Creating a DevSecOps pipeline with Jenkins — Part 1

• vulnado

  1 149 0.0 Java

  Purposely vulnerable Java application to help lead secure coding workshops

  

pipeline { agent any stages { stage('Checkout') { steps { git 'https://github.com/ScaleSec/vulnado.git' } } stage('Build') { steps { sh 'mvn clean package' } } stage('SonarQube Analysis') { steps{ withSonarQubeEnv(installationName: 'sonar-local') { sh "mvn clean verify sonar:sonar -Dsonar.projectKey=vulnado -Dsonar.projectName='vulnado'" } } } } }

• semgrep

  74 9,724 9.9 OCaml

  Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

  

For the SAST stage, I used SonarQube tool. SonarQube is an open-source platform developed by SonarSource for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs and code smells on more than 30 programming languages. I preferred SonarQube instead of other SAST tools because it has a detailed documentation and plugins about integration with Jenkins and SonarQube works with Java projects pretty well. Of course you can similar multi-language-supported tools such as Semgrep or language-specific tools such as Bandit.

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• bandit

  21 5,989 8.2 Python

  Bandit is a tool designed to find common security issues in Python code.

  

For the SAST stage, I used SonarQube tool. SonarQube is an open-source platform developed by SonarSource for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs and code smells on more than 30 programming languages. I preferred SonarQube instead of other SAST tools because it has a detailed documentation and plugins about integration with Jenkins and SonarQube works with Java projects pretty well. Of course you can similar multi-language-supported tools such as Semgrep or language-specific tools such as Bandit.

Suggest a related project