Configure a step to review Dynamic Analysis results with pipeline builds

You can add a step to your Jenkins pipeline project to get scan results from a Dynamic Analysis of your application.

Before you begin:

You meet the prerequisites.
You have installed the Jenkins Plugin.
For added security, Veracode highly recommends using the Credentials Binding plugin to manage your credentials. You use the plugin to bind your credentials to environment variables, which prevents your credentials from appearing in the Jenkins interface. See Protect Veracode credentials in Jenkins pipeline builds.
You must have already linked an existing Dynamic Analysis to an application profile with a Veracode policy. See Manually link Dynamic Analysis results to an application profile. If the Dynamic Analysis is linked to multiple URLs, you cannot view the analysis results in Jenkins. Therefore, you can either unlink URLs until there is only one linked to the Dynamic Analysis, or you can view the results in the Veracode Platform.

Veracode recommends using a snippet generator to create code snippets for routinely repeated steps in your build/test/deploy pipeline.

To complete this task:

In your Jenkins pipeline project, select Configure > Pipeline.
Select Pipeline Syntax to display the Snippet Generator page.
From the Sample Step dropdown menu, select veracodeDynamicAnalysisReview: Review Veracode Dynamic Analysis Results.
Enter the number of hours to wait for analysis results to be available.
Select whether to fail the Jenkins build if the analysis violates a linked Veracode policy.
Enter your API credentials.

note
If your Veracode API credentials are bound to environment variables, you can enter the environment variables for the API ID and API key.
Select Run in debug mode to collect detailed information about the analysis. The plugin stores the information in the console log of each Jenkins project.
If you are using a proxy host to connect to the Veracode Platform, select Connect using proxy and enter the proxy host information.
Select Generate Pipeline Script to generate a script using the selected settings.

This example shows a script using bound credentials. The values for the Veracode API user ID (vid) and API key (vkey) are the environment variables which map to the actual credentials in the Jenkins credential store.
```
veracodeDynamicAnalysisReview debug: true, failBuildForPolicyViolation: true, vid: 'VERACODE_API_ID', vkey: 'VERACODE_API_KEY' waitForResultsDuration: 1
```
Copy the pipeline script, which you add to your pipeline project.
Go back to the main page for your pipeline project.
Select Configure > Pipeline.
In the Pipeline section, paste the script into the Script field.
Delete the quotes from around the values for vid and vkey.
Select Apply to save your changes.
Go back to the main page for your pipeline project.
Select Build Now and wait for the build and analysis to complete successfully.
Under Build History, select a build number.
Select Veracode Dynamic Analysis to review the results of the analysis.

In the results, you can select the View Executive Summary link to view additional information in the Veracode Platform.

Did you find this helpful?