lerer-veracode / veracode-manual-for-github Goto Github PK

Hi !
We're currently users of Veracode, mostly with jenkins, and scanning PRs is really the best of both worlds in my opinion.

I know other scanners are able to only review the diff, not with a deep SAST analysis of course, but they do gain a simple advantage... they prevent introducing the issues in the production branches efficiently.

Now I know that pipeline scan is intended for that, and it may be fairly fast, but the main and only gripe I have is that most of the support is on Github issues, which don't really translate to issues that "don't really exist yet", since they are not merged yet.

In my opinion the comments in PRs should be used, and I maintain https://github.com/security-alert/security-alert for that purpose (using SARIF input, to comment issues in PRs)

If the veracode wrapper could do that out of the box it would be great for compatibility (and not just GH actions)