用于 Veracode 扫描离子电容器项目的 Azure Pipeline 任务。构建工件文件路径无效

Question

我第一次尝试 veracode。我想通过 azure pipeline 扫描我的 ionic 项目。

以下是我的项目结构：

所以我在 azure-pipeline.yml 文件中添加了一个任务。

# Starter pipeline
# Start with a minimal pipeline that you can customize to build and deploy your code.
# Add steps that build, run tests, deploy, and more:
# https://aka.ms/yaml

trigger:
- develop

pool:
  vmImage: macOS-latest

steps:

- script: npm install
  displayName: 'Install dependencies'
  workingDirectory: $(pluginDir)
  
- script: |
    # Add any necessary setup steps for running iOS tests (e.g., installing dependencies, setting up simulators)
    brew install cocoapods
    cd $(pluginDir)/ios
    pod install
  displayName: 'Setup for iOS tests'
  
- task: JavaToolInstaller@0
  inputs:
    versionSpec: '17'
    jdkArchitectureOption: 'x64'
    jdkSourceOption: 'PreInstalled'
  
- task: Gradle@3
  inputs:
    gradleWrapperFile: '$(pluginDir)/android/gradlew'
    workingDirectory: '$(pluginDir)/android'
    tasks: 'test'
    publishJUnitResults: false
    javaHomeOption: 'JDKVersion'
    sonarQubeRunAnalysis: false
    spotBugsAnalysis: false

- task: Xcode@5
  inputs:
    actions: 'test'
    configuration: 'Debug'
    sdk: 'iphonesimulator'
    xcWorkspacePath: '$(pluginDir)/ios/Plugin.xcworkspace'
    scheme: 'PluginTests'
    packageApp: false
    destinationPlatformOption: 'iOS'
    destinationSimulators: 'iPhone 14'

- task: Veracode@3
  displayName: 'Upload dist to Veracode'
  inputs:
    ConnectionDetailsSelection: 'Service Connection'
    AnalysisService: 'Vera***'
    veracodeAppProfile: 'K2 Mobile Component Media'
    version: '$(Build.BuildNumber)'
    filepath: '$(Build.SourcesDirectory)/$(pluginDir)/dist'
    maximumWaitTime: '360'
  condition: ne(variables['Build.Reason'], 'PullRequest')


- task: Npm@1
  inputs:
    command: 'publish'
    workingDir: '$(pluginDir)'
    publishRegistry: 'useFeed'
    publishFeed: '694ea4fc-*************'

- task: UniversalPackages@0
  inputs:
    command: 'publish'
    publishDirectory: '$(Build.SourcesDirectory)/$(docsDir)'
    feedsToUsePublish: 'internal'
    vstsFeedPublish: '694ea4fc-*************'
    vstsFeedPackagePublish: '$(docsDir)'
    versionOption: 'patch'

我收到的回复如下

Accessing Service Connection
Getting Service Connection URL
Getting Auth Service Connection
Auth Scheme :Token
filepath: /Users/runner/work/1/s/k2-mobile-component-media-plugin/dist
veracodeAppProfile: K2 Mobile Component Media
createProfile: false
failBuildIfUploadAndScanBuildStepFails: false
failBuildOnPolicyFail: false
importResults: false
version: 20240806.4
sandboxName: undefined
createSandBox: false
MaximumWaitTime: 360
Autoscan: true
isDebugEnabled: false
Autoscan: true
/Users/runner/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.12-7/x64/Contents/Home/bin/java -version
openjdk version "17.0.12" 2024-07-16
OpenJDK Runtime Environment Temurin-17.0.12+7 (build 17.0.12+7)
OpenJDK 64-Bit Server VM Temurin-17.0.12+7 (build 17.0.12+7, mixed mode)
Veracode upload & scan task started
Build artifact file path is not valid
Ensure the path to the application artifact or to the folder that contains artifacts for upload is valid.
Finishing: Upload dist to Veracode

是否有特定的文件夹可以将其添加到文件路径中进行扫描？或者我应该压缩所有内容并将其发送以扫描整个项目。如何解决这个问题？

Answer 1

根据打包要求，对于Ionic项目，你应该

压缩应用程序源文件并上传 ZIP 文件。

您可以在

ArchiveFiles@2

任务之前添加

Veracode@3

任务来压缩源文件。

- task: ArchiveFiles@2
  inputs:
    rootFolderOrFile: '{The folder of your source files}'
    includeRootFolder: false
    archiveType: 'zip'
    archiveFile: '$(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip'
    replaceExistingArchive: true
- task: Veracode@3
  displayName: 'Upload dist to Veracode'
  inputs:
    ConnectionDetailsSelection: 'Service Connection'
    AnalysisService: 'Vera***'
    veracodeAppProfile: 'K2 Mobile Component Media'
    version: '$(Build.BuildNumber)'
    filepath: '$(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip'
    maximumWaitTime: '360'
  condition: ne(variables['Build.Reason'], 'PullRequest')

从打包您的代码查看更多信息。