search

veracode / veracode-uploadandscan-action

This action uploads and scans code to Veracode for a static policy (or sandbox) scan.
MIT License
30 stars 29 forks source link

Overriding ability for the mvn repository url to download jar from #18

Open Macadoshis opened 2 years ago

Macadoshis commented 2 years ago

Please make the mvn target repository overridable, particularly for GH Enterprise private instances whose most of them have their Internet access blocked or ssl access enforced by restrictive certificates, and thus benefit from their intranet nexus instance (less download time and security compliance).

https://github.com/veracode/veracode-uploadandscan-action/blob/e86714cf9d98f634d8bc2011992fc4dd74c70a7d/entrypoint.sh#L240-L244

Based on other jar-downloading tools like the maven-wrapper, please expose the url as an overridable parameter or environment variable, and only fallback to https://repo1.maven.org/maven2 if not set.

Something like :

- name: Veracode Upload And Scan
  uses: veracode/veracode-uploadandscan-action
  env:
    MVNW_REPOURL: "https://nexus.mycompany.com/repository/maven-central"
# entrypoint.sh
if [ ! -n "$MVNW_REPOURL" ]; then
MVNW_REPOURL="https://repo1.maven.apache.org/maven2"
fi

javawrapperversion=$(curl $MVNW_REPOURL/com/veracode/vosp/api/wrappers/vosp-api-wrappers-java/maven-metadata.xml | grep latest |  cut -d '>' -f 2 | cut -d '<' -f 1)

#echo "javawrapperversion: $javawrapperversion"

curl -sS -o VeracodeJavaAPI.jar "$MVNW_REPOURL/com/veracode/vosp/api/wrappers/vosp-api-wrappers-java/$javawrapperversion/vosp-api-wrappers-java-$javawrapperversion.jar"