1
0
mirror of https://github.com/SAP/jenkins-library.git synced 2024-12-12 10:55:20 +02:00
sap-jenkins-library/resources/metadata/codeqlExecuteScan.yaml

174 lines
6.2 KiB
YAML

metadata:
name: codeqlExecuteScan
description: This step executes a codeql scan on the specified project to perform static code analysis and check the source code for security flaws.
longDescription: |-
This step executes a codeql scan on the specified project to perform static code analysis and check the source code for security flaws.
The codeql step triggers a scan locally on your orchestrator (e.g. Jenkins) within a docker container so finally you have to supply a docker image with codeql
and Java plus Maven.
spec:
inputs:
secrets:
- name: githubTokenCredentialsId
description: Jenkins 'Secret text' credentials ID containing token to authenticate to GitHub.
type: jenkins
resources:
- name: commonPipelineEnvironment
resourceSpec:
type: piperEnvironment
- name: buildDescriptor
type: stash
- name: tests
type: stash
params:
- name: githubToken
description: "GitHub personal access token in plain text. NEVER set this parameter in a file commited to a source code repository. This parameter is intended to be used from the command line or set securely via the environment variable listed below. In most pipeline use-cases, you should instead either store the token in Vault (where it can be automatically retrieved by the step from one of the paths listed below) or store it as a Jenkins secret and configure the secret's id via the `githubTokenCredentialsId` parameter."
scope:
- GENERAL
- PARAMETERS
- STAGES
- STEPS
type: string
secret: true
aliases:
- name: access_token
resourceRef:
- name: githubTokenCredentialsId
type: secret
- type: vaultSecret
default: github
name: githubVaultSecretName
- name: buildTool
type: string
description: Defines the build tool which is used for building the project.
longDescription: |-
Based on the build tool the step will try to auto build the project. The step will try to auto select
the language and the build command. You can override the language and the build command by specifiying it seperatly.
mandatory: true
scope:
- GENERAL
- PARAMETERS
- STAGES
- STEPS
possibleValues:
- custom
- maven
- golang
- npm
- pip
- yarn
default: "maven"
- name: buildCommand
type: string
description: "Command to build the project"
scope:
- PARAMETERS
- STAGES
- STEPS
- name: language
type: string
description: "The programming language used to analyze."
scope:
- PARAMETERS
- STAGES
- STEPS
- name: modulePath
type: string
description: "Allows providing the path for the module to scan"
scope:
- PARAMETERS
- STAGES
- STEPS
default: "./"
- name: database
type: string
description: "Path to the CodeQL database to create. This directory will be created, and must not already exist."
scope:
- PARAMETERS
- STAGES
- STEPS
default: "codeqlDB"
- name: querySuite
type: string
description: "The name of a CodeQL query suite. If omitted, the default query suite for the language of the database being analyzed will be used."
scope:
- PARAMETERS
- STAGES
- STEPS
- name: uploadResults
type: bool
description: "Allows you to upload codeql SARIF results to your github project. You will need to set githubToken for this."
scope:
- PARAMETERS
- STAGES
- STEPS
default: false
- name: threads
type: string
description: "Use this many threads for the codeql operations."
scope:
- PARAMETERS
- STAGES
- STEPS
default: "0"
- name: ram
type: string
description: "Use this much ram (MB) for the codeql operations."
scope:
- PARAMETERS
- STAGES
- STEPS
- name: analyzedRef
type: string
description: "Name of the ref that was analyzed."
longDescription: |-
If this ref is a pull request merge commit, then use refs/pulls/1234/merge or refs/pulls/1234/head (depending on whether or not this commit corresponds to the HEAD or MERGE commit of the PR).
Otherwise, this should be a branch: refs/heads/branch-name. If omitted, the CLI will attempt to automatically populate this from the current branch of the checkout path, if this exists.
resourceRef:
- name: commonPipelineEnvironment
param: git/ref
- name: repository
aliases:
- name: githubRepo
description: "URL of the GitHub instance"
resourceRef:
- name: commonPipelineEnvironment
param: git/httpsUrl
type: string
- name: commitId
description: "SHA of commit that was analyzed."
resourceRef:
- name: commonPipelineEnvironment
param: git/remoteCommitId
type: string
- name: vulnerabilityThresholdTotal
description: "Threashold for maximum number of allowed vulnerabilities."
type: int
default: 0
scope:
- PARAMETERS
- STAGES
- STEPS
- name: checkForCompliance
description: "If set to true, the piper step checks for compliance based on vulnerability threadholds. Example - If total vulnerabilites are 10 and vulnerabilityThresholdTotal is set as 0, then the steps throws an compliance error."
type: bool
default: false
scope:
- PARAMETERS
- STAGES
- STEPS
containers:
- image: ""
outputs:
resources:
- name: reports
type: reports
params:
- filePattern: "**/*.csv"
type: codeql
- filePattern: "**/*.sarif"
type: codeql
- filePattern: "**/toolrun_codeql_*.json"
type: codeql