From aa869f9c6a4eb62616ec73904123089ff72e212d Mon Sep 17 00:00:00 2001 From: Todor Mitev Date: Wed, 8 Jul 2026 09:33:18 +0300 Subject: [PATCH 1/3] feat: Use jenkins template repo --- Jenkinsfile | 132 +++++----------------------------------------------- 1 file changed, 12 insertions(+), 120 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index a04c715..420f122 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -1,122 +1,14 @@ -pipeline { - agent { label 'azure-linux-ubuntu-18' } - options { - skipStagesAfterUnstable() - disableConcurrentBuilds() - } - stages { - stage("Clone Git Repo") { - steps { - cleanWs() - script { - def branchName = env.CHANGE_BRANCH ?: env.BRANCH_NAME - env.branchName = branchName - echo "Using branch/commit: ${env.BRANCH_NAME}" - } - checkout([ - $class: 'GitSCM', - branches: [[name: "refs/heads/${env.branchName}"]], - doGenerateSubmoduleConfigurations: false, - extensions: [ - [$class: 'RelativeTargetDirectory', relativeTargetDir: 'valideer'], - [$class: 'CloneOption', shallow: false, noTags: false] - ], - submoduleCfg: [], - userRemoteConfigs: [[credentialsId: 'github-app-podio-jm', url: 'https://github.com/podio/valideer.git']] - ]) - } - } - - stage('Polaris') { - environment { - BRIDGE_POLARIS_SERVERURL = "https://polaris.blackduck.com" - BRIDGE_POLARIS_ACCESSTOKEN = credentials('blackduck-api-token') - BRIDGE_POLARIS_APPLICATION_NAME = "Podio-Podio" - BRIDGE_POLARIS_PROJECT_NAME = "valideer" - BRIDGE_POLARIS_BRANCH_NAME = "${env.branchName}" - BRIDGE_POLARIS_ASSESSMENT_TYPES = "SAST" - } - steps { - dir('valideer') { - script { - def status = sh returnStatus: true, script: ''' - bridge-cli --stage polaris - ''' - if (status == 8) { - unstable 'Policy violation' - } else if (status != 0) { - error 'Bridge CLI failure' - } - } - } - } - } - - stage('BlackDuckSCA') { - environment { - BRIDGE_BLACKDUCKSCA_URL = "https://progresssoftware.app.blackduck.com" - BRIDGE_BLACKDUCKSCA_TOKEN = credentials('blackduck-sca-token') - BRIDGE_BLACKDUCKSCA_SCAN_FAILURE_SEVERITIES = "CRITICAL" - BRIDGE_BLACKDUCKSCA_SCAN_FULL = "true" - BRIDGE_DETECT_ARGS = "--detect.project.name=DX-Podio-valideer --detect.project.version.name=${env.branchName} --detect.project.version.update=true --detect.project.version.distribution=SAAS --detect.project.group.name=Podio-Podio --detect.accuracy.required=NONE --detect.excluded.detector.types=PIP" - } - steps { - dir('valideer') { - script { - def status = sh returnStatus: true, script: ''' - bridge-cli --stage blackducksca - ''' - if (status != 0) { - error 'BlackDuck SCA Scan failed' - } - } - } - } - } - - stage('TruffleHog Scan') { - steps { - script { - def scanOutput = 'trufflehog_output.json' - def repoPath = "${env.WORKSPACE}/valideer" - - echo "🔍 Running TruffleHog Git scan on repo path: ${repoPath}, branch: ${env.branchName}" - - def scanExitCode = sh(returnStatus: true, script: """ - docker run --rm -v "${repoPath}:/usr/src" \ - artifacts.progress.com/ci-local-docker/trufflesecurity/trufflehog:3.88.29-amd64 \ - git file:/usr/src \ - --branch="${env.branchName}" \ - --results=verified \ - --force-skip-binaries \ - --force-skip-archives \ - --json \ - --no-update \ - > "${scanOutput}" - - echo "📄 TruffleHog scan completed. Output saved to ${scanOutput}" - if grep -q '"SourceMetadata"' "${scanOutput}"; then - echo "❌ TruffleHog found potential secrets!" - cat "${scanOutput}" - exit 1 - else - echo "✅ No secrets found." - fi - """) - - if (scanExitCode != 0) { - error("❌ TruffleHog scan failed, potential secrets detected in the repository.") - } - } - } - post { - always { - archiveArtifacts artifacts: 'trufflehog_output.json', fingerprint: true, allowEmptyArchive: true - } - success { - echo "✅ TruffleHog scan passed - No secrets detected." - } - } - } +#!/usr/bin/env groovy +applicationName = "valideer"; + +def template +node ('aws-linuxdocker-test') { + checkout scm + dir("jenkins-template") { + checkout([$class: 'GitSCM',branches: [[name:'main']],extensions:[],userRemoteConfigs: [[credentialsId: 'gh-podio-app', url: 'https://github.com/podio/jenkins-template-repo.git']]]) } + def rootDir = pwd() + template = load "${rootDir}/jenkins-template/Jenkinsfile" } + +template() From 28303feffed54b1f829b20c497b2ee98e34b5af0 Mon Sep 17 00:00:00 2001 From: Todor Mitev Date: Wed, 8 Jul 2026 10:26:08 +0300 Subject: [PATCH 2/3] fix: Security scans only --- Jenkinsfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Jenkinsfile b/Jenkinsfile index 420f122..f8128d4 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -1,11 +1,12 @@ #!/usr/bin/env groovy applicationName = "valideer"; +securityScanOnly = true; def template node ('aws-linuxdocker-test') { checkout scm dir("jenkins-template") { - checkout([$class: 'GitSCM',branches: [[name:'main']],extensions:[],userRemoteConfigs: [[credentialsId: 'gh-podio-app', url: 'https://github.com/podio/jenkins-template-repo.git']]]) + checkout([$class: 'GitSCM',branches: [[name:'feature/security-only']],extensions:[],userRemoteConfigs: [[credentialsId: 'gh-podio-app', url: 'https://github.com/podio/jenkins-template-repo.git']]]) } def rootDir = pwd() template = load "${rootDir}/jenkins-template/Jenkinsfile" From e7b43ed4ca5c6f96b18da080cb1a1d34191ddcd2 Mon Sep 17 00:00:00 2001 From: Todor Mitev Date: Wed, 8 Jul 2026 10:32:45 +0300 Subject: [PATCH 3/3] chore: Turn back the main branch --- Jenkinsfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Jenkinsfile b/Jenkinsfile index f8128d4..1b36d5a 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -6,7 +6,7 @@ def template node ('aws-linuxdocker-test') { checkout scm dir("jenkins-template") { - checkout([$class: 'GitSCM',branches: [[name:'feature/security-only']],extensions:[],userRemoteConfigs: [[credentialsId: 'gh-podio-app', url: 'https://github.com/podio/jenkins-template-repo.git']]]) + checkout([$class: 'GitSCM',branches: [[name:'main']],extensions:[],userRemoteConfigs: [[credentialsId: 'gh-podio-app', url: 'https://github.com/podio/jenkins-template-repo.git']]]) } def rootDir = pwd() template = load "${rootDir}/jenkins-template/Jenkinsfile"