Update SSC pipeline to use "fcli action run ci"#55
Conversation
kadraman
changed the title
There was a problem hiding this comment.
Pull request overview
This PR modernizes the Azure DevOps pipeline for Fortify ScanCentral SAST by migrating from manual fcli command execution to a higher-level action-based approach using fcli action run ci. The update replaces the Docker container-based setup with dynamic tool installation via @fortify/setup and simplifies the scanning workflow.
Changes:
- Replaced manual fcli session management and scan commands with
fcli action run cicommand - Updated environment variables from FCLI_DEFAULT_* pattern to simplified SSC_*, SC_SAST_TOKEN, and feature-specific variables
- Introduced
@fortify/setupfor dynamic installation of fcli and sc-client tools instead of using pre-built Docker container - Added comprehensive DO_* flags for controlling scan behavior (setup, wait, summary, policy check, job summary, PR comment, export)
- Commented out the old implementation for reference
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
devops-integrations/azure/azure-pipelines-fortify-sast-scancentral.yml
Outdated
Show resolved
Hide resolved
devops-integrations/azure/azure-pipelines-fortify-sast-scancentral.yml
Outdated
Show resolved
Hide resolved
devops-integrations/azure/azure-pipelines-fortify-sast-scancentral.yml
Outdated
Show resolved
Hide resolved
devops-integrations/azure/azure-pipelines-fortify-sast-scancentral.yml
Outdated
Show resolved
Hide resolved
devops-integrations/azure/azure-pipelines-fortify-sast-scancentral.yml
Outdated
Show resolved
Hide resolved
devops-integrations/azure/azure-pipelines-fortify-sast-scancentral.yml
Outdated
Show resolved
Hide resolved
devops-integrations/azure/azure-pipelines-fortify-sast-scancentral.yml
Outdated
Show resolved
Hide resolved
devops-integrations/azure/azure-pipelines-fortify-sast-scancentral.yml
Outdated
Show resolved
Hide resolved
devops-integrations/azure/azure-pipelines-fortify-sast-scancentral.yml
Outdated
Show resolved
Hide resolved
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Fortify vulnerability summary
Any issues listed below are based on comparing the latest scan results against the previous scan results in FoD release fortify/IWA-Java - azure-pipelines-ssc-update. This is for informational purposes only and, depending on workflow, may not be an accurate representation of what issues will be introduced into or removed from the target branch when merging this PR.
New Issues
- No new or re-introduced issues were detected
Removed Issues
- Fix Validated (Static) - XML External Entity Injection:
src/main/java/com/microfocus/example/web/controllers/UserController.java:587
There was a problem hiding this comment.
Fortify vulnerability summary
Any issues listed below are based on comparing the latest scan results against the previous scan results in FoD release fortify/IWA-Java - azure-pipelines-ssc-update. This is for informational purposes only and, depending on workflow, may not be an accurate representation of what issues will be introduced into or removed from the target branch when merging this PR.
New Issues
- No new or re-introduced issues were detected
Removed Issues
- Fix Validated (Static) - XML External Entity Injection:
src/main/java/com/microfocus/example/web/controllers/UserController.java:587
No description provided.