--- sourceDocument: Australia IT Service Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-service-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Service Management ft:clusterId : - itsm bundleId : - itsm workflow : - Technology --- # Configure Veracode scans on your pipeline # Configure Veracode scans on your pipeline {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Configure Veracode scans on your pipeline This guide explains how to configure Veracode security scans within various CI/CD pipelines including Azure DevOps, Jenkins, GitHub Actions, GitLab, and Harness. Integrating Veracode scans into your pipeline enables automated retrieval and reporting of security scan results into ServiceNow DevOps Change Velocity, enhancing visibility and governance over application security. Show full answer Show less ## Key Configuration Details * **Pipeline Stage Integration:** Veracode scans can be configured at any pipeline stage where scanning is required. The scan results are automatically retrieved and associated with that stage in ServiceNow. * **Custom Action Code:** For Azure DevOps and GitHub Actions, you must add a custom action code snippet to your pipeline to enable scan result integration. * **Jenkins:** If Jenkins pipelines already include a Veracode scan step, ensure the parameter `waitForScan: true` is set to allow result retrieval. No additional custom action code is needed. * **GitLab:** Use a generic Docker container image to add the Veracode scan step or follow the ServiceNow integration guidelines for GitLab security tools. * **Harness:** Configure Veracode scans exclusively via the generic Docker container image custom action. ## Pipeline-Specific Implementation * **Azure DevOps:** Add the ServiceNow DevOps Security Results extension task to your pipeline YAML. Provide required attributes including `scanner` (set to "Veracode"), `applicationName`, optional `buildVersion`, and optional `securityToolId` referencing the onboarded ServiceNow security tool. * **Jenkins:** Use the Pipeline Syntax generator to add the `snDevOpsSecurityResult` step with the necessary Veracode scan attributes. Copy the generated snippet into your Jenkinsfile. * **GitHub Actions:** Include the ServiceNow DevOps Security Results custom action from the GitHub Marketplace in your workflow YAML. Configure authentication secrets and provide Veracode scan attributes similarly. * **Harness:** Run a custom action using the provided Docker image `servicenowdocker/sndevops:5.0.0` with a shell command invoking `sndevopscli create securityScan`. Pass pipeline and scan metadata in JSON format along with environment variables for ServiceNow connectivity. ## Key Outcomes * Automated ingestion of Veracode scan results into ServiceNow DevOps Change Velocity, providing centralized security insights linked to pipeline executions. * Improved governance and traceability of application security scans across multiple CI/CD platforms. * Flexible integration options tailored to your existing DevOps tools and pipeline configurations. Configure Veracode scans on your Azure DevOps, Jenkins, GitHub, GitLab, or Harness pipelines. You can configure Veracode scans on any stage of the pipeline and the scan details are retrieved from the corresponding stage to DevOps Change Velocity. If you are using Azure DevOps or GitHub Actions orchestration tools then you need to add the custom action code in your pipeline always. If you are using Jenkins, and your pipeline already has a Veracode security scan step, you do not have to add the custom action code in your pipeline. Ensure that your Veracode security scan step has waitForScan: true. This is required for the system to retrieve the scan information. If you want to configure Veracode for the GitLab tool, you can use the generic Docker container image to add the Veracode security step or perform the steps specified in the [Integrate security tools with GitLab](https://www.servicenow.com/docs/_Ei_m2ZDQ12JaIrx4Nm5eQ "Configure security tool for GitLab which is not supported in the base system.") topic. For Harness pipelines, you can configure Veracode scans only through the generic Docker Container Image. For more information, see [Implement custom actions for pipelines using Docker image](https://www.servicenow.com/docs/lyDd5Y1L9yyAuDzJFwe0tg "Use the ServiceNow custom actions to collect data related to change request creation, Sonar scan, artifact registration, and package registration in your pipeline with the help of the generic Docker Container Image."). 1. Navigate to the step in your pipeline and add the custom action. |-|-| | Azure DevOps | 1. Navigate to your pipeline .yml file. 2. In the Tasks section on the right side, search for the ServiceNow DevOps Security Results extension task. 3. Enter the ServiceNow endpoint. 