Creating a DevSecOps pipeline with Jenkins — Part 1

• vulnado

  1 166 0.0 Java

  Purposely vulnerable Java application to help lead secure coding workshops

  

  pipeline { agent any stages { stage('Checkout') { steps { git 'https://github.com/ScaleSec/vulnado.git' } } stage('Build') { steps { sh 'mvn clean package' } } stage('SonarQube Analysis') { steps{ withSonarQubeEnv(installationName: 'sonar-local') { sh "mvn clean verify sonar:sonar -Dsonar.projectKey=vulnado -Dsonar.projectName='vulnado'" } } } } }

• InfluxDB

  www.influxdata.com featured

  Purpose built for real-time analytics at any scale. InfluxDB Platform is powered by columnar analytics, optimized for cost-efficient storage, and built with open data standards.

  

• semgrep

  77 10,322 9.9 OCaml

  Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

  

  For the SAST stage, I used SonarQube tool. SonarQube is an open-source platform developed by SonarSource for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs and code smells on more than 30 programming languages. I preferred SonarQube instead of other SAST tools because it has a detailed documentation and plugins about integration with Jenkins and SonarQube works with Java projects pretty well. Of course you can similar multi-language-supported tools such as Semgrep or language-specific tools such as Bandit.

• bandit

  21 6,309 8.5 Python

  Bandit is a tool designed to find common security issues in Python code.

  

  For the SAST stage, I used SonarQube tool. SonarQube is an open-source platform developed by SonarSource for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs and code smells on more than 30 programming languages. I preferred SonarQube instead of other SAST tools because it has a detailed documentation and plugins about integration with Jenkins and SonarQube works with Java projects pretty well. Of course you can similar multi-language-supported tools such as Semgrep or language-specific tools such as Bandit.

Suggest a related project