veracode-config

veracode-config is a JavaScript GitHub Action that helps onboard repositories into the Veracode Workflow integration. It:

• Checks whether an Application Profile exists for the repository.
• Creates one if missing (after performing repository inventory).
• Persists inventory and workflow configuration values in Application Profile custom metadata.
• Exposes reusable workflow outputs for downstream jobs.

What the action inventories

When the profile does not exist (or when refresh_inventory: true), the action inventories:

• Programming languages and their volume by bytes.
• Package managers present in the repository.
• Non-GitHub build definitions (for example Jenkins, GitLab CI, CircleCI, Azure Pipelines).

Inputs

• veracode_api_id (required): Veracode API ID.
• veracode_api_key (required): Veracode API key.
• veracode_api_base_url (optional, default https://api.veracode.com): Veracode API base URL.
• application_name (optional): Profile name, defaults to <owner>/<repo>.
• business_criticality (optional, default MEDIUM): Business criticality used on create.
• business_unit_guid (optional): Business unit GUID used on create.
• policy_guid (optional): Policy GUID used on create.
• team_guids (optional): Comma-separated team GUIDs used on create.
• application_description (optional): Optional profile description used on create.
• inventory_path (optional): Directory to inventory, defaults to GITHUB_WORKSPACE.
• refresh_inventory (optional, default false): Always rerun inventory.
• update_custom_metadata (optional, default true): Update custom metadata values.
• languages_metadata_field (optional, default repo_languages): Metadata field for language inventory JSON.
• package_managers_metadata_field (optional, default repo_package_managers): Metadata field for package managers JSON.
• build_definitions_metadata_field (optional, default repo_build_definitions): Metadata field for non-GitHub build definitions JSON.
• workflow_config_metadata_field (optional, default workflow_config): Metadata field for workflow config JSON.
• custom_metadata_max_length (optional, default 255): Maximum metadata field length before truncation.

Outputs

• application_guid
• application_name
• application_created
• business_criticality
• policy_guid
• primary_language
• languages_by_bytes (JSON)
• package_managers (JSON)
• non_github_build_definitions (JSON)
• workflow_config_json (JSON)
• workflow_config_source (custom_metadata or derived)

Example workflow usage

name: veracode-workflow
on:
  push:
    branches: [main]

jobs:
  configure:
    runs-on: ubuntu-latest
    outputs:
      app_guid: ${{ steps.veracode_config.outputs.application_guid }}
      workflow_config: ${{ steps.veracode_config.outputs.workflow_config_json }}
    steps:
      - uses: actions/checkout@v4

      - name: Configure Veracode onboarding
        id: veracode_config
        uses: your-org/veracode-config@v1
        with:
          veracode_api_id: ${{ secrets.VERACODE_API_ID }}
          veracode_api_key: ${{ secrets.VERACODE_API_KEY }}
          business_criticality: MEDIUM
          # Optional, but often needed by org policy:
          # business_unit_guid: ${{ vars.VERACODE_BUSINESS_UNIT_GUID }}
          # policy_guid: ${{ vars.VERACODE_POLICY_GUID }}
          # team_guids: ${{ vars.VERACODE_TEAM_GUIDS }}

  scan:
    runs-on: ubuntu-latest
    needs: configure
    steps:
      - name: Consume config
        run: |
          echo "App GUID: ${{ needs.configure.outputs.app_guid }}"
          echo '${{ needs.configure.outputs.workflow_config }}'

Notes

• Veracode profile creation requirements can vary by account policy and role. If creation fails, provide any required GUIDs (policy_guid, business_unit_guid, team_guids).
• This action uses Veracode HMAC signing for API authentication.