Skip to content

Instantly share code, notes, and snippets.

@nikhilgeo

nikhilgeo/gist:0f7aa20b35be355559f9f8f6ff0bb9b0

Last active January 17, 2020 09:52
Show Gist options
  • Save nikhilgeo/0f7aa20b35be355559f9f8f6ff0bb9b0 to your computer and use it in GitHub Desktop.
Save nikhilgeo/0f7aa20b35be355559f9f8f6ff0bb9b0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. nikhilgeo revised this gist Jan 17, 2020. 1 changed file with 24 additions and 20 deletions.
    44 changes: 24 additions & 20 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -3,24 +3,30 @@
    # Runs the job in a docker so jekins should have docker installed.
    # Need a third-party library called jenkinsci-unstashParam-library to fetch the baseline json uploaded as job parameter.

    properties([parameters([string(defaultValue: 'NameofScan', description: 'Use only alphabets, without space', name: 'SCAN_NAME', trim: true), string(defaultValue: '[email protected]:test/repo1.git', description: 'Enter the "Clone with SSH" url', name: 'REPO', trim: true), string(defaultValue: 'dev', description: 'Select the release branch to run scans for particular release', name: 'Branch', trim: true), choice(choices: ['YES', 'NO'], description: 'Run normal scan', name: 'NORMAL_SCAN'),choice(choices: ['YES', 'NO'], description: 'Run baseline scan to hide previous found issues. If you choose YES you MUST upload baseline json file in next step.', name: 'BASELINE_SCAN'), file(description: 'Upload the bandit baseline json file to ignore old issues', name: 'BASELINE_JSON'), choice(choices: ['YES', 'NO'], description: 'Choose YES to generate baseline json file, which can be uploaded next time you run the scan to hide issues found in this scan.', name: 'CREATE_BASELINE')])])
    properties([parameters(
    [string(defaultValue: 'NameofScan', description: 'Use only alphabets, without space', name: 'SCAN_NAME', trim: true), string(defaultValue: '[email protected]:test/repo1.git', description: 'Enter the "Clone with SSH" url', name: 'REPO', trim: true),
    string(defaultValue: 'dev', description: 'Select the release branch to run scans for particular release', name: 'Branch', trim: true),
    choice(choices: ['YES', 'NO'], description: 'Run normal scan', name: 'NORMAL_SCAN'),
    choice(choices: ['YES', 'NO'], description: 'Run baseline scan to hide previous found issues. If you choose YES you MUST upload baseline json file in next step.', name: 'BASELINE_SCAN'),
    file(description: 'Upload the bandit baseline json file to ignore old issues', name: 'BASELINE_JSON'),
    choice(choices: ['YES', 'NO'], description: 'Choose YES to generate baseline json file, which can be uploaded next time you run the scan to hide issues found in this scan.', name: 'CREATE_BASELINE')
    ])])
    pipeline {
    agent {
    docker { image 'python:2.7.17'
    args '-u root:sudo'
    }
    }

    }
    }
    stages {
    stage('Install Bandit') {
    steps {
    sh "pip install bandit"
    }
    }
    stage ('Run Bandit Scan') {
    when {
    expression {params.NORMAL_SCAN == "YES"}
    }
    when {
    expression {params.NORMAL_SCAN == "YES"}
    }
    steps {
    timestamps{ echo ">>>>>>>>>>Running bandit on repo ${params.repo}>>>>>>>>>>>>>>>>>>>>" }
    git branch: "${params.Branch}",
    @@ -33,11 +39,10 @@ pipeline {
    }

    stage ('Run Bandit Baseline Scan') {
    when {
    expression {params.BASELINE_SCAN == "YES"}
    }
    when {
    expression {params.BASELINE_SCAN == "YES"}
    }
    steps {

    timestamps{ echo ">>>>>>>>>>Running bandit baseline scan on repo ${params.REPO}>>>>>>>>>>>>>>>>>>>>" }
    git branch: "${params.Branch}",
    credentialsId: "****",
    @@ -50,19 +55,18 @@ pipeline {
    """
    sh "rm -rf ${file_in_workspace}"
    }
    }
    }

