Try different wildcard for include alfresco files option

.github/workflows/ci.yml

@@ -106,16 +106,12 @@ jobs:
         run: |
           bash ./scripts/ci/init.sh
           bash ./scripts/ci/build.sh
-      - name: "Remove excluded files"
-        run: |
-          mkdir temp-dir-for-sast
-          bash ./scripts/ci/remove-sast-exclusions.sh ./packaging/war/target/alfresco.war temp-dir-for-sast/reduced.war
       - name: "Run SAST Scan"
-        uses: veracode/Veracode-pipeline-scan-action@v1.0.16
+        uses: veracode/Veracode-pipeline-scan-action@v1.0.17
         with:
           vid: ${{ secrets.VERACODE_API_ID }}
           vkey: ${{ secrets.VERACODE_API_KEY }}
-          file: "temp-dir-for-sast/reduced.war"
+          file: "packaging/war/target/alfresco.war"
           fail_build: true
           project_name: alfresco-community-repo
           issue_details: true
@@ -124,6 +120,7 @@ jobs:
           summary_output_file: results.json
           summary_display: true
           baseline_file: baseline.json
+          include: alfresco-*
       - name: Upload scan result
         if: success() || failure()
         run: zip readable_output.zip results.json
@@ -133,8 +130,6 @@ jobs:
         with:
           name: Veracode Pipeline-Scan Results (Human Readable)
           path: readable_output.zip
-      - name: "Remove temporary directory"
-        run: rm -rfv temp-dir-for-sast
       - name: "Clean Maven cache"
         run: bash ./scripts/ci/cleanup_cache.sh
 

.secrets.baseline

@@ -133,21 +133,21 @@
         "filename": ".github/workflows/ci.yml",
         "hashed_secret": "b86dc2f033a63f2b7b9e7d270ab806d2910d7572",
         "is_verified": false,
-        "line_number": 299
+        "line_number": 294
       },
       {
         "type": "Secret Keyword",
         "filename": ".github/workflows/ci.yml",
         "hashed_secret": "1bfb0e20f886150ba59b853bcd49dea893e00966",
         "is_verified": false,
-        "line_number": 374
+        "line_number": 369
       },
       {
         "type": "Secret Keyword",
         "filename": ".github/workflows/ci.yml",
         "hashed_secret": "128f14373ccfaff49e3664045d3a11b50cbb7b39",
         "is_verified": false,
-        "line_number": 908
+        "line_number": 903
       }
     ],
     ".github/workflows/master_release.yml": [
@@ -1888,5 +1888,5 @@
       }
     ]
   },
-  "generated_at": "2024-12-19T08:58:42Z"
+  "generated_at": "2025-01-10T00:30:49Z"
 }

pom.xml

@@ -58,7 +58,7 @@
 
         <dependency.aspectj.version>1.9.22.1</dependency.aspectj.version>
         <dependency.spring.version>6.1.14</dependency.spring.version>
-        <dependency.spring-security.version>6.3.4</dependency.spring-security.version>
+        <dependency.spring-security.version>6.4.1</dependency.spring-security.version>
         <dependency.antlr.version>3.5.3</dependency.antlr.version>
         <dependency.jackson.version>2.17.2</dependency.jackson.version>
         <dependency.cxf.version>4.0.5</dependency.cxf.version>

scripts/ci/SAST-exclusion-list.txt

@@ -1 +0,0 @@
-spring-security*

scripts/ci/remove-sast-exclusions.sh

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-echo "=========================== Excluding Files from Veracode SAST ==========================="
-set -ex
-pushd "$(dirname "${BASH_SOURCE[0]}")/../../"
-
-# Copy war file to temporary directory
-cp -f "$1" "$2"
-
-# Remove files to be excluded from Veracode SAST
-exclusions="./scripts/ci/SAST-exclusion-list.txt"
-if [ -e $exclusions ]
-then
-    while read -r line
-    do
-      echo "Removing WEB-INF/lib/$line"
-      zip -d "$2" "WEB-INF/lib/$line" || true
-    done < "$exclusions"
-else
-    echo "No files to be excluded from SAST"
-fi
-
-popd
-set +ex
-echo "=========================== Finishing Excluding Files from Veracode SAST =========================="