Initial commit
This commit is contained in:
Zhongwei Li
@@ -0,0 +1,310 @@
|
||||
// Jenkins Declarative Pipeline for Black Duck SCA Scanning
|
||||
//
|
||||
// Prerequisites:
|
||||
// 1. Install "Synopsys Detect" plugin in Jenkins
|
||||
// 2. Configure Black Duck server in Jenkins Global Configuration
|
||||
// 3. Add credentials: BLACKDUCK_URL and BLACKDUCK_API_TOKEN
|
||||
|
||||
pipeline {
|
||||
agent any
|
||||
|
||||
parameters {
|
||||
choice(
|
||||
name: 'SCAN_TYPE',
|
||||
choices: ['RAPID', 'INTELLIGENT', 'FULL'],
|
||||
description: 'Type of Black Duck scan to perform'
|
||||
)
|
||||
booleanParam(
|
||||
name: 'FAIL_ON_POLICY_VIOLATION',
|
||||
defaultValue: true,
|
||||
description: 'Fail build on policy violations'
|
||||
)
|
||||
booleanParam(
|
||||
name: 'GENERATE_SBOM',
|
||||
defaultValue: false,
|
||||
description: 'Generate Software Bill of Materials'
|
||||
)
|
||||
}
|
||||
|
||||
environment {
|
||||
BLACKDUCK_URL = credentials('blackduck-url')
|
||||
BLACKDUCK_TOKEN = credentials('blackduck-api-token')
|
||||
PROJECT_NAME = "${env.JOB_NAME}"
|
||||
PROJECT_VERSION = "${env.BRANCH_NAME}-${env.BUILD_NUMBER}"
|
||||
DETECT_JAR_DOWNLOAD_DIR = "${WORKSPACE}/.blackduck"
|
||||
}
|
||||
|
||||
options {
|
||||
timestamps()
|
||||
timeout(time: 2, unit: 'HOURS')
|
||||
buildDiscarder(logRotator(numToKeepStr: '30', artifactNumToKeepStr: '10'))
|
||||
}
|
||||
|
||||
stages {
|
||||
stage('Preparation') {
|
||||
steps {
|
||||
script {
|
||||
echo "=========================================="
|
||||
echo "Black Duck SCA Scan"
|
||||
echo "=========================================="
|
||||
echo "Project: ${PROJECT_NAME}"
|
||||
echo "Version: ${PROJECT_VERSION}"
|
||||
echo "Scan Type: ${params.SCAN_TYPE}"
|
||||
echo "=========================================="
|
||||
}
|
||||
|
||||
// Clean previous scan results
|
||||
sh 'rm -rf blackduck-output || true'
|
||||
sh 'mkdir -p blackduck-output'
|
||||
}
|
||||
}
|
||||
|
||||
stage('Dependency Installation') {
|
||||
steps {
|
||||
script {
|
||||
// Install dependencies based on project type
|
||||
if (fileExists('package.json')) {
|
||||
echo 'Node.js project detected'
|
||||
sh 'npm ci || npm install'
|
||||
}
|
||||
else if (fileExists('requirements.txt')) {
|
||||
echo 'Python project detected'
|
||||
sh 'pip install -r requirements.txt'
|
||||
}
|
||||
else if (fileExists('pom.xml')) {
|
||||
echo 'Maven project detected'
|
||||
sh 'mvn dependency:resolve'
|
||||
}
|
||||
else if (fileExists('build.gradle')) {
|
||||
echo 'Gradle project detected'
|
||||
sh './gradlew dependencies'
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
stage('Black Duck Scan') {
|
||||
steps {
|
||||
script {
|
||||
def detectCommand = """
|
||||
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
|
||||
--blackduck.url=${BLACKDUCK_URL} \
|
||||
--blackduck.api.token=${BLACKDUCK_TOKEN} \
|
||||
--detect.project.name="${PROJECT_NAME}" \
|
||||
--detect.project.version.name="${PROJECT_VERSION}" \
|
||||
--detect.output.path=${WORKSPACE}/blackduck-output \
|
||||
--detect.cleanup=false \
