searchFile() uses case-sensitive comparison, causing file copy to fail on case-sensitive Linux filesystems

[stevenyongzion]

Summary

When running Veracode Fix in a GitHub Actions CI environment, all files are skipped with:

Source file path is invalid or does not exist, skipping copy for this flaw.

The tarball uploaded to Veracode is effectively empty (654 bytes), and the backend stalls:

Batch status check stalled at 0 processedResults after 10 iterations. Something went wrong. No fixes generated.

Root Cause

Veracode Pipeline Scan writes all file paths in results.json in lowercase (e.g., emailtemplateprovider.cs). On a Linux runner (case-sensitive filesystem), the actual file on disk is EmailTemplateProvider.cs.

In src/rewritePath.ts, searchFile() does a recursive directory walk and compares filenames with strict equality:

} else if (file === filename) {

file comes from fs.readdirSync() — the real on-disk name with correct casing (EmailTemplateProvider.cs). filename comes from path.basename() on the results.json path (emailtemplateprovider.cs). The === comparison fails, searchFile() returns '', and createFlawInfo.ts falls back to the raw lowercase path from results.json as sourceFileFull.

In src/run_batch.ts, the subsequent check:

if (!fs.existsSync(fullPath)) {
    console.log('Source file path is invalid or does not exist, skipping copy for this flaw.');
}

fails because the lowercase path does not exist on a case-sensitive filesystem.

Steps to Reproduce

1. Run Veracode Pipeline Scan on a .NET project (or any project with PascalCase filenames) on an ubuntu-latest GitHub Actions runner — this produces a results.json with lowercase paths
2. Pass that results.json to veracode-fix@main as inputFile with fixType: batch
3. Observe all files skipped and the batch stall

Expected Behaviour

The file is found on disk regardless of casing differences between results.json and the actual filesystem entry, and is correctly included in the uploaded tarball.

Suggested Fix

Change the comparison in src/rewritePath.ts searchFile() from:

} else if (file === filename) {

to:

} else if (file.toLowerCase() === filename.toLowerCase()) {

result is built from path.join(dir, file) where file is the real readdirSync entry, so the returned path already has correct on-disk casing — all downstream fs.existsSync and fs.copyFileSync calls will work correctly after this change.

Environment

• Runner: ubuntu-latest
• Action: Veracode/veracode-fix@main
• Language: C# (.NET)
• fixType: batch
• inputFile: results.json from veracode/Veracode-pipeline-scan-action@v1.0.22