.gitlab-ci.yml

stages:
    - SCA
    - build
    - scan
    
Software Composition Analysis:
    image: maven:3.6.0-jdk-8
    stage: SCA
    script:
        - curl -sSL https://download.sourceclear.com/ci.sh | bash


compile-application:
    image: maven:3.6.0-jdk-8
    stage: build
    script:
      - mvn clean package
    artifacts:
      name: verademo_julian_10_build
      paths:
        - target/
      expire_in: 5 week
    cache:
      paths:
        - target/
        - .m2/repository

development-upload-for-sast:
    image: openjdk:11-jre
    stage: scan
    only:
        - development
    before_script:
        - curl -sSO https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
        - unzip pipeline-scan-LATEST.zip
    script:
        - java -jar pipeline-scan.jar -vid ${VERACODE_API_ID} -vkey ${VERACODE_API_KEY} --file target/verademo.war
    artifacts:
        paths:
            - results.json
    allow_failure: true
    
release-upload-for-sast:
    image: openjdk:11-jre
    stage: scan
    only:
        - release
    before_script:
        - wget -q -O VeracodeJavaAPI.jar https://repo1.maven.org/maven2/com/veracode/vosp/api/wrappers/vosp-api-wrappers-java/${VERACODE_WRAPPER_VERSION}/vosp-api-wrappers-java-${VERACODE_WRAPPER_VERSION}.jar
    script:
        - java -jar VeracodeJavaAPI.jar -vid ${TEAM_ANALYSISCENTER_ID} -vkey ${TEAM_ANALYSISCENTER_KEY}
          -action UploadAndScan -appname "Verademo" -createprofile true -autoscan true -sandboxname "gitlab-release"
          -filepath ./target/verademo.war -version "Job ${CI_JOB_ID} in pipeline ${CI_PIPELINE_ID}"
    allow_failure: true
    
policy-upload-for-sast:
    image: openjdk:11-jre
    stage: scan
    only:
        - schedules
        - master
    before_script:
            - wget -q -O VeracodeJavaAPI.jar https://repo1.maven.org/maven2/com/veracode/vosp/api/wrappers/vosp-api-wrappers-java/${VERACODE_WRAPPER_VERSION}/vosp-api-wrappers-java-${VERACODE_WRAPPER_VERSION}.jar
    script:
        - java -jar VeracodeJavaAPI.jar -vid ${TEAM_ANALYSISCENTER_ID} -vkey ${TEAM_ANALYSISCENTER_KEY}
          -action UploadAndScan -appname "Verademo" -createprofile true -autoscan true
          -filepath ./target/verademo.war -version "Job ${CI_JOB_ID} in pipeline ${CI_PIPELINE_ID}"
          -scantimeout 15