Skip to Content

Changes for page Jenkins Shared Library

Last modified by Boris Folgmann on 2026/03/30 10:13
From version 11.4
edited by Boris Folgmann
on 2026/03/30 10:09
Change comment: There is no comment for this version
To version 2.3
edited by Boris Folgmann
on 2025/07/09 16:13
Change comment: There is no comment for this version

Summary

Details

Page properties
Content
... ... @@ -6,7 +6,7 @@
6 6  
7 7  == Getting Started ==
8 8  
9 -Since the Shared Library is globally configured on all Jenkins instances managed by DevOps-as-a-Service you just need to place the following very short Jenkinsfile in the root folder of your git repository to automatically build your maven, node or go project or simply build a container using a Dockerfile.
9 +Since the Shared Library is globally configured on all Jenkins instances managed by DevOps-as-a-Service you just need to place the following very short Jenkinsfile in the root folder of your git repository to automatically build your maven or node project or simply build a container using a Dockerfile.
10 10  
11 11  {{code}}
12 12  @Library('sdcloud') _
... ... @@ -21,35 +21,28 @@
21 21  
22 22  What the pipeline currently does is visualised in the following image which shows an example for a maven-based Java project.
23 23  
24 -[[image:1762161531690-966.png||data-xwiki-image-style-border="true" height="247" width="1654"]]
24 +[[image:attach:image2022-5-17_17-51-43.png||height="250"]]
25 25  
26 -1. **sdcPipeline **prints some valuable information about this shared Jenkinslib. Allocates a node (Jenkins Agent) to start executing the pipeline.
27 -1. **Checkout**: checking out the source code from git.
28 -1. **JDK**: If a pom.xml is found, your favorite JDK or the current default is selected .
29 -1. **Maven Build**: If a pom.xml is found, a maven build is done.
30 -1. If there's no pom.xml, but a package.json is found a nodejs build is done.
31 -1. If there is no pom.xml or package.json but a go.mod file, a go build is done.
26 +1. Checking out the source code from git.
27 +1. If a pom.xml is found your favorite JDK is selected, by default jdk11. Then a maven build is done.
28 +1. If there's no pom.xml but a package.json is found a nodejs build is done.
32 32  1. Then the following stages are executed in parallel
33 -11. **Analysis**: For maven projects the Java source code is checked by checkstyle, pmd and spotbugs. Furthermore the job output will be checked for any warnings generated by maven, javac or javadoc.
34 -If Python modules (.py files) exist in the git repository they will be analyzed using pylint and flake8. If pylint or flake8 are not available on the Jenkins agent the steps will be skipped. Python files that are generated or downloaded into the workspace will not be checked. The results will be displayed on the classical Jenkins build page after the build. For Go projects, the Go test tool is used to run all tests and produce a coverage output file for SonarQube. Additionally, the gotestsum tool is used to produce a report which is picked up by Jenkins.
35 -If SonarQube is configured fore this Jenkins instance, a **Sonar Scan** is performed on the agent and the result is pushed to SonarQube for further processing.
36 -11. **Security**:
37 -111. If it's not a feature or bugfix branch, a dependency check is done which checks if e.g. libraries are used which have known vulnerabilities. The results will be displayed in Jenkins after the build.
38 -111. If Dependency Track is enabled for the current project, an SBOM file is created and archived in the build. In addition it's pushed to Dependency Track. Jenkins will wait for DepTrack to process the SBOM and display information about found potential vulnerabilities in the build.
39 -11. **Docker**: this will also work for projects which are neither maven, nodejs or go. A Dockerfile is enough to trigger this part of the pipeline.
40 -111. **Build Container Image**: If a Dockerfile is found a docker image is built.
41 -111. **Test Container Image**: The image is started as an isolated container on the Jenkins agent. Any loglines written to stdout or stderr by the container will be displayed.A smoke test is performed which is a simple query for a valid answer on the exposed port of the container.
42 -111. **Push Container Image**: If the smoke test was successful the container image will be pushed to the image registry.
43 -For easy identification of the image 3 image tags are defined:
30 +11. Analysis: For maven projects the Java source code is checked by checkstyle, pmd and spotbugs. Furthermore the job output will be checked for any warnings generated by maven, javac or javadoc. If Python modules (.py files) exist in the git repository they will be analyzed using pylint and flake8. If pylint or flake8 are not available on the Jenkins agent the steps will be skipped. Python files that are generated or downloaded into the workspace will not be checked. The results will be displayed on the classical Jenkins build page after the build.
31 +11. Security: If it's not a feature or bugfix branch a dependency check is done which checks if e.g. libraries are used which have known vulnerabilities. The results will be displayed in Jenkins after the build.
