action.yml

# action.yml
name: 'Veracode Static Analysis Pipeline Scan and SARIF import'
description: 'Initiate a Veracode Static Analysis Pipeline Scan and convert the results file to a valid SARIF file'
inputs:
  scan-type:
    description: 'The scan type for which a SARIF report needs to be generated can be either a pipeline scan or a policy scan'
    required: true
    default: 'pipeline'
  results-json:
    description: 'The location of the JSON result file for the policy or pipeline'
    required: true
    default: 'filtered_results.json'
  pipeline-results-json:  # id of input
    description: 'location of the pipeline json result file'
    required: true
    default: 'results.json'
  output-results-sarif:  # id of input
    description: 'the path to the SARIF file as an output of the transformation'
    required: true
    default: 'veracode-results.sarif'  
  source-base-path-1:  
    description: 'a path prefix conversion before publish in the SARIF file'
    required: false
    default: ''
  source-base-path-2:  
    description: 'a path prefix conversion before publish in the SARIF file'
    required: false
    default: ''
  source-base-path-3:  
    description: 'a path prefix conversion before publish in the SARIF file'
    required: false
    default: ''
  finding-rule-level:
    description: 'The conversion rule of Veracode findings to GitHub level'
    required: true
    default: '4:3:0'
  repo_owner: 
    description: 'The account owner of the repository. The name is not case sensitive.'
    required: false
  repo_name: 
    description: 'The name of the repository without the .git extension. The name is not case sensitive.'
    required: false
  githubToken: 
    description: 'GitHub token is a secure token that allows the workflow to interact with the GitHub API and perform actions on behalf of the repository or user'
    required: true
    default: ${{ github.token }}
  ref:
    description: 'The full Git reference'
    required: true
    default: ${{ github.ref }}
  commitSHA:
    description: 'The SHA of the commit to which the analysis you are uploading relates.'
    required: true
    default: ${{ github.sha }}
  noupload:
    description: 'Do not upload the SARIF file to the GitHub repository'
    required: false
    default: 'false'
runs:
  using: 'node20'
  main: 'dist/index.js'