Skip to main content

Integrate Static Analysis with the CLI

You can integrate the Veracode CLI with your CI/CD pipelines to identify security flaws as part of the software development process.

You add a job to your pipeline that runs the static scan command. This command causes the job to fail if the analysis finds flaws that match your specified criteria.

Getting started

Locate a project you want to scan and ensure it meets the packaging requirements. If you do not have a project to scan,
Veracode provides the demo applications VeraDemoDotNet and VeraDemo on GitHub that you can use for testing purposes.

To get started using static analysis scanning in a pipeline, follow these steps:

1. Get API credentials

Before using the following examples, the Veracode CLI requires you to have working API credentials. After generating credentials, you must configure them with the CLI. The examples below use environment variables, but you can use a configuration file as well. Veracode recommends that you store the credentials as secrets or masked variables depending on your CI/CD platform.

2. Build your code

Before you can scan, you must build and package your code. See the packaging requirements to determine the necessary steps. Then, in your pipeline, add a stage for the build process and pass the build artifacts to the scan job.

3. Scan your code

Before you can run a scan, you must install the CLI.

Then run a scan:

./veracode static scan <source> [flags]

You use flags to configure the scan. For example, you can add a flag to fail the job when the scan finds flaws. For the list of flags, see the static scan command.


The following examples show how to set up a static analysis scan job for common CI/CD platforms:

Azure DevOps

- main
vmImage: "ubuntu-latest"
- task:
# build here
- task: CmdLine@2
displayName: Veracode static scan
script: |
curl -fsS | sh
./veracode static scan verademo.war
VERACODE_API_KEY_ID: $(myVeracodeId)
VERACODE_API_KEY_SECRET: $(myVeracodeSecret)


name: static-scan
on: push
# build here
runs-on: ubuntu-latest
- name: Download Veracode CLI
uses: wei/curl@master
args: -fsS | sh
- name: Run a static scan
run: ./veracode static scan verademo.war
VERACODE_API_KEY_ID: ${{ secrets.myVeracodeId }}
VERACODE_API_KEY_SECRET: ${{ secrets.myVeracodeSecret }}


image: ubuntu-latest
- build
- scan
# build here
stage: scan
- build_job
- curl -fsS | sh
- ./veracode static scan verademo.war
VERACODE_API_KEY_ID: ${myVeracodeId}
VERACODE_API_KEY_SECRET: ${myVeracodeSecret}


pipeline {
agent { label <'ubuntu-latest'> }
environment {
VERACODE_API_KEY_ID = '${myVeracodeId}'
VERACODE_API_KEY_SECRET = '${myVeracodeSecret}'
stages {
stage('Build') {
// build here
stage('Veracode static scan') {
steps {
sh 'curl -fsS | sh'
sh './veracode static scan verademo.war'

Configure GitLab to generate issues

To use the --gl-issue-generation flag with the veracode static scan command to automatically generate issues in GitLab from discovered flaws, you must create a GitLab access token. For Java applications, you must also add environment variables in GitLab for the base directories.

Create an access token

To enable the Veracode CLI to generate GitLab issues from discovered flaws, create a GitLab access token and add it as an environment variable in your GitLab project.

To complete this task:

  1. Select Edit Profile > Access Tokens > Create personal access token.
  2. Ensure that the token has a scope of api. See the GitLab documentation.
  3. Select Settings > CI/CD > Variables and store the token you created as an environment variable named PRIVATE_TOKEN.

Add environment variables for Java applications

To use the --gl-issue-generation flag to generate issues for Java applications, add environment variables for the GitLab base directories.

To complete this task:

  1. In GitLab, go to your project and select Settings > CI/CD > Variables.
  2. Add the following environment variables:
    • SRC_ROOT: the filepath typically is /src/main/java/.

    • JSP_ROOT: the filepath typically is /src/main/webapp/.

Add a GITLAB_URL variable for custom domains

To use the --gl-issue-generation flag with a custom domain, in your project, add a GITLAB_URL CI/CD variable for the base URL. For example:


The default value is