Integrated CI security scanning

Use CloudBees platform’s security scanning features to maintain the security and integrity of your software assets. Configure your Jenkinsfile to run a security scan with a variety of popular tool types, including software composition analysis (SCA), static application security testing (SAST), and secret scanning. You can also set up automatic, implicit analysis of your integrated CI pipeline source code, ensuring that your software is continually assessed for vulnerabilities and risks.

Prerequisites

Set up CloudBees platform and your CI controller to work together. For more information, including technical requirements and limitations, refer to Getting started.

Set up security scanning on your Multibranch Pipeline

Set up your Jenkinsfile to install scanning tools, run scans, and publish security scan reports for ingestion to CloudBees platform, to leverage its enhanced analytics.

To enable security scan reports from your CI build to CloudBees platform:

Complete the five steps in CloudBees CI / Jenkins® and CloudBees platform: Getting started.
Add install, run, and publish steps to your Jenkinsfile.

Table 1. Available scanning tools in CloudBees platform.
Scanning tool	Type
Black Duck	SCA
Checkov	SAST
CodeQL	SAST
findsecbugs	SAST
Gitleaks	Secrets
Gosec	SAST
Grype	SAST
njsscanner	SAST
Snyk	SAST
Trivy	Container

Configure your Jenkinsfile to install, run, and publish scans

In your Jenkinsfile, execute a shell command with sh containing the CLI command for the selected security tool.

The output report must be archived as SARIF (Static Analysis Results Interchange Format), an OASIS Standard format. SARIF is a widely accepted standard used for sharing results from static analysis tools, especially in CI/CD environments.

Usage examples

Use the following examples as a guide to set up your security scans.

Jenkinsfile example that uses the Black Duck scanner.

Add the following steps to your Jenkinsfile to install, run, and publish the results of a Black Duck scan to CloudBees platform.

pipeline {
    agent any

    environment {
        BRIDGE_CLI_DIR = "${WORKSPACE}/bridge-cli"
        BD_PROJECT_NAME = "my-blackduck-project"
        BD_VERSION_NAME = "1.0.0"
        GO_VERSION="1.21.2"
        BD_URL = credentials('BLACKDUCK_URL')
        BD_TOKEN = credentials('BLACKDUCK_API_TOKEN')
    }

    stages {
        stage('Download and Extract Bridge CLI') { (1)
            steps {
                sh '''
                    mkdir -p "$BRIDGE_CLI_DIR"

                    # Download with error check
                    curl -f -L "https://repo.blackduck.com/bds-integrations-release/com/blackduck/integration/bridge/binaries/bridge-cli-bundle/latest/bridge-cli-bundle-linux64.zip" \
                        -o bridge.zip

                    # Extract with jar (no unzip needed)
                    (cd "$BRIDGE_CLI_DIR" && jar -xf ../bridge.zip)

                    # check if the binary exists
                    ls -lrt ${BRIDGE_CLI_DIR}
                    chmod +x "$BRIDGE_CLI_DIR"/bridge-cli-bundle-linux64/bridge-cli

                    # Verify
                    "$BRIDGE_CLI_DIR/bridge-cli-bundle-linux64/bridge-cli" --version
                '''
            }
        }

        stage('Prepare Bridge CLI') {
            steps {
                sh '''
                    chmod -R +x bridge-cli/bridge-cli-bundle-linux64/adapters
                '''
            }
        }


        stage('Run Black Duck Bridge CLI with SARIF Output') { (2)
            steps {
                sh """

                    curl -LO https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz
                    rm -rf /tmp/go
                    tar -C /tmp -xzf go${GO_VERSION}.linux-amd64.tar.gz
                    export PATH=/tmp/go/bin:$PATH

                    "${BRIDGE_CLI_DIR}/bridge-cli-bundle-linux64/bridge-cli" \
                        --stage blackducksca \
                        blackducksca.url="https://blackduck.example.com/" \
                        blackducksca.scan.full=true \
                        blackducksca.token="${BD_TOKEN}" \
                        blackducksca_reports_sarif_create=true \
                        blackducksca_reports_sarif_file_path="output/blackduck-sarif-report.sarif" \
                        blackducksca_reports_sarif_groupSCAIssues=false
                """
            }
        }

        stage('Check the SARIF Report') { (3)
            steps {
                sh '''
                    echo "Checking SARIF report..."
                    ls -l output/*.sarif
                    cat output/*.sarif
                '''
            }
        }

        stage('Archive SARIF Report') {
            steps {
                archiveArtifacts artifacts: 'output/*.sarif', fingerprint: true
            }
        }
    }
}▼

1	Download and extract Bridge CLI. Use Black Duck Bridge, not Black Duck Detect, for scanning.
2	Run the scan with SARIF output. The shell command should be formed as above. You must include `blackducksca_reports_sarif_groupSCAIssues=false`.
3	Check the SARIF report.

Jenkinsfile example that uses the Checkov scanner.

