azure-pipelines-pipelinescan.yml

# Maven
# Build your Java project and run tests with Apache Maven.
# Add steps that analyze code, save build artifacts, deploy, and more:
# https://docs.microsoft.com/azure/devops/pipelines/languages/java

trigger:
- master

pool:
  vmImage: ubuntu-latest

steps:
- task: Maven@3
  displayName: 'build verademo'
  inputs:
    mavenPomFile: 'pom.xml'
    mavenOptions: '-Xmx3072m'
    javaHomeOption: 'JDKVersion'
    jdkVersionOption: '1.8'
    jdkArchitectureOption: 'x64'
    publishJUnitResults: true
    testResultsFiles: '**/surefire-reports/TEST-*.xml'
    goals: 'package'

- task: Bash@3
  displayName: 'Veracode SCA scan'
  inputs:
     targetType: 'inline'
     script: |
          export SRCCLR_SCM_URI=https://github.com/christyson/verademo
          export SRCCLR_API_TOKEN="$(SRCCLR_API_TOKEN)"
          export SRCCLR_SCM_REF=master
          export SRCCLR_SCM_REF_TYPE=branch
          export SRCCLR_SCM_REV="$(build.buildNumber)"
          curl -sSL https://download.sourceclear.com/ci.sh | bash -s -- scan --update-advisor
  continueOnError: true
  env:
    SRCCLR_API_TOKEN: $(SRCCLR_API_TOKEN)

- task: VeracodePipelineScan@0
  displayName: 'Download Veracode Pipeline Scanner'
  inputs:
    VeracodeAPIID: '$(VERACODE_API_ID)'
    VeracodeAPIsecret: '$(VERACODE_API_KEY)'
    fileToScan: '/home/vsts/work/1/s/target/verademo.war'
    policyName: 'OWASP'
  continueOnError: true