blocks|key|4505441|text|您可以创建关于Veracode静态扫描分析的GitHub操作。为此，您可以执行以下步骤：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4505442|4505443|在GitHub项目的安全选项卡中(您需要具有GitHub项目的管理员权限)，单击"Code+scanning+alerts“的"Enable+settings”。|ordered-list-item|4505444|4505445|4505446|这将把您带到项目的设置，在这里您需要为“代码扫描”“启用”“GitHub高级安全”，|4505447|4505448|4505449|，然后单击将启用的“Go+to+code+scanning”按钮。|4505450|4505451|4505452|在出现多个代码扫描工具的列表上向下滚动，选择“Veracode静态分析”(通常显示在页面底部)。|4505453|4505454|工作流单击“设置此工作流”，将自动在.github/|4505455|路径下的主分支中创建一个子目录。工作流在包含管道步骤的.yml文件中配置。|4505456|4505457|您需要将Veracode+API密钥设置为项目机密(查看此处的Create+Veracode+API+keys和此处的setup+GitHub+Action+Secrets+for+Repository。将您的API密钥命名为VERACODE_API_ID和VERACODE_API_KEY+(因为这是在.yml文件中设置的名称，或者在这两个位置相应地更改它们)|offset|length|4505458|4505459|在自动创建的.yml文件中，有一个管道根据|4505460|所在行上设置的规则运行|4505461|📷|atomic|4505462|您可以查看此链接以了解更多信息on+push/pull+request+branches/tags|4505463|4505464|分支名称可以更改，也可以遵循正则表达式，有关更多信息，请参阅here。|4505465|4505466|您还可以将操作配置为按计划运行。将鼠标悬停在“cron”上可查看出现的人工阅读格式。这样，该操作将根据cron运行。计划的工作流在默认或基本分支上的最新提交上运行。查找有关如何在项目的操作选项卡上配置GitHub操作的计划事件的更多信息您现在可以看到管道运行的日志和每次运行的日志您已经按照上述步骤设置了GitHub操作(步骤1-8)，并且操作运行良好(如步骤9所述检查其状态)在GitHub项目的安全选项卡中，您应该能够看到"Code+scanning+alerts“是”活动的“，单击”GitHub+alerts“。这会将您带到Veracode缺陷列表。|4505467|4505468|entityMap|0|LINK|mutability|MUTABLE|url|https://help.veracode.com/r/t_create_api_creds|1|https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository|2|IMAGE|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/0528a6aac6539fd4dc723d4152a2e57a.png|imageAlt|3|https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestbranchestags|4|https://ask.qcloudimg.com/http-save/yehe-900000/b5bf704545f49ba8749c6eab7bcb0077.png|5|https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|V|O|0|1N|16|1|0|0|0|0|0|1|2|0|F|Y|3|0|0|1|4|0|U|4|5|0|0|0|0^^$0|@$1|2|3|4|5|6|7|24|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|25|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|26|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|27|8|@]|9|@]|A|$]]|$1|G|3|-4|5|6|7|28|8|@]|9|@]|A|$]]|$1|H|3|I|5|E|7|29|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|2A|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|2B|8|@]|9|@]|A|$]]|$1|L|3|M|5|E|7|2C|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|2D|8|@]|9|@]|A|$]]|$1|O|3|-4|5|6|7|2E|8|@]|9|@]|A|$]]|$1|P|3|Q|5|E|7|2F|8|@]|9|@]|A|$]]|$1|R|3|-4|5|6|7|2G|8|@]|9|@]|A|$]]|$1|S|3|T|5|6|7|2H|8|@]|9|@]|A|$]]|$1|U|3|V|5|E|7|2I|8|@]|9|@]|A|$]]|$1|W|3|-4|5|6|7|2J|8|@]|9|@]|A|$]]|$1|X|3|Y|5|6|7|2K|8|@]|9|@$Z|2L|10|2M|1|2N]|$Z|2O|10|2P|1|2Q]]|A|$]]|$1|11|3|-4|5|6|7|2R|8|@]|9|@]|A|$]]|$1|12|3|13|5|E|7|2S|8|@]|9|@]|A|$]]|$1|14|3|15|5|6|7|2T|8|@]|9|@]|A|$]]|$1|16|3|17|5|18|7|2U|8|@]|9|@$Z|2V|10|2W|1|2X]]|A|$]]|$1|19|3|1A|5|6|7|2Y|8|@]|9|@$Z|2Z|10|30|1|31]]|A|$]]|$1|1B|3|17|5|18|7|32|8|@]|9|@$Z|33|10|34|1|35]]|A|$]]|$1|1C|3|1D|5|6|7|36|8|@]|9|@$Z|37|10|38|1|39]]|A|$]]|$1|1E|3|-4|5|6|7|3A|8|@]|9|@]|A|$]]|$1|1F|3|1G|5|E|7|3B|8|@]|9|@]|A|$]]|$1|1H|3|-4|5|6|7|3C|8|@]|9|@]|A|$]]|$1|1I|3|-4|5|6|7|3D|8|@]|9|@]|A|$]]]|1J|$1K|$5|1L|1M|1N|A|$1O|1P]]|1Q|$5|1L|1M|1N|A|$1O|1R]]|1S|$5|1T|1M|1U|A|$1V|1W|1X|-4]]|1Y|$5|1L|1M|1N|A|$1O|1Z]]|20|$5|1T|1M|1U|A|$1V|21|1X|-4]]|22|$5|1L|1M|1N|A|$1O|23]]]]

