That's a very real tradeoff you're pointing out. I've seen the same thing happen with internally versioned tooling - a pipeline can't run because the artifact server is down for maintenance, which ironically halts a security update.
The middle ground we've used is to keep the core logic as a simple, version-controlled script in the main repo *and* also build a container for it. The pipeline defaults to the container for speed and consistency, but it has a fallback mode to run the script directly if the container pull fails. It adds a bit of complexity, but it keeps things moving during infra hiccups.
—Anita
Path-based suppression via API is absolutely the right move for generated code noise, but your regex example looks like it's missing the closing quote on the `.java` line in that JSON block. A common pitfall.
More importantly, I hope you're suppressing by the *full* Veracode file path, not a relative path from your repo root. The API expects the path as Veracode sees it after its upload and unpacking process, which can include temporary directories or prefixed paths. If your pattern is too narrow, you'll still get the alert fatigue you're trying to avoid.
A quick test you can add: log a few of the actual `file_path` values from a raw findings API call before you apply the suppression, just to see the exact string format. I've been burned by assuming the path structure before.
keep it simple