32 +11. Docker: this will also work for projects which are neither maven or nodejs. A Dockerfile is enough to trigger this part of the pipeline.
33 +111. If a Dockerfile is found a docker image is built.
34 +111. The image is started as an isolated container on the Jenkins agent.
35 +111. Any loglines written to stdout or stderr by the container will be displayed.
36 +111. A smoke test is performed which is a simple query for a valid answer on the exposed port of the container.
37 +111. If the smoke test was successful and the build was not done for a pull request the docker image will be pushed to the docker registry.
38 +111. For easy identification of the image 3 image tags are defined:
44 44  1111. BRANCH_NAME-BUILD_NUMBER (e.g. 'production-1014')
45 45  1111. BRANCH_NAME-GIT_HASH (e.g. 'develop-8a7c4f2')
46 46  1111. BRANCH_NAME-latest (e.g. 'feature-PKEY-42-latest')
47 47  1111. (If BRANCH_NAME is defaultBranch the prefix 'BRANCH_NAME-' will not be included.)
48 -111. **Create Helm Chart**: When a chart/Chart.yaml is found and it's not a pull-request, a Helm Chart will be created and pushed to the Helm Chart repository.
49 -1. **Yamllint **will check all YAML files in the workspace for errors and warnings. This is done at this place since the Create Helm Chart stage modifies or creates YAML files which should be also checked before the pipeline proceeds.
50 -1. **Deploy application**: when depolyHelmChart is set to true the Helm chart will be deployed to the Kubernestes cluster and namespace of your choice. Not done in the example diagram.
51 -1. **Trivy Results**: if a container image was pushed to Harbor as the container registry, the results of the Trivy security scan are fetched from Harbor
52 -1. **Sonar Results**: finally the pipeline waits for the result of the Sonar Quality Gate to decide on the success of the build.
43 +111. When a chart/Chart.yaml is found and  it's not a pull request a Helm Chart will be created and pushed to the Helm Chart repository.
44 +1. Yamllint will check all YAML files in the workspace for errors and warnings. This is done at this place since the Create Helm Chart stage modifies or creates YAML files which should be also checked before the pipeline proceeds.
45 +1. When depolyHelmChart is set to true the Helm chart will be deployed to the Kubernestes cluster and namespace of your choice. Not done in the example diagram.
53 53  
54 54  == {{id name="pipeline_customization"/}}Pipeline Customization ==
55 55  
... ... @@ -132,16 +132,10 @@
132 132  )))|(((
133 133  'npm install && npm run build ~-~-prod'
134 134  )))|(((
135 -npm command to execute for building Node.JS projects.
128 +npm command to execute for building Node.JS projects.
136 136  )))
137 -|= |go|'go'|Golang version to use.
138 -Refers to a symbolic name of a go tool configuration in Jenkins.
139 -|= |goBuildCommand|(((
140 -'go build -o app cmd/server/main.go'
141 -)))|go build run. Should be overridden for your project.
142 -|= |goTestCommand|'gotestsum ~-~-format pkgname ~-~-junitfile report.xml ~-~- -failfast -race -coverprofile=coverage.out -tags=test ./...'|Runs gotestsum tool which in turn calls 'go test' for all packages in the project. Should be overridden for your project. The gotestsum tool is available out-of-the-box and produces a report file which is picked up by Jenkins automatically.
143 143  |=(% rowspan="10" %)(((
144 -Container build
131 +Docker build
145 145  )))|(((
146 146  dockerBuildPath
147 147  )))|(((
... ... @@ -215,7 +215,7 @@
215 215  Id of the Jenkins Credentials which have to be used to authenticate to the //pullDockerRegistry//.
216 216  )))
217 217  |=(% rowspan="7" %)(((
218 -Container test
205 +Docker container test
219 219  )))|(((
220 220  skipSmokeTest
221 221  )))|(((
... ... @@ -266,7 +266,7 @@
266 266  Total time in seconds after which the container is expected to be up and running even if it's still writing loglines to stdout. After this time has passed the container will be queried for an answer.
267 267  )))
268 268  |=(% rowspan="2" %)(((
269 -Image push
256 +Docker push
270 270  )))|(((
271 271  pushDockerRegistry
272 272  )))|(((
... ... @@ -282,7 +282,7 @@
282 282  Id of the Jenkins Credentials which have to be used to authenticate to the //pullDockerRegistry//.