You can create a GitHub Action about Veracode static scan analysis. To do this you can follow the steps below:
<ol>
<li>In the Security tab of your GitHub project (you need to have admin rights for the GitHub project), click on &quot;Enable settings&quot; for &quot;Code
scanning alerts&quot;.
</li>
<li>This takes you to the Settings of the project, where you need to “Enable” “GitHub Advanced Security” for “Code scanning”,
</li>
<li>and then click the “Go to code scanning” button that will be enabled.
</li>
<li>Scrolling down on the list appearing with multiple code scanning tools, you pick “Veracode Static Analysis” (usually appearing on the bottom of the page).
</li>
<li>Clicking to “Set up this workflow”, automatically creates a subdirectory in master branch in .github/workflows path. The workflow is configured in a .yml file, that contains the steps of the pipeline.
</li>
<li>Prerequisite: you need to set up Veracode API Keys as Project Secrets (have a look here <a href="https://help.veracode.com/r/t_create_api_creds" rel="nofollow noreferrer">Create Veracode API keys</a> and here
<a href="https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository" rel="nofollow noreferrer">setup GitHub Action Secrets for Repository</a>. Name your API Keys as VERACODE_API_ID and VERACODE_API_KEY (as these are the names that are set in .yml file or change them accordingly in both locations)
</li>
<li>In the .yml file that got created automatically there is a pipeline that runs according to the rules set on the line where it says
<a href="https://i.stack.imgur.com/n9H4K.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/n9H4K.png" alt="check the image" /></a>
</li>
</ol>
you can have a look at this link for more information <a href="https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestbranchestags" rel="nofollow noreferrer">on push/pull request branches/tags</a>
<a href="https://i.stack.imgur.com/lZggy.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/lZggy.png" alt="enter image description here" /></a>
branch names can be altered, following regular expressions as well, see <a href="https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet" rel="nofollow noreferrer">here</a> for more info.
<ol start="8">
<li>You can configure the Action to run on schedule as well.
Hover over “cron” to see the man-read format that appears. With this, the Action will run according to cron. Scheduled workflows run on the latest commit on the default or base branch.
Find more information on how to configure scheduled events on GitHub Actions <a href="https://docs.github.com/en/actions/reference/events-that-trigger-workflows#scheduled-events" rel="nofollow noreferrer">here</a></li>
<li>In the Actions tab of your Project you can now see the logs of the run of the pipeline and each run's status.</li>
<li>After you have set up the GitHub Action as described above (steps 1-8), and the Action has run well (check its status as described in step 9) in the Security tab of your GitHub project, you should be able to see that &quot;Code scanning alerts&quot; are &quot;Active&quot;, click on &quot;View alerts&quot;, that takes you to the list of the Veracode flaws if any.</li>
</ol>

How to integrate Veracode scanner as a pre-commit hook for git working repository? How can we check weather the scanner is actually running?

Veracode as a precommit hook for git

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

如何集成Veracode扫描器作为git工作存储库的预提交钩子？我们如何检查扫描仪是否正在运行？

问Veracode作为git的预提交钩子
EN

回答 1

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Veracode作为git的预提交钩子EN