|
| 1 | +--- |
| 2 | +tags: |
| 3 | + - Bitbucket |
| 4 | + - Jenkins |
| 5 | + - Freestyle projects |
| 6 | +description: Set up Jenkins freestyle projects for Bitbucket repositories. |
| 7 | +--- |
| 8 | + |
| 9 | +# Set up Jenkins Freestyle projects for Bitbucket repositories |
| 10 | + |
| 11 | +## Requirements |
| 12 | + |
| 13 | +Ensure you have set up [triggering events from Bitbucket to Jenkins](https://semgrep.dev/docs/kb/semgrep-ci/bitbucket-triggering-events-to-jenkins/). |
| 14 | + |
| 15 | +## Create a Jenkins Freestyle project |
| 16 | + |
| 17 | +1. From the Jenkins **Dashboard**, click **New Item**. |
| 18 | +1. Type a project name and select **Freestyle project**. Click **OK**. |
| 19 | + |
| 20 | +1. On the **General** page, go to the **Source Code Management** section. Select **Git**. Add your Bitbucket **Repository URL**, select the **Credentials** needed to check out sources, and select the **Branches to build**. |
| 21 | + |
| 22 | +1. In the **Build Triggers** section, click **<i class="fa-solid fa-square-check"></i> Build with Bitbucket Push and Pull Request Plugin**. |
| 23 | +1. In **Triggers > Select an Action** select **Created**, **Updated**, and **Push**. |
| 24 | + |
| 25 | +1. In the **Build environment** section, declare the `SEMGREP_APP_TOKEN` by selecting **Use secret text or file.** Set **Variable** to `SEMGREP_APP_TOKEN` and **Credentials > Specific credentials** to the defined credential for the Semgrep token. Click **Add** to save your changes. |
| 26 | + |
| 27 | +:::note |
| 28 | +Ensure that you have [defined `SEMGREP_APP_TOKEN` as a credential](https://www.jenkins.io/doc/book/using/using-credentials/#configuring-credentials) in Jenkins. |
| 29 | +::: |
| 30 | + |
| 31 | +## Run full scans |
| 32 | +In the **Build Steps** section, add an **Execute Shell** step with the logic below: |
| 33 | +``` |
| 34 | +#!/bin/bash |
| 35 | +
|
| 36 | +REPO_URL=$GIT_URL |
| 37 | +REPO_NAME=$(echo "$GIT_URL" | awk -F'/' '{print $(NF-1)"/"$(NF)}' | sed 's/.git$//') |
| 38 | +
|
| 39 | +docker run \ |
| 40 | + -e SEMGREP_APP_TOKEN=$SEMGREP_APP_TOKEN \ |
| 41 | + -e SEMGREP_REPO_URL=$REPO_URL \ |
| 42 | + -e SEMGREP_REPO_NAME=$REPO_NAME \ |
| 43 | + -v "$(pwd):$(pwd)" --workdir $(pwd) \ |
| 44 | + semgrep/semgrep semgrep ci |
| 45 | +``` |
| 46 | +:::note |
| 47 | +- The variable `SEMGREP_REPO_URL` links the Semgrep project and findings with the Bitbucket repository. |
| 48 | +- The variable `SEMGREP_REPO_NAME` provides an accurate and meaningful name to the Semgrep project. |
| 49 | +::: |
| 50 | + |
| 51 | +After adding the script, a full scan runs when you push changes to the default branch. |
| 52 | + |
| 53 | +## Run scans on pull requests (diff-aware scans) |
| 54 | + |
| 55 | +The diff-aware scan configuration must specify a merge base to compare the PR changes against. To achieve that, specify the pull request target branch as `SEMGREP_BASELINE_REF`, and set `SEMGREP_BRANCH` to the pull request source branch to ensure it's correctly identified. Set the `SEMGREP_REPO_NAME` as described above for full scans, and add `SEMGREP_PR_ID` so Semgrep can send comments to the related PR. |
| 56 | + |
| 57 | +One possible way to modify the shell script to include diff-aware scans is: |
| 58 | + |
| 59 | +``` |
| 60 | +#!/bin/bash |
| 61 | +
|
| 62 | +BASELINE_REF="main" |
| 63 | +BASELINE_REF_ORIGIN="origin/$BASELINE_REF" |
| 64 | +
|
| 65 | +REPO_URL=$GIT_URL |
| 66 | +REPO_NAME=$(echo "$GIT_URL" | awk -F'/' '{print $(NF-1)"/"$(NF)}' | sed 's/.git$//') |
| 67 | +
|
| 68 | +## Merge or push to primary branch |
| 69 | +if [ $BITBUCKET_SOURCE_BRANCH = $BASELINE_REF ]; then |
| 70 | + docker run -e SEMGREP_APP_TOKEN=$SEMGREP_APP_TOKEN \ |
| 71 | + -e SEMGREP_REPO_URL=$REPO_URL \ |
| 72 | + -e SEMGREP_REPO_NAME=$REPO_NAME \ |
| 73 | + -v "$(pwd):$(pwd)" --workdir $(pwd) \ |
| 74 | + semgrep/semgrep semgrep ci |
| 75 | + ## pull request scans |
| 76 | + elif [ $BITBUCKET_PULL_REQUEST_ID -ge 0 ]; then |
| 77 | + git checkout $BITBUCKET_SOURCE_BRANCH && git pull |
| 78 | + docker run -e SEMGREP_APP_TOKEN=$SEMGREP_APP_TOKEN \ |
| 79 | + -e SEMGREP_BASELINE_REF=$BASELINE_REF_ORIGIN \ |
| 80 | + -e SEMGREP_REPO_URL=$REPO_URL \ |
| 81 | + -e SEMGREP_REPO_NAME=$REPO_NAME \ |
| 82 | + -e SEMGREP_BRANCH=$BITBUCKET_SOURCE_BRANCH \ |
| 83 | + -e SEMGREP_PR_ID=$BITBUCKET_PULL_REQUEST_ID \ |
| 84 | + -v "$(pwd):/src" \ |
| 85 | + semgrep/semgrep semgrep ci |
| 86 | +fi |
| 87 | +``` |
| 88 | + |
| 89 | +:::note |
| 90 | +- The variable `SEMGREP_BASELINE_REF` must be set to the default branch, which, in the example, is `main`. |
| 91 | +::: |
0 commit comments