    stage ('Create Bandit baseline') {
    when {
    expression {params.CREATE_BASELINE == "YES"}
    }
    }
    stage ('Create Bandit baseline') {
    when {
    expression {params.CREATE_BASELINE == "YES"}
    }
    steps {
    sh label: '', returnStatus: true, script: """
    bandit -r -f json -o bandit_baseline_${params.SCAN_NAME}.json .
    """
    bandit -r -f json -o bandit_baseline_${params.SCAN_NAME}.json .
    """
    }
    }
    }
    stage ('Archive report') {
    steps {
    archiveArtifacts artifacts: 'bandit_*.*'
  2. nikhilgeo created this gist Jan 17, 2020.
    73 changes: 73 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,73 @@
    # Jenkins pipeline script in declarative snytax to run bandit on git repo
    # Needs git token added to the jenkins server in credential store
    # Runs the job in a docker so jekins should have docker installed.
    # Need a third-party library called jenkinsci-unstashParam-library to fetch the baseline json uploaded as job parameter.

    properties([parameters([string(defaultValue: 'NameofScan', description: 'Use only alphabets, without space', name: 'SCAN_NAME', trim: true), string(defaultValue: '[email protected]:test/repo1.git', description: 'Enter the "Clone with SSH" url', name: 'REPO', trim: true), string(defaultValue: 'dev', description: 'Select the release branch to run scans for particular release', name: 'Branch', trim: true), choice(choices: ['YES', 'NO'], description: 'Run normal scan', name: 'NORMAL_SCAN'),choice(choices: ['YES', 'NO'], description: 'Run baseline scan to hide previous found issues. If you choose YES you MUST upload baseline json file in next step.', name: 'BASELINE_SCAN'), file(description: 'Upload the bandit baseline json file to ignore old issues', name: 'BASELINE_JSON'), choice(choices: ['YES', 'NO'], description: 'Choose YES to generate baseline json file, which can be uploaded next time you run the scan to hide issues found in this scan.', name: 'CREATE_BASELINE')])])
    pipeline {
    agent {
    docker { image 'python:2.7.17'
    args '-u root:sudo'
    }
    }

    stages {
    stage('Install Bandit') {
    steps {
    sh "pip install bandit"
    }
    }
    stage ('Run Bandit Scan') {
    when {
    expression {params.NORMAL_SCAN == "YES"}
    }
    steps {
    timestamps{ echo ">>>>>>>>>>Running bandit on repo ${params.repo}>>>>>>>>>>>>>>>>>>>>" }
    git branch: "${params.Branch}",
    credentialsId: "****",
    url: "${params.REPO}"
    sh label: '', returnStatus: true, script: """
    bandit -r -f html -o bandit_report_${params.SCAN_NAME}.html .
    """
    }
    }

    stage ('Run Bandit Baseline Scan') {
    when {
    expression {params.BASELINE_SCAN == "YES"}
    }
    steps {

    timestamps{ echo ">>>>>>>>>>Running bandit baseline scan on repo ${params.REPO}>>>>>>>>>>>>>>>>>>>>" }
    git branch: "${params.Branch}",
    credentialsId: "****",
    url: "${params.REPO}"
    script{
    @Library('jenkinsci-unstashParam-library@master') _
    def file_in_workspace = unstashParam "BASELINE_JSON"
    sh label: '', returnStatus: true, script: """
    bandit -r -f html -o bandit_report_${params.SCAN_NAME}.html -b ${file_in_workspace} .
    """
    sh "rm -rf ${file_in_workspace}"
    }
    }
    }

    stage ('Create Bandit baseline') {
    when {
    expression {params.CREATE_BASELINE == "YES"}
    }
    steps {
    sh label: '', returnStatus: true, script: """
    bandit -r -f json -o bandit_baseline_${params.SCAN_NAME}.json .
    """
    }
    }
    stage ('Archive report') {
    steps {
    archiveArtifacts artifacts: 'bandit_*.*'
    deleteDir()
    }
    }
    }
    }