技术文档 | 在Jenkins及GitlabCI中集成OpenSCA，轻松实现CI/CD开源风险治理

# install opensca-clicurl -sSL https://raw.githubusercontent.com/XmirrorSecurity/OpenSCA-cli/master/scripts/install.sh | sh# export opensca-cli to PATHexport PATH=/var/jenkins_home/.config/opensca-cli:$PATH# run opensca scan and generate reports(replace {put_your_token_here} with your token)opensca-cli -path $WORKSPACE -token {put_your_token_here} -out $WORKSPACE/results/result.html,$WORKSPACE/results/result.dsdx.json

pipeline {    agent any    stages {        stage('Build') {            steps {                // Get some code from a GitHub repository                // build it, test it, and archive the binaries.            }        }        stage('Security Scan') {            steps {                // install opensca-cli                sh "curl -sSL https://raw.githubusercontent.com/XmirrorSecurity/OpenSCA-cli/master/scripts/install.sh | sh"                // run opensca scan and generate reports(replace {put_your_token_here} with your token)                sh "/var/jenkins_home/.config/opensca-cli/opensca-cli -path $WORKSPACE -token {put_your_token_here} -out $WORKSPACE/results/result.html,$WORKSPACE/results/result.dsdx.json"            }        }    }    post {        always {            // do something post build        }    }}

System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", "sandbox allow-scripts; default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval';")

post {    always {        // do something post build        publishHTML(            [                allowMissing: false,                alwaysLinkToLastBuild: true,                keepAll: true,                reportDir: 'results',                reportFiles: 'result.html',                reportName: 'OpenSCA Report',                reportTitles: 'OpenSCA Report',                useWrapperFileDirectly: true            ]        )    }}

security-test-job:    stage: test    script:        - echo "do opensca scan..."        - curl -sSL https://raw.githubusercontent.com/XmirrorSecurity/OpenSCA-cli/master/scripts/install.sh | sh        - /root/.config/opensca-cli/opensca-cli -path $CI_PROJECT_DIR -token {put_your_token_here} -out $CI_PROJECT_DIR/results/result.html,$CI_PROJECT_DIR/results/result.dsdx.json    artifacts:      paths:        - results/      untracked: false      when: on_success      expire_in: 30 days

stages:  - build  - test  - deploybuild-job:  stage: build  script:    - echo "Compiling the code..."    - echo "Compile complete."unit-test-job:  stage: test  script:    - echo "do unit test..."    - sleep 10    - echo "Code coverage is 90%"lint-test-job:  stage: test  script:    - echo "do lint test..."    - sleep 10    - echo "No lint issues found."security-test-job:    stage: test    script:        - echo "do opensca scan..."        - curl -sSL https://raw.githubusercontent.com/XmirrorSecurity/OpenSCA-cli/master/scripts/install.sh | sh        - /root/.config/opensca-cli/opensca-cli -path $CI_PROJECT_DIR -token {put_your_token_here} -out $CI_PROJECT_DIR/results/result.html,$CI_PROJECT_DIR/results/result.dsdx.json    artifacts:      paths:        - results/      untracked: false      when: on_success      expire_in: 30 daysdeploy-job:  stage: deploy  environment: production  script:    - echo "Deploying application..."    - echo "Application successfully deployed."