Skip to main content

Run an agent-based scan for Gradle

You can use agent-based scanning to scan any code repository to which you have access and fulfills the above requirements. To run an example scan, you can clone one of the public Veracode SCA repositories:

git clone https://github.com/veracode/example-java-gradle

After you add a srcclr.yml file to the directory where you point the Veracode SCA agent, you can specify scan directives for scanning your Gradle code. Some scan directives are specific to Gradle projects.

Before you begin:

  • Meet the requirements for the Veracode SCA agent.
  • Have access to the Gradle repository.
  • Use Gradle version 8 or earlier.
  • Have the Gradle executable installed in your path or include the gradlew wrapper file in the project repository.
  • Include the build.gradle file in the directory where you perform the scan.
  • In ~/.gradle/gradle.properties, ensure you properly set up any Nexus servers or authentications to successfully compile code.
  • Be able to run the gradle dependencies command from the root of the project where you perform the scan.
  • If access to maven.apache.org is restricted, set the SRCCLR_GRADLE_DEP_TREE_COLLECTOR environment variable to true.

The Veracode SCA agent runs a specific command to identify the dependencies and their versions in your project. You can run this command before scanning to test that the agent can build the project:

./gradlew projects classes

To complete this task:

Run the scan command with the Veracode SCA CLI agent pointed to the directory of the Gradle repository. For example:

srcclr scan path/to/{project_folder}

To scan code repositories hosted in Git, use the --url argument with the CLI agent.

To view more verbose output during the scan process, you can add the --loud argument:

srcclr scan path/to/{project_folder} --loud

Results:

The Veracode SCA agent uses the native package managers to identify the dependencies and their versions in your project. When the agent evaluates the open-source libraries in use, it produces a summary of the scan results. This summary includes counts for total libraries used, vulnerable libraries, percentage of third-party code, and a list of the vulnerabilities found.

Next steps:

After completing the scan, you can view the results.

Last updated on