|
||||
--detect.risk.report.pdf=true \
|
||||
--detect.notices.report=true
|
||||
"""
|
||||
|
||||
// Add scan type configuration
|
||||
switch(params.SCAN_TYPE) {
|
||||
case 'RAPID':
|
||||
detectCommand += " --detect.detector.search.depth=0"
|
||||
detectCommand += " --detect.blackduck.signature.scanner.snippet.matching=SNIPPET_MATCHING"
|
||||
break
|
||||
case 'INTELLIGENT':
|
||||
detectCommand += " --detect.detector.search.depth=3"
|
||||
break
|
||||
case 'FULL':
|
||||
detectCommand += " --detect.tools=DETECTOR,SIGNATURE_SCAN,BINARY_SCAN"
|
||||
detectCommand += " --detect.detector.search.depth=10"
|
||||
break
|
||||
}
|
||||
|
||||
// Add policy check if enabled
|
||||
if (params.FAIL_ON_POLICY_VIOLATION) {
|
||||
detectCommand += " --detect.policy.check.fail.on.severities=BLOCKER,CRITICAL"
|
||||
detectCommand += " --detect.wait.for.results=true"
|
||||
}
|
||||
|
||||
// Execute scan
|
||||
try {
|
||||
sh detectCommand
|
||||
} catch (Exception e) {
|
||||
if (params.FAIL_ON_POLICY_VIOLATION) {
|
||||
error("Black Duck policy violations detected!")
|
||||
} else {
|
||||
unstable("Black Duck scan completed with violations")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
stage('Generate SBOM') {
|
||||
when {
|
||||
expression { params.GENERATE_SBOM == true }
|
||||
}
|
||||
steps {
|
||||
script {
|
||||
sh """
|
||||
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
|
||||
--blackduck.url=${BLACKDUCK_URL} \
|
||||
--blackduck.api.token=${BLACKDUCK_TOKEN} \
|
||||
--detect.project.name="${PROJECT_NAME}" \
|
||||
--detect.project.version.name="${PROJECT_VERSION}" \
|
||||
--detect.tools=DETECTOR \
|
||||
--detect.bom.aggregate.name=sbom-cyclonedx.json \
|
||||
--detect.output.path=${WORKSPACE}/sbom-output
|
||||
"""
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
stage('Parse Results') {
|
||||
steps {
|
||||
script {
|
||||
// Parse Black Duck results
|
||||
def statusFile = sh(
|
||||
script: 'find blackduck-output -name "status.json" -type f | head -n 1',
|
||||
returnStdout: true
|
||||
).trim()
|
||||
|
||||
if (statusFile) {
|
||||
def status = readJSON file: statusFile
|
||||
echo "Policy Status: ${status.policyStatus?.overallStatus}"
|
||||
echo "Component Count: ${status.componentStatus?.componentCount}"
|
||||
|
||||
// Set build description
|
||||
currentBuild.description = """
|
||||
Black Duck Scan Results
|
||||
Policy: ${status.policyStatus?.overallStatus}
|
||||
Components: ${status.componentStatus?.componentCount}
|
||||
""".stripIndent()
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
stage('Publish Reports') {
|
||||
steps {
|
||||
// Archive reports
|
||||
archiveArtifacts(
|
||||
artifacts: 'blackduck-output/**/BlackDuck_RiskReport_*.pdf,blackduck-output/**/BlackDuck_Notices_*.txt',
|
||||
allowEmptyArchive: true,
|
||||
fingerprint: true
|
||||
)
|
||||
|
||||
// Archive SBOM if generated
|
||||
archiveArtifacts(
|
||||
artifacts: 'sbom-output/**/sbom-cyclonedx.json',
|
||||
allowEmptyArchive: true,
|
||||
fingerprint: true
|
||||
)
|
||||
|
||||
// Publish HTML reports
