jjb/nsm/Jenkinsfile.security-scan

   1
   2 node('nordix-nsm-build-ubuntu1804') {
   3     build_number = env.BUILD_NUMBER
   4     workspace = env.WORKSPACE
   5     ws("${workspace}/${build_number}") {
   6         def git_project = params.GIT_PROJECT
   7         def current_branch = params.CURRENT_BRANCH
   8         def default_branch = params.DEFAULT_BRANCH
   9         def image_registry = params.IMAGE_REGISTRY
  10         def version = params.IMAGE_VERSION
  11         def email_recipients = EMAIL_RECIPIENTS
  12         def image_names = IMAGE_NAMES
  13
  14         def vulnerabilityBadge = addEmbeddableBadgeConfiguration(id: 'meridio-vulnerabilities', subject: 'vulnerabilities', color: 'peru', status: '?')
  15
  16         timeout(30) {
  17             stage('Clone/Checkout') {
  18                 git branch: default_branch, url: git_project
  19                 checkout([
  20                     $class: 'GitSCM',
  21                     branches: [[name: current_branch]],
  22                     extensions: [],
  23                     userRemoteConfigs: [[
  24                         refspec: '+refs/pull/*/head:refs/remotes/origin/pr/*',
  25                         url: git_project
  26                     ]]
  27                 ])
  28                 sh 'git show'
  29             }
  30             stage('Grype') {
  31                 def command = "make grype VERSION=${version} REGISTRY=${image_registry} IMAGES='${image_names}'"
  32                 ExecSh(command).call()
  33             }
  34             stage('Nancy') {
  35                 def command = 'make nancy'
  36                 ExecSh(command).call()
  37             }
  38             stage('Trivy') {
  39                 def command = "make trivy VERSION=${version} REGISTRY=${image_registry} IMAGES='${image_names}'"
  40                 ExecSh(command).call()
  41             }
  42             stage('Parse') {
  43                 def command = './hack/parse_security_scan.sh'
  44                 ExecSh(command).call()
  45             }
  46             stage('Report') {
  47                 archiveArtifacts artifacts: '_output/*', followSymlinks: false
  48
  49                 def number_of_vulnerabilities =  sh(script: 'cat _output/list.txt | grep -v "^$" | awk \'{print $1}\' | sort | uniq | wc -l', returnStdout: true).trim()
  50                 def list_of_vulnerabilities =  sh(script: 'cat _output/list.txt | grep -v "^$" | awk \'{print $1}\' | sort | uniq | sed \':a;N;$!ba;s/\\n/ ; /g\'', returnStdout: true).trim()
  51                 def number_of_high_severity_vulnerabilities =  sh(script: 'cat _output/list.txt | grep -v "^$" | grep -i "high" | awk \'{print $1}\' | sort | uniq | wc -l', returnStdout: true).trim()
  52                 def list_of_high_severity_vulnerabilities =  sh(script: 'cat _output/list.txt | grep -v "^$" | grep -i "high" | awk \'{print $1}\' | sort | uniq | sed \':a;N;$!ba;s/\\n/ ; /g\'', returnStdout: true).trim()
  53                 def git_describe =  sh(script: 'git describe --dirty --tags', returnStdout: true).trim()
  54                 def git_rev =  sh(script: 'git rev-parse HEAD', returnStdout: true).trim()
  55                 def report =  sh(script: 'cat _output/report.txt', returnStdout: true).trim()
  56
  57                 def subject = "Meridio - Security Scan - ${number_of_high_severity_vulnerabilities} high severity vulnerabilities detected"
  58                 def body = """
  59 Run: ${RUN_DISPLAY_URL}
  60 git describe --dirty --tags: ${git_describe}
  61 git rev-parse HEAD: ${git_rev}
  62 Image registry: ${image_registry}
  63 Image Version: ${version}
  64
  65 Number of vulnerabilities: ${number_of_vulnerabilities}
  66 List of vulnerabilities: ${list_of_vulnerabilities}
  67
  68 Number of vulnerabilities with high severity: ${number_of_high_severity_vulnerabilities}
  69 List of vulnerabilities with high severity: ${list_of_high_severity_vulnerabilities}
  70
  71 report:
  72 ${report}
  73 """
  74                 emailext body: "${body}", subject: "${subject}", to: "${email_recipients}"
  75
  76                 vulnerabilityBadge.setStatus("${number_of_vulnerabilities}")
  77             }
  78         }
  79         stage('Cleanup') {
  80             Cleanup()
  81         }
  82     }
  83 }
  84
  85 // Cleanup directory
  86 def Cleanup() {
  87     cleanWs()
  88 }
  89
  90 // Execute command
  91 def ExecSh(command) {
  92     return {
  93         sh """
  94             . \${HOME}/.profile
  95             ${command}
  96         """
  97     }
  98 }