Azure Pipeline中Ionic项目Veracode扫描路径无效问题求助

我首次使用Veracode，想通过Azure Pipeline扫描Ionic Capacitor项目，但配置azure-pipeline.yml后执行时提示「Build artifact file path is not valid」。请问是否需要指定特定扫描目录，或是要打包整个项目上传？该如何修复？

项目结构 #

当前Azure Pipeline配置 #

# Starter pipeline
# Start with a minimal pipeline that you can customize to build and deploy your code.
# Add steps that build, run tests, deploy, and more:
# https://aka.ms/yaml

trigger:
- develop

pool:
  vmImage: macOS-latest

steps:

- script: npm install
  displayName: 'Install dependencies'
  workingDirectory: $(pluginDir)
  
- script: |
    # Add any necessary setup steps for running iOS tests (e.g., installing dependencies, setting up simulators)
    brew install cocoapods
    cd $(pluginDir)/ios
    pod install
  displayName: 'Setup for iOS tests'
  
- task: JavaToolInstaller@0
  inputs:
    versionSpec: '17'
    jdkArchitectureOption: 'x64'
    jdkSourceOption: 'PreInstalled'
  
- task: Gradle@3
  inputs:
    gradleWrapperFile: '$(pluginDir)/android/gradlew'
    workingDirectory: '$(pluginDir)/android'
    tasks: 'test'
    publishJUnitResults: false
    javaHomeOption: 'JDKVersion'
    sonarQubeRunAnalysis: false
    spotBugsAnalysis: false

- task: Xcode@5
  inputs:
    actions: 'test'
    configuration: 'Debug'
    sdk: 'iphonesimulator'
    xcWorkspacePath: '$(pluginDir)/ios/Plugin.xcworkspace'
    scheme: 'PluginTests'
    packageApp: false
    destinationPlatformOption: 'iOS'
    destinationSimulators: 'iPhone 14'

- task: Veracode@3
  displayName: 'Upload dist to Veracode'
  inputs:
    ConnectionDetailsSelection: 'Service Connection'
    AnalysisService: 'Vera***'
    veracodeAppProfile: 'K2 Mobile Component Media'
    version: '$(Build.BuildNumber)'
    filepath: '$(Build.SourcesDirectory)/$(pluginDir)/dist'
    maximumWaitTime: '360'
  condition: ne(variables['Build.Reason'], 'PullRequest')


- task: Npm@1
  inputs:
    command: 'publish'
    workingDir: '$(pluginDir)'
    publishRegistry: 'useFeed'
    publishFeed: '694ea4fc-*************'

- task: UniversalPackages@0
  inputs:
    command: 'publish'
    publishDirectory: '$(Build.SourcesDirectory)/$(docsDir)'
    feedsToUsePublish: 'internal'
    vstsFeedPublish: '694ea4fc-*************'
    vstsFeedPackagePublish: '$(docsDir)'
    versionOption: 'patch'

错误日志 #

Accessing Service Connection
Getting Service Connection URL
Getting Auth Service Connection
Auth Scheme :Token
filepath: /Users/runner/work/1/s/k2-mobile-component-media-plugin/dist
veracodeAppProfile: K2 Mobile Component Media
createProfile: false
failBuildIfUploadAndScanBuildStepFails: false
failBuildOnPolicyFail: false
importResults: false
version: 20240806.4
sandboxName: undefined
createSandBox: false
MaximumWaitTime: 360
Autoscan: true
isDebugEnabled: false
Autoscan: true
/Users/runner/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.12-7/x64/Contents/Home/bin/java -version
openjdk version "17.0.12" 2024-07-16
OpenJDK Runtime Environment Temurin-17.0.12+7 (build 17.0.12+7)
OpenJDK 64-Bit Server VM Temurin-17.0.12+7 (build 17.0.12+7, mixed mode)
Veracode upload & scan task started
Build artifact file path is not valid
Ensure the path to the application artifact or to the folder that contains artifacts for upload is valid.
Finishing: Upload dist to Veracode

问题原因及修复步骤 #

1. 核心问题 #

从日志看，Veracode找不到指定的dist目录——要么目录根本没生成，要么目录里没有Veracode能识别的扫描产物。Veracode不直接扫描源码，必须上传编译/打包后的产物。

2. 针对Ionic Capacitor项目的修复方案 #

根据项目类型选择对应方案：

方案一：扫描Android编译产物（APK/AAB）

• 先在Gradle任务后添加构建Release版本APK的步骤：

- task: Gradle@3
  inputs:
    gradleWrapperFile: '$(pluginDir)/android/gradlew'
    workingDirectory: '$(pluginDir)/android'
    tasks: 'assembleRelease' # 构建Release包
    publishJUnitResults: false
    javaHomeOption: 'JDKVersion'

• 修改Veracode任务的filepath指向APK的生成路径：

filepath: '$(pluginDir)/android/app/build/outputs/apk/release/app-release.apk'

方案二：扫描iOS编译产物（IPA）

• 修改Xcode任务，改为构建Release版本并生成IPA：

- task: Xcode@5
  inputs:
    actions: 'build'
    configuration: 'Release'
    sdk: 'iphoneos'
    xcWorkspacePath: '$(pluginDir)/ios/Plugin.xcworkspace'
    scheme: 'Plugin' # 替换为主应用的scheme，不是测试scheme
    packageApp: true
    archivePath: '$(Build.ArtifactStagingDirectory)/ios_archive'
    exportPath: '$(Build.ArtifactStagingDirectory)/ios_export'
    exportOptions: 'plist'
    exportOptionsPlist: '$(pluginDir)/ios/ExportOptions.plist' # 需提前准备导出配置文件

• 调整Veracode的filepath指向生成的IPA：

filepath: '$(Build.ArtifactStagingDirectory)/ios_export/*.ipa'

方案三：扫描前端Web组件打包产物

如果你的插件是纯前端组件，先执行打包命令生成dist目录：

- script: npm run build
  displayName: 'Build web component'
  workingDirectory: $(pluginDir)

• 确保npm run build能正确生成$(pluginDir)/dist，再保留Veracode的路径配置即可。

3. 额外验证步骤 #

在Veracode任务前加一个脚本，确认目标路径存在：

- script: |
    ls -la $(Build.SourcesDirectory)/$(pluginDir)/dist
    echo "当前工作目录: $(pwd)"
  displayName: '检查dist目录是否存在'
  condition: ne(variables['Build.Reason'], 'PullRequest')

内容的提问来源于stack exchange，提问作者BLB