packaging Instructions for JavaScript and TypeScript
• JavaScript @jupiterone/veracode-client