|
||||
publishHTML([
|
||||
allowMissing: true,
|
||||
alwaysLinkToLastBuild: true,
|
||||
keepAll: true,
|
||||
reportDir: 'blackduck-output',
|
||||
reportFiles: '**/*.html',
|
||||
reportName: 'Black Duck Security Report'
|
||||
])
|
||||
}
|
||||
}
|
||||
|
||||
stage('Quality Gate') {
|
||||
when {
|
||||
expression { params.FAIL_ON_POLICY_VIOLATION == true }
|
||||
}
|
||||
steps {
|
||||
script {
|
||||
// Check for policy violations
|
||||
def statusFile = sh(
|
||||
script: 'find blackduck-output -name "status.json" -type f | head -n 1',
|
||||
returnStdout: true
|
||||
).trim()
|
||||
|
||||
if (statusFile) {
|
||||
def status = readJSON file: statusFile
|
||||
|
||||
if (status.policyStatus?.overallStatus == 'IN_VIOLATION') {
|
||||
error("Build failed: Black Duck policy violations detected")
|
||||
} else {
|
||||
echo "✅ No policy violations detected"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
post {
|
||||
always {
|
||||
// Clean up workspace
|
||||
cleanWs(
|
||||
deleteDirs: true,
|
||||
patterns: [
|
||||
[pattern: '.blackduck', type: 'INCLUDE'],
|
||||
[pattern: 'blackduck-output/runs', type: 'INCLUDE']
|
||||
]
|
||||
)
|
||||
}
|
||||
|
||||
success {
|
||||
echo '✅ Black Duck scan completed successfully'
|
||||
|
||||
// Send notification (configure as needed)
|
||||
// emailext(
|
||||
// subject: "Black Duck Scan Success: ${PROJECT_NAME}",
|
||||
// body: "Black Duck scan completed with no policy violations",
|
||||
// to: "${env.CHANGE_AUTHOR_EMAIL}"
|
||||
// )
|
||||
}
|
||||
|
||||
failure {
|
||||
echo '❌ Black Duck scan failed or policy violations detected'
|
||||
|
||||
// Send notification
|
||||
// emailext(
|
||||
// subject: "Black Duck Scan Failed: ${PROJECT_NAME}",
|
||||
// body: "Black Duck scan detected policy violations. Review the report for details.",
|
||||
// to: "${env.CHANGE_AUTHOR_EMAIL}"
|
||||
// )
|
||||
}
|
||||
|
||||
unstable {
|
||||
echo '⚠️ Black Duck scan completed with warnings'
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Shared library functions (optional)
|
||||
|
||||
def getProjectType() {
|
||||
if (fileExists('package.json')) return 'nodejs'
|
||||
if (fileExists('requirements.txt')) return 'python'
|
||||
if (fileExists('pom.xml')) return 'maven'
|
||||
if (fileExists('build.gradle')) return 'gradle'
|
||||
if (fileExists('Gemfile')) return 'ruby'
|
||||
if (fileExists('go.mod')) return 'golang'
|
||||
return 'unknown'
|
||||
}
|
||||
|
||||
def installDependencies(projectType) {
|
||||
switch(projectType) {
|
||||
case 'nodejs':
|
||||
sh 'npm ci || npm install'
|
||||
break
|
||||
case 'python':
|
||||
sh 'pip install -r requirements.txt'
|
||||
break
|
||||
case 'maven':
|
||||
sh 'mvn dependency:resolve'
|
||||
break
|
||||
case 'gradle':
|
||||
sh './gradlew dependencies'
|
||||
break
|
||||
case 'ruby':
|
||||
sh 'bundle install'
|
||||
break
|
||||
case 'golang':
|
||||
sh 'go mod download'
|
||||
break
|
||||
default:
|
||||
echo "Unknown project type, skipping dependency installation"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user