Add the following steps to your Jenkinsfile to install, run, and publish the results of a Checkov scan to CloudBees platform.

pipeline {
    agent any

    environment {
        PYTHON_URL = "https://github.com/indygreg/python-build-standalone/releases/download/20240107/cpython-3.11.7+20240107-x86_64-unknown-linux-gnu-install_only.tar.gz"
        PYTHON_DIR = "${env.WORKSPACE}/python"
        VENV_DIR = "${env.WORKSPACE}/venv"
        CHECKOV_REPORT = "checkov-report.sarif"
        CHECKOV_TARGET_DIR = "${env.WORKSPACE}/terragoat"
        CHECKOV_TARGET_FILE = "${env.WORKSPACE}/minimain.tf"
        CHECKOV_DISABLE_GUIDE = "true"
        BC_API_KEY = ""
        PRISMA_API_URL = ""
    }

    stages {
        // Step 1: Download and set up prebuilt Python binary
        stage('Download Prebuilt Python') {
            steps {
                echo ":arrow_down: Downloading prebuilt Python binary..."
                sh '''
                    mkdir -p $PYTHON_DIR
                    cd $PYTHON_DIR
                    curl -L -o python.tar.gz $PYTHON_URL
                    tar -xzf python.tar.gz --strip-components=1
                    echo ":white_check_mark: Python extracted to: $PYTHON_DIR"
                '''
            }
        }

        // Step 2: Verify Python & Pip installation
        stage('Verify Python & Pip') {
            steps {
                sh '''
                    $PYTHON_DIR/bin/python3.11 --version
                    $PYTHON_DIR/bin/pip3.11 --version
                '''
            }
        }

        // Step 3: Create Virtual Environment for Pipenv
        stage('Create Virtual Environment') {
            steps {
                echo "Creating virtual environment if missing..."
                sh '''
                    if [ ! -d "$VENV_DIR" ]; then
                        $PYTHON_DIR/bin/python3.11 -m venv "$VENV_DIR"
                    else
                        echo "Virtualenv already exists."
                    fi
                '''
            }
        }

        // Step 4: Install Pipenv if missing
        stage('Install Pipenv if Missing') {
            steps {
                echo "Installing Pipenv if missing..."
                sh '''
                    source "$VENV_DIR/bin/activate"
                    if ! pip show pipenv > /dev/null 2>&1; then
                        pip install pipenv
                    else
                        echo "Pipenv already installed."
                    fi
                '''
            }
        }

        // Step 5: Install Checkov via Pipenv
        stage('Install Checkov via Pipenv') { (1)
            steps {
                echo "Installing Checkov using Pipenv..."
                sh '''
                    source "$VENV_DIR/bin/activate"
                    pip install certifi
                    pipenv install checkov
                    echo "Checkov and certifi installed."
                '''
            }
        }

        stage('Run Checkov Scan') { (2)
            steps {
                echo "Running Checkov scan on a specific file (main.tf)..."
                sh '''
                    source "$VENV_DIR/bin/activate"
                    export SSL_CERT_FILE=$(python -m certifi)
                    CHECKOV_DISABLE_GUIDE=true pipenv run checkov -f "$CHECKOV_TARGET_FILE" -o sarif > "$CHECKOV_REPORT" || true
                '''
            }
        }

        stage('Display SARIF Report') { (3)
            steps {
                echo "Displaying SARIF report:"
                sh '''
                    echo "=== Checkov SARIF Report (First 20 lines) ==="
                    head -n 20 "$CHECKOV_REPORT"
                '''
            }
        }
    }

    post {
        always {
            archiveArtifacts artifacts: "${env.CHECKOV_REPORT}", fingerprint: true
        }
    }
}▼

1	Install the scanner.
2	Run the scan.
3	Format the report in SARIF.

Jenkinsfile example that uses the Grype scanner.

Add the following steps to your Jenkinsfile to install, run, and publish the results of a Grype scan to CloudBees platform.

pipeline {
    agent any

    environment {
        GRYPE_BINARY_DIR = "${env.WORKSPACE}/bin"
        GRYPE_SCAN_TARGET = "${env.WORKSPACE}/test-workflow"
        GRYPE_REPORT = "grype-report.sarif"
    }

    stages {
        stage('Install Grype') { (1)
            steps {
                sh '''
                echo "Installing Grype..."
                mkdir -p ${GRYPE_BINARY_DIR}
                export PATH=${GRYPE_BINARY_DIR}:$PATH
                curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b ${GRYPE_BINARY_DIR}
                grype version
                '''
            }
        }

        stage('List Files') {
            steps {
                sh '''
                echo "Current workspace contents:"
                ls -la ${WORKSPACE}
                '''
            }
        }

        stage('Scan Folder with Grype') { (2)
            steps {
                sh '''
                echo "Scanning folder '${GRYPE_SCAN_TARGET}' with Grype..."
                ${GRYPE_BINARY_DIR}/grype ${GRYPE_SCAN_TARGET} -o sarif > ${GRYPE_REPORT}
                '''
            }
        }

        stage('Display SARIF Report') { (3)
            steps {
                sh '''
                echo "=== Grype SARIF Report ==="
                cat ${GRYPE_REPORT}
                '''
            }
        }

    }
}▼

1	Install the scanner.
2	Run the scan.
3	Format the report in SARIF.

Run an automatically triggered implicit scan of your source code

Implicit scanning in the CloudBees platform refers to the automatic security analysis of source code without requiring explicit user intervention. This process ensures continuous security checks by automatically triggering scans whenever certain events occur, such as:

The creation of a new component.
Committing changes in a connected repository.
Generating an artifact from a CI build.

Enable implicit security scanning to provide ongoing security monitoring.

Learn more

For more information on security management and monitoring in CloudBees platform, refer to: