Skip to content

Commit 96fa28d

Browse files
Susenthiran28Susenthiran28
committed
add and modify files for Jenkins Update Center publishing
- Updated plugin metadata and configuration for compatibility with Jenkins Update Center - Added required files for publishing workflow - Adjusted existing files to align with update center requirements
1 parent 33f425f commit 96fa28d

File tree

14 files changed

+442
-127
lines changed

14 files changed

+442
-127
lines changed

‎README.md‎

Lines changed: 171 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,185 @@
1-
# .
1+
# Vigilnz Security Plugin
22

3-
## Introduction
3+
[![Jenkins Plugin](https://img.shields.io/jenkins/plugin/v/vigilnz-security.svg)](https://plugins.jenkins.io/vigilnz-security)
4+
[![Jenkins Plugin Installs](https://img.shields.io/jenkins/plugin/i/vigilnz-security.svg?color=blue)](https://plugins.jenkins.io/vigilnz-security)
45

5-
TODO Describe what your plugin does here
6+
Vigilnz Security Plugin integrates comprehensive security scanning capabilities into Jenkins CI/CD pipelines. Run CVE, SAST, SBOM, and other security scans as part of your build process.
67

7-
## Getting started
8+
## Features
89

9-
TODO Tell users how to configure your plugin here, include screenshots, pipeline examples and
10-
configuration-as-code examples.
10+
- 🔒 **Multiple Scan Types**: Support for CVE, SAST, SBOM, and more
11+
- 🔐 **Secure Credential Management**: Store and manage Vigilnz API tokens securely
12+
- 🚀 **Freestyle & Pipeline Support**: Works with both traditional and modern Jenkins jobs
13+
- 📊 **Detailed Results**: View scan results directly in the Jenkins build sidebar
14+
- ⚙️ **Flexible Configuration**: Select which scan types to run per build
15+
- 🔄 **Token Management**: Automatic token refresh and caching
1116

12-
## Issues
17+
## Requirements
1318

14-
TODO Decide where you're going to host your issues, the default is Jenkins JIRA, but you can also enable GitHub issues,
15-
If you use GitHub issues there's no need for this section; else add the following line:
19+
- Jenkins 2.516.3 or later
20+
- Java 17 or later
21+
- Vigilnz API access (API key required)
1622

17-
Report issues and enhancements in the [Jenkins issue tracker](https://issues.jenkins.io/).
23+
## Installation
24+
25+
### From Jenkins Update Center
26+
27+
1. Go to **Manage Jenkins** → **Manage Plugins**
28+
2. Search for "Vigilnz Security"
29+
3. Click **Install without restart** or **Download now and install after restart**
30+
31+
### Manual Installation
32+
33+
1. Download the latest `.hpi` file from [GitHub Releases](https://github.com/your-org/vigilnz-security-plugin/releases)
34+
2. Go to **Manage Jenkins** → **Manage Plugins** → **Advanced**
35+
3. Upload the `.hpi` file under **Upload Plugin**
36+
4. Restart Jenkins
37+
38+
## Getting Started
39+
40+
### 1. Configure Vigilnz Credentials
41+
42+
1. Go to **Manage Jenkins** → **Manage Credentials**
43+
2. Click **Add Credentials**
44+
3. Select **Vigilnz Security Token** from the kind dropdown
45+
4. Enter:
46+
- **Token**: Your Vigilnz API key
47+
- **ID**: Unique identifier (optional, auto-generated if not provided)
48+
- **Description**: Description for this credential
49+
5. Click **OK**
50+
51+
### 2. Use in Freestyle Job
52+
53+
1. Create a new Freestyle project or edit an existing one
54+
2. In **Build Steps**, click **Add build step** → **Invoke Vigilnz Security Task**
55+
3. Configure:
56+
- **Token**: Select your Vigilnz credential
57+
- **Target File**: (Optional) File or path to scan
58+
- **Scan Types**: Select at least one scan type (CVE, SAST, SBOM)
59+
4. Save and run the build
60+
61+
### 3. Use in Pipeline
62+
63+
```groovy
64+
pipeline {
65+
agent any
66+
67+
stages {
68+
stage('Security Scan') {
69+
steps {
70+
vigilnzScan(
71+
token: 'my-vigilnz-token',
72+
scanTypes: ['cve', 'sast', 'sbom']
73+
)
74+
}
75+
}
76+
}
77+
}
78+
```
79+
80+
## Configuration
81+
82+
### Environment Variables
83+
84+
You can configure API endpoints using environment variables or system properties:
85+
86+
- `VIGILNZ_AUTH_URL` or `-Dvigilnz.auth.url`: Authentication API URL (default: `http://localhost:1337/auth/api-key`)
87+
- `VIGILNZ_SCAN_URL` or `-Dvigilnz.scan.url`: Multi-scan API URL (default: `http://localhost:8000/scan-targets/multi-scan`)
88+
89+
### Scan Types
90+
91+
- **CVE**: Common Vulnerabilities and Exposures scan
92+
- **SAST**: Static Application Security Testing
93+
- **SBOM**: Software Bill of Materials
94+
95+
## Viewing Results
96+
97+
After a build completes:
98+
99+
1. **Sidebar Summary**: View a quick summary in the build page sidebar
100+
2. **Full Details**: Click "View Details →" in the sidebar to see complete scan results
101+
3. **Console Output**: Check the build console for detailed scan logs
102+
103+
## Pipeline Examples
104+
105+
### Basic Usage
106+
107+
```groovy
108+
vigilnzScan(
109+
token: 'my-vigilnz-token',
110+
scanTypes: ['cve']
111+
)
112+
```
113+
114+
### Multiple Scan Types
115+
116+
```groovy
117+
vigilnzScan(
118+
token: 'my-vigilnz-token',
119+
scanTypes: ['cve', 'sast', 'sbom']
120+
)
121+
```
122+
123+
### With Credentials Binding
124+
125+
```groovy
126+
pipeline {
127+
agent any
128+
129+
stages {
130+
stage('Security Scan') {
131+
steps {
132+
withCredentials([string(credentialsId: 'vigilnz-token', variable: 'VIGILNZ_TOKEN')]) {
133+
vigilnzScan(
134+
token: 'vigilnz-token',
135+
scanTypes: ['cve', 'sast']
136+
)
137+
}
138+
}
139+
}
140+
}
141+
}
142+
```
143+
144+
## Troubleshooting
145+
146+
### Authentication Failed
147+
148+
- Verify your API key is correct
149+
- Check that the authentication URL is accessible
150+
- Ensure the token has not expired
151+
152+
### Scan Types Not Selected
153+
154+
- At least one scan type must be selected
155+
- Check the checkbox selections in the build configuration
156+
157+
### No Results in Sidebar
158+
159+
- Ensure the build completed successfully
160+
- Check the build console for any errors
161+
- Verify the API response was successful
162+
163+
## Support
164+
165+
- **Issues**: Report issues on [GitHub Issues](https://github.com/your-org/vigilnz-security-plugin/issues)
166+
- **Documentation**: [Plugin Wiki](https://github.com/your-org/vigilnz-security-plugin/wiki)
167+
- **Email**: [email protected]
18168

19169
## Contributing
20170

21-
TODO review the default [CONTRIBUTING](https://github.com/jenkinsci/.github/blob/master/CONTRIBUTING.md) file and make sure it is appropriate for your plugin, if not then add your own one adapted from the base file
171+
Contributions are welcome! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
172+
173+
## Changelog
22174

23-
Refer to our [contribution guidelines](https://github.com/jenkinsci/.github/blob/master/CONTRIBUTING.md)
175+
### Version 1.0
24176

25-
## LICENSE
177+
- Initial release
178+
- Support for CVE, SAST, SBOM scan types
179+
- Freestyle and Pipeline job support
180+
- Secure credential management
181+
- Build sidebar results display
26182

27-
Licensed under MIT, see [LICENSE](LICENSE.md)
183+
## License
28184

185+
Licensed under MIT License. See [LICENSE](LICENSE.md) for details.

‎pom.xml‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@
1717

1818
<!-- Plugin Name -->
1919
<name>Vigilnz Security</name>
20-
<url>https://dev.vigilnz.com/</url>
20+
<description>Vigilnz Security Plugin integrates security scanning capabilities into Jenkins. Run CVE, SAST, SBOM, and other security scans as part of your CI/CD pipeline.</description>
21+
<url>https://github.com/${gitHubRepo}</url>
2122
<licenses>
2223
<license>
2324
<name>MIT License</name>
@@ -31,6 +32,14 @@
3132
<tag>${scmTag}</tag>
3233
<url>https://github.com/${gitHubRepo}</url>
3334
</scm>
35+
36+
<developers>
37+
<developer>
38+
<id>vigilnz</id>
39+
<name>Vigilnz Team</name>
40+
<email>[email protected]</email>
41+
</developer>
42+
</developers>
3443

3544
<properties>
3645
<revision>1.0</revision>
@@ -43,7 +52,7 @@
4352
<spotless.check.skip>false</spotless.check.skip>
4453
<ban-junit4-imports.skip>false</ban-junit4-imports.skip>
4554
<hpi.strictBundledArtifacts>true</hpi.strictBundledArtifacts>
46-
<hpi.bundledArtifacts>gson,json</hpi.bundledArtifacts>
55+
<hpi.bundledArtifacts>jackson-annotations,jackson-core,jackson-databind</hpi.bundledArtifacts>
4756
</properties>
4857

4958
<dependencyManagement>
@@ -104,15 +113,9 @@
104113
</dependency>
105114

106115
<dependency>
107-
<groupId>com.google.code.gson</groupId>
108-
<artifactId>gson</artifactId>
109-
<version>2.8.9</version>
110-
</dependency>
111-
112-
<dependency>
113-
<groupId>org.json</groupId>
114-
<artifactId>json</artifactId>
115-
<version>20231013</version>
116+
<groupId>com.fasterxml.jackson.core</groupId>
117+
<artifactId>jackson-databind</artifactId>
118+
<version>2.20.1</version>
116119
</dependency>
117120

118121
</dependencies>

‎src/main/java/io/jenkins/plugins/ApiService.java‎

Lines changed: 6 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import hudson.EnvVars;
44
import hudson.model.TaskListener;
5+
import io.jenkins.plugins.models.AuthResponse;
56
import net.sf.json.JSONObject;
67

78
import java.io.BufferedReader;
@@ -126,9 +127,12 @@ public static String triggerScan(String token, String targetFile, List<String> s
126127
JSONObject json = new JSONObject();
127128
// Send scan types as array
128129
json.put("scanTypes", scanTypes);
129-
json.put("project", targetFile);
130130
json.put("gitRepoUrl", repoUrl);
131-
if (targetFile != null) json.put("targetFile", targetFile);
131+
// Optional fields
132+
if (targetFile != null && !targetFile.trim().isEmpty()) {
133+
json.put("project", targetFile);
134+
json.put("targetFile", targetFile);
135+
}
132136

133137
String body = json.toString();
134138

@@ -158,35 +162,4 @@ public static String triggerScan(String token, String targetFile, List<String> s
158162
}
159163
}
160164

161-
/** Authentication response model */
162-
public static class AuthResponse {
163-
private String accessToken;
164-
private String refreshToken;
165-
private long expiresIn;
166-
private String tokenType;
167-
168-
public AuthResponse(String accessToken, String refreshToken, long expiresIn, String tokenType) {
169-
this.accessToken = accessToken;
170-
this.refreshToken = refreshToken;
171-
this.expiresIn = expiresIn;
172-
this.tokenType = tokenType;
173-
}
174-
175-
public String getAccessToken() {
176-
return accessToken;
177-
}
178-
179-
public String getRefreshToken() {
180-
return refreshToken;
181-
}
182-
183-
public long getExpiresIn() {
184-
return expiresIn;
185-
}
186-
187-
public String getTokenType() {
188-
return tokenType;
189-
}
190-
}
191-
192165
}

‎src/main/java/io/jenkins/plugins/PipelineStep.java‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,28 @@
88
import org.jenkinsci.plugins.workflow.steps.StepDescriptor;
99
import org.jenkinsci.plugins.workflow.steps.StepExecution;
1010
import org.kohsuke.stapler.DataBoundConstructor;
11+
import org.kohsuke.stapler.DataBoundSetter;
1112

1213
import java.util.List;
1314
import java.util.Set;
1415

1516
public class PipelineStep extends Step {
1617

1718
private final String token;
18-
private final String targetFile;
1919
private final List<String> scanTypes;
20+
private String targetFile; // Optional parameter
2021

2122
@DataBoundConstructor
22-
public PipelineStep(String token, String targetFile, List<String> scanTypes) {
23+
public PipelineStep(String token, List<String> scanTypes) {
2324
this.token = token;
24-
this.targetFile = targetFile;
2525
this.scanTypes = scanTypes != null ? scanTypes : List.of();
2626
}
2727

28+
@DataBoundSetter
29+
public void setTargetFile(String targetFile) {
30+
this.targetFile = targetFile;
31+
}
32+
2833
public String getToken() {
2934
return token;
3035
}

‎src/main/java/io/jenkins/plugins/PipelineStepExecution.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,14 @@ public boolean start() throws Exception {
106106
listener.getLogger().println("Selected Scan Types: " + String.join(", ", scanTypes));
107107
String result = ApiService.triggerScan(token, step.getTargetFile(), scanTypes, env, listener);
108108

109+
run.addAction(new ScanResultAction(result));
110+
109111
if (result == null || result.isEmpty()) {
110112
listener.error("Scan failed");
111113
getContext().onFailure(new AbortException("Scan failed"));
112114
return false;
113115
}
116+
114117
} else {
115118
listener.getLogger().println("No Vigilnz Token credential found");
116119
getContext().onFailure(new AbortException("No Vigilnz Token credential found"));

‎src/main/java/io/jenkins/plugins/ScanResultAction.java‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,26 @@
11
package io.jenkins.plugins;
22

3-
import com.google.gson.Gson;
3+
import com.fasterxml.jackson.core.JsonProcessingException;
4+
import com.fasterxml.jackson.databind.ObjectMapper;
45
import hudson.model.Action;
56
import io.jenkins.plugins.models.ApiResponse;
67

78
public class ScanResultAction implements Action {
89
private final ApiResponse response;
910

10-
public ScanResultAction(String scanSummary) {
11+
public ScanResultAction(String scanSummary) throws JsonProcessingException {
1112

1213
// Convert JSON string to ApiResponse
13-
Gson gson = new Gson();
14-
ApiResponse apiResponse = gson.fromJson(scanSummary, ApiResponse.class);
14+
ObjectMapper mapper = new ObjectMapper();
15+
ApiResponse apiResponse;
16+
apiResponse = mapper.readValue(scanSummary, ApiResponse.class);
1517
this.response = apiResponse;
1618
}
1719

1820
@Override
1921
public String getIconFileName() {
20-
return "clipboard.png"; // or a custom icon
22+
// return "clipboard.png"; // or a custom icon
23+
return "symbol-reader-outline plugin-ionicons-api"; // or a custom icon
2124
}
2225

2326
@Override

0 commit comments

Comments
 (0)