283 283  )))
284 284  |=(% rowspan="6" %)(((
285 -Helm Chart
272 +Helm chart
286 286  )))|(((
287 287  helmChartPath
288 288  )))|(((
... ... @@ -318,11 +318,9 @@
318 318  |(((
319 319  helmRegistry
320 320  )))|(((
321 -Helm registry of your DOaaS instance, which is usally 'https:~/~/registry-CUSTOMER.devops.t-systems.net/chartrepo/PROJECTKEY'
308 +Nexus registry of your DOaaS instance
322 322  )))|(((
323 -Helm registry to which the packaged Helm chart is uploaded.
324 -
325 -
310 +Name of registry to which the packaged Helm chart is uploaded.
326 326  )))
327 327  |(((
328 328  helmRegistryCredentialsId
... ... @@ -329,12 +329,8 @@
329 329  )))|(((
330 330   'doaas-PROJECTKEY+jenkins-push-harbor' or 'PROJECTKEY-jenkins' (which were added to the credentials of your project folder in Jenkins when the project was set up by the DevOps Portal. While the first is added for Harbor, the second is added for Nexus OSS. That means that the library will automatically choose the best default for you. Please note that Harbor will be prefered, if both tools are used in the project.)
331 331  )))|(((
332 -Id of the Jenkins Credentials which have to be used to authenticate to the Helm registry for accessing Helm charts.
317 +Id of the Jenkins Credentials which have to be used to authenticate to the Helm registry for acccessing Helm charts.
333 333  )))
334 -|= |pullHelmRegistry|Helm registry of your DevOps-as-a-Service instance which is usually 'oci:~/~/registry-CUSTOMER.devops.t-systems.net/'|Helm registry from which dependencies referenced in your chart are pulled.
335 -|= |pullHelmRegistryCredentialsId|the value set by helmRegistryCredentialsId|Id of the Jenkins Credentials which have to be used to authenticate to the pull Helm registry for pulling Helm charts.
336 -|= |pushHelmRegistry|Defaults to the Helm registry of your DevOps-as-a-Service instance which is usally 'oci:~/~/registry-CUSTOMER.devops.t-systems.net/'|Helm registry to which your chart is pushed.
337 -|= |pushHelmRegistryCredentialsId|the value set by helmRegistryCredentialsId|Id of the Jenkins Credentials which have to be used to authenticate to the push Helm registry for pushing Helm charts.
338 338  |=(% rowspan="4" %)(((
339 339  Container image signature
340 340  )))|(((
... ... @@ -365,7 +365,7 @@
365 365  )))|(((
366 366  Id of the Jenkins Credentials for signers private keyfile.
367 367  )))
368 -|=(% colspan="1" rowspan="8" %)(((
349 +|=(% colspan="1" rowspan="12" %)(((
369 369  Static Source Code Analysis
370 370  )))|(((
371 371  checkstyleConfig
... ... @@ -390,16 +390,42 @@
390 390  )))|(((
391 391   Name of a config file to use for yamllint. If not set a best-practice[[ relaxed configuration >>url:https://prd.sdc.t-systems.net/bitbucket/projects/DEVOPSAAS/repos/sdcloud-caas-jenkins-libs/browse/resources/com/tsystems/sdc/jenkinslib/yamllint.yml||shape="rect"]]is used which is different from the original yamllint[[ config>>url:https://yamllint.readthedocs.io/en/stable/configuration.html#default-configuration||shape="rect"]].
392 392  )))
374 +|skipDependencyCheck|false|Set to true to skip the dependency-check.
393 393  |(((
376 +dependencyCheckTool
377 +)))|(((
378 +'dependency-check'
379 +)))|(((
380 +Defines which named dependency-check tool should be used.
381 +)))
382 +|(((
383 +dependencyCheckArgs
384 +)))|(((
385 +'~-~-disableAssembly ~-~-nvdValidForHours 720'
386 +)))|(((
387 +Addtional arguments which are be passed to dependency-check. See [[Dependency>>url:https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html||shape="rect"]][[ Check CLI Arguments>>url:https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html||shape="rect"]] for more information.
388 +)))
389 +|(((
390 +dependencyCheckNvdApiKeyCredentialsId
391 +)))|(((
392 +'dependency-check-nvdapikey'
393 +)))|(((
394 +If you have your own NVD API Key, set it as a credential of type text in Jenkins. Then specify the credential id using this argument. It will be automatically passed to dependency-check. There will be no error if no credential is found. Just the NVD download will be slower. Please note, on DevOps-as-a-Service a shared NVD API Key is automatically supplied for the default credential id.
