search

calgaryscientific / veracode-gradle-plugin

Veracode Gradle Plugin
MIT License
3 stars 4 forks source link

Run the gradle workflow task in foreground #47

Open hgakhr opened 6 years ago

hgakhr commented 6 years ago

Hi ,

Firstly this gradle plugin is awesome. We are able to achieve almost every thing by using this plugin . cheers for that . I need a small help from you guys . Actually we are using the gradle task "veracodeBuildWorkflow ". I am getting the below output [root@ip-10-12-168-81 sonar-testing]# gradle veracodeBuildWorkflow -Papp_id=XXXXXX -Pbuild_version=V5

Task :veracodeBuildWorkflow Processing customerfacinguser.zip customerfacinguser.zip=Uploaded

BUILD SUCCESSFUL in 11s 1 actionable task: 1 executed

So , as per logs the gradle command is executed successfully however veracode scanning is still running in the background . Is there any option with which we can run this veracode scanning in the foreground and gradle command should not get exited successfully untill the veracode scan is completed or whole workflow gets completed..

plus , do we have any parameter or flag provided by veracode , which tells us the status of the veracode scan , so that we can take necessary action using that flag value.

Thanks

DavidGamba commented 6 years ago

The Workflow tasks are meant to run asynchronously from the Veracode platform scan since, at least in our case, the veracode scan takes several hours (to days) and we don't want the build agent to hang for that long.

The task calls getBuildStatus at regular intervals:

https://github.com/calgaryscientific/veracode-gradle-plugin/blob/v0.4.0/src/main/groovy/com/calgaryscientific/gradle/VeracodeWorkflow.groovy#L52

The Build Informaiton can be obtained with the veracodeGetBuildInfo task.

From the workflow tasks description in the readme: https://github.com/calgaryscientific/veracode-gradle-plugin#work-flow-tasks-ci-environment

After uploading files, the workflow task will begin a prescan. The next time you run the veracodeBuildWorkflow task, it will tell you that the pre-scan is in progress an exit by doing nothing.

One workflow change I might do, at least internally, is to first query the veracode platform status, and then decide whether to build at all, since I only do debug builds for the veracode scan and don't use those artifacts for anything else. I want to save some CPU cicles.

I hope that answers some of your questions. Let me know if there is anything else you need.

DavidGamba commented 6 years ago

If you want to hang your build you could implement a polling task that checks if the platform is ready. In our case, we have enough PRs merged that the build system is triggering builds constantly and there is no need to block the build. We only submit artifacts when the platform is ready basically and otherwise just finish the build or trigger a begin scan task for the previously uploaded artifacts.

I would like to hear your thoughts into the approach we are taking. Otherwise, in the meanwhile I don't see us changing the workflow to a blocking synchronous one.

PRs are always welcomed though.

hgakhr commented 6 years ago

Hi ,

Thanks for the reply , Can you please let me know is the xml file(buildinfo-app_id-latest.xml) is been updated at runtime. I donot see it to be updated at rntime, its status remain the same. status="Pre-Scan Submitted"

Can you please let me know , how this file is been updated and can we get the status of the scan from this file ?

veerupotru commented 2 years ago

I am seeing this error when ran locally:

could you guide this please:

Execution failed for task ':veracodeDetailedReport'.

javax/xml/bind/DatatypeConverter