4. Enter the Security results attributes as the following. { "scanner": "Veracode", "applicationName": "", "buildVersion": "", "securityToolId": "" } // scanner: Scanning tool and is required e.g. Veracode. // applicationName: Name of your Veracode application and is required. This attribute is applicable only for Veracode. // buildVersion: Veracode Scan name / build version and is optional. This attribute is applicable only for Veracode. // securityToolId: Security tool onboarded in ServiceNow (sys_id of the onboarded security tool) and is optional. 5. Select Add to add the custom action code to your pipeline. {#configure-veracode-scans-on-your-pipeline__ol_lrx_bxl_1yb} | | Jenkins | 1. Navigate to the Pipeline Syntax from a configured pipeline. 2. Select the snDevOpsSecurityResult step from the Sample Step list, and update the values for the security scan attributes in the step. 3. Select Generate Pipeline Script to create a snippet. You can copy and paste the snippet into the pipeline. snDevOpsSecurityResult { securityResultAttributes:{"scanner":"Veracode", "applicationName": "", "buildVersion": "", "securityToolId": ""}} // scanner: Scanning tool and is required e.g. Veracode. // applicationName: Name of your Veracode application and is required. This attribute is applicable only for Veracode. // buildVersion: Veracode Scan name / build version and is optional. This attribute is applicable only for Veracode. // securityToolId: Security tool onboarded in ServiceNow (sys_id of the onboarded security tool) and is optional. {#configure-veracode-scans-on-your-pipeline__ol_kcw_mxl_1yb} | | GitHub Actions | 1. Navigate to your workflow .yml file. 2. In the Marketplace section on the right side, search for the ServiceNow DevOps Security Results custom action. 3. Add the following snippet into your .yml file. SecurityScanResults: needs: build runs-on: ubuntu-latest name: Servicenow Security Scan Results steps: - name: ServiceNow DevOps Security Results uses: ServiceNow/servicenow-devops-security-result@v1.39.0 with: devops-integration-user-name: ${{ secrets.SN_DEVOPS_USER }} devops-integration-user-password: ${{ secrets.SN_DEVOPS_PASSWORD }} instance-url: ${{ secrets.SN_INSTANCE_URL }} tool-id: ${{ secrets.SN_ORCHESTRATION_TOOL_ID }} context-github: ${{ toJSON(github) }} job-name: 'Servicenow Security Scan Results' security-result-attributes: '{ "scanner": "Veracode", "applicationName": "", "buildVersion": "", "securityToolId": ""} // scanner: Scanning tool and is required e.g. Veracode. // applicationName: Name of your Veracode application and is required. This attribute is applicable only for Veracode. // buildVersion: Veracode Scan name / build version and is optional. This attribute is applicable only for Veracode. // securityToolId: Security tool onboarded in ServiceNow (sys_id of the onboarded security tool) and is optional. {#configure-veracode-scans-on-your-pipeline__ol_qhn_ynn_dyb}For more information, see [GitHub marketplace](https://github.com/ServiceNow/servicenow-devops-security-result). | | Harness | Run the generic Docker Container Image to use the following script. For more information, see [Implement custom actions for pipelines using Docker image](https://www.servicenow.com/docs/lyDd5Y1L9yyAuDzJFwe0tg "Use the ServiceNow custom actions to collect data related to change request creation, Sonar scan, artifact registration, and package registration in your pipeline with the help of the generic Docker Container Image."). - stage: name: ServiceNow DevOps Security Result identifier: Security description: "" type: Custom spec: execution: steps: - stepGroup: name: Security identifier: Security steps: - step: type: Run name: ServiceNow DevOps Security Result identifier: ServiceNow_DevOps_Security_Result spec: connectorRef: docker_hub_connector_for_harness image: servicenowdocker/sndevops:5.0.0 shell: Sh command: |- sndevopscli create securityScan -p "{"pipelineInfo":{ "buildNumber":"<+stage.nodeExecutionId>", "taskExecutionUrl":"<+pipeline.executionUrl>?stage=<+stage.nodeExecutionId>", "orchestrationPipeline":"<+org.identifier>/<+project.identifier>/<+pipeline.name>" }, "securityResultAttributes":{ "scanner":"Veracode", "applicationName":"", "buildVersion":"", "securityToolId":"" } }" envVariables: SNOW_URL: <+variable.SNOW_URL> SNOW_TOOLID: <+variable.SNOW_TOOLID> SNOW_TOKEN: <+variable.SNOW_TOKEN> stepGroupInfra: type: KubernetesDirect spec: connectorRef: kubernates_connector namespace: harness-delegate-ng tags: {} | [ ] {#configure-veracode-scans-on-your-pipeline__choicetable_mt3_1xl_1yb} 2. Run the pipeline to retrieve the security scan results. {#configure-veracode-scans-on-your-pipeline__ol_pvj_bfm_cyb}