395 +)))
396 +|(((
394 394  sonarQube
395 395  )))|(((
396 -true for the defaultBranch and for pull-requests, if a SonarQube version is detected which supports scanning multiple branches
399 +true for the defaultBranch
397 397  
398 -false for all other branches
401 +false for all other branches and pull-requests
399 399  )))|(((
400 -Set this to true to force a SonarQube scan for the current branch. Usually this makes only sense if you explicitly want to scan feature and bugfix branches.
403 +Boolean which determines if SonarQube should be used if an installation is found.
401 401  
402 -If not set or set to false, the default branch will be scanned automatically as well as pull-requests, if a SonarQube version is detected which supports scanning multiple branches. This is currently the case for SonarQube Developer and Enterprise editions. The free SonarQube Community edition supports just one branch.
405 +The default is the best choice for the free community edition of SonarQube, which supports just one branch.
406 +
407 +If you have the Developer or Enterprise edition consider setting sonarQube to true to cover all branches. For more information see [[SonarQube>>SonarQube.WebHome]].
408 +
409 +Set this to true to force a SonarQube scan for the current branch. Usually this makes only sense if you explicitly want to scan feature and bugfix branches. If not set or set to false, the default branch will be scanned automatically as well as pull-requests if a SonarQube version is detected which supports scanning multiple branches. This is currently the case for SonarQube Developer and Enterprise editions. The free SonarQube Community edition supports just one branch.
403 403  )))
404 404  |(((
405 405  sonarScanMavenOpts
... ... @@ -441,23 +441,6 @@
441 441  |sonarQualityGate| |Sets the desired quality gate to use for the scan result in SonarQube.
442 442  If not specified, the quality gate is not changed.
443 443  As a default, SonarQube will use the quality gate "Sonar way" for new scan results.
444 -|=(% colspan="1" rowspan="5" %)Dependency Check|skipDependencyCheck|false|Set to true to skip the dependency-check.
445 -|dependencyCheckTool|'dependency-check'|Defines which named dependency-check tool should be used.
446 -|dependencyCheckMvnArgs|'-DassemblyAnalyzerEnabled=false'|Additional arguments which are be passed to dependency-check for maven projects.(((
447 -See [[Dependency Check Maven Configuration>>https://jeremylong.github.io/DependencyCheck/dependency-check-maven/configuration.html]] for more information.
448 -)))
449 -|dependencyCheckArgs|'~-~-disableAssembly'|Addtional arguments which are be passed to dependency-check. See [[Dependency>>url:https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html||shape="rect"]][[ Check CLI Arguments>>url:https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html||shape="rect"]] for more information.
450 -|dependencyCheckNvdApiKeyCredentialsId|'dependency-check-nvdapikey'|If you have your own NVD API Key, set it as a credential of type text in Jenkins. Then specify the credential id using this argument. It will be automatically passed to dependency-check. There will be no error if no credential is found. Just the NVD download will be slower. Please note, on DevOps-as-a-Service a shared NVD API Key is automatically supplied for the default credential id.
451 -|=(% colspan="1" rowspan="2" %)Dependency Track|depTrackCredentialsId|'PROJECTKEY-deptrack-projectcreator'|(((
452 -Id of the Jenkins Credential which has to be used to authenticate to Dependency Track for publishing the SBOM.
453 -)))
454 -|depTrackClassifier|'application'|The component type (e.g. application, library, firmware, ...) that should be set in the SBOM file.
455 -Will be later shown as classifier for the project in Dependency Track.
456 -See [[CycloneDX Metadata Component Type>>https://cyclonedx.org/docs/1.6/json/#metadata_component_type]] for supported values.
457 -|=(% colspan="1" rowspan="2" %)Trivy|trivySeverity|'High'|String which sets the minimum severity of Trivy findings that has to be reached to mark the Trivy Results stage as unstable.
458 -Possible values are: "None", "Unknown", "Negligible", "Low", "Medium", "High", "Critical".
459 -|trivyBuildResult|'SUCCESS'|String which sets the overall build result when the result of the Trivy scan reaches trivyServerity.
460 -Possible values are: "SUCCESS", "UNSTABLE" or "FAILURE"
461 461  |=(% rowspan="7" %)(((
462 462  Deployment
463 463  )))|(((
1762161476370-318.png
Author
... ... @@ -1,1 +1,0 @@
1 -xwiki:XWiki.borisfolgmannt-systemscom
Size
... ... @@ -1,1 +1,0 @@
1 -79.4 KB
Content
1762161531690-966.png
Author
... ... @@ -1,1 +1,0 @@
1 -xwiki:XWiki.borisfolgmannt-systemscom
Size
... ... @@ -1,1 +1,0 @@
1 -82.3 KB
Content
© 2018-2026 T-Systems International GmbH