Skip to Content

Changes for page Jenkins Shared Library

Last modified by Boris Folgmann on 2025/11/03 09:41
From version 6.1
edited by Boris Folgmann
on 2025/11/03 08:48
Change comment: There is no comment for this version
To version 2.1
edited by Boris Folgmann
on 2025/04/29 12:01
Change comment: Added sonarQualityGate

Summary

Details

Page properties
Content
... ... @@ -26,9 +26,8 @@
26 26  1. Checking out the source code from git.
27 27  1. If a pom.xml is found your favorite JDK is selected, by default jdk11. Then a maven build is done.
28 28  1. If there's no pom.xml but a package.json is found a nodejs build is done.
29 -1. If there is no pom.xml or package.json but a go.mod file, a go build is done.
30 30  1. Then the following stages are executed in parallel
31 -11. Analysis: For maven projects the Java source code is checked by checkstyle, pmd and spotbugs. Furthermore the job output will be checked for any warnings generated by maven, javac or javadoc. If Python modules (.py files) exist in the git repository they will be analyzed using pylint and flake8. If pylint or flake8 are not available on the Jenkins agent the steps will be skipped. Python files that are generated or downloaded into the workspace will not be checked. The results will be displayed on the classical Jenkins build page after the build. For Go projects, the Go test tool is used to run all tests and produce a coverage output file for SonarQube. Additionally, the gotestsum tool is used to produce a report which is picked up by Jenkins.</dd>
30 +11. Analysis: For maven projects the Java source code is checked by checkstyle, pmd and spotbugs. Furthermore the job output will be checked for any warnings generated by maven, javac or javadoc. If Python modules (.py files) exist in the git repository they will be analyzed using pylint and flake8. If pylint or flake8 are not available on the Jenkins agent the steps will be skipped. Python files that are generated or downloaded into the workspace will not be checked. The results will be displayed on the classical Jenkins build page after the build.
32 32  11. Security: If it's not a feature or bugfix branch a dependency check is done which checks if e.g. libraries are used which have known vulnerabilities. The results will be displayed in Jenkins after the build.
33 33  11. Docker: this will also work for projects which are neither maven or nodejs. A Dockerfile is enough to trigger this part of the pipeline.
34 34  111. If a Dockerfile is found a docker image is built.
... ... @@ -126,12 +126,8 @@
126 126  )))|(((
127 127  'npm install && npm run build ~-~-prod'
128 128  )))|(((
129 -npm command to execute for building Node.JS projects.
128 +npm command to execute for building Node.JS projects.
130 130  )))
131 -|= |goBuildCommand|(((
132 -'go build -o app cmd/server/main.go'
133 -)))|go build run. Should be overridden for your project.
134 -|= |goTestCommand|'gotestsum ~-~-format pkgname ~-~-junitfile report.xml ~-~- -failfast -race -coverprofile=coverage.out -tags=test ./...'|Runs gotestsum tool which in turn calls 'go test' for all packages in the project. Should be overridden for your project. The gotestsum tool is available out-of-the-box and produces a report file which is picked up by Jenkins automatically.
135 135  |=(% rowspan="10" %)(((
136 136  Docker build
137 137  )))|(((
... ... @@ -351,7 +351,7 @@
351 351  )))|(((
352 352  Id of the Jenkins Credentials for signers private keyfile.
353 353  )))
354 -|=(% colspan="1" rowspan="12" %)(((
349 +|=(% rowspan="11" %)(((
355 355  Static Source Code Analysis
356 356  )))|(((
357 357  checkstyleConfig
... ... @@ -401,13 +401,15 @@
401 401  |(((
402 402  sonarQube
403 403  )))|(((
404 -true for the defaultBranch and for pull-requests, if a SonarQube version is detected which supports scanning multiple branches
399 +true for the defaultBranch
405 405  
406 -false for all other branches
401 +false for all other branches and pull-requests
407 407  )))|(((
408 -Set this to true to force a SonarQube scan for the current branch. Usually this makes only sense if you explicitly want to scan feature and bugfix branches.
403 +Boolean which determines if SonarQube should be used if an installation is found.
409 409  
410 -If not set or set to false, the default branch will be scanned automatically as well as pull-requests, if a SonarQube version is detected which supports scanning multiple branches. This is currently the case for SonarQube Developer and Enterprise editions. The free SonarQube Community edition supports just one branch.
405 +The default is the best choice for the free community edition of SonarQube, which supports just one branch.
406 +
407 +If you have the Developer or Enterprise edition consider setting sonarQube to true to cover all branches. For more information see [[SonarQube>>SonarQube.WebHome]].
411 411  )))
412 412  |(((
413 413  sonarScanMavenOpts
... ... @@ -446,19 +446,9 @@
446 446  {{/code}}
447 447  )))
448 448  )))
449 -|sonarQualityGate| |Sets the desired quality gate to use for the scan result in SonarQube.
446 +|= |sonarQualityGate| |Sets the desired quality gate to use for the scan result in SonarQube.
450 450  If not specified, the quality gate is not changed.
451 451  As a default, SonarQube will use the quality gate "Sonar way" for new scan results.
452 -|=(% colspan="1" rowspan="2" %)Dependency Track|depTrackCredentialsId|'PROJECTKEY-deptrack-projectcreator'|(((
453 -Id of the Jenkins Credential which has to be used to authenticate to Dependency Track for publishing the SBOM.
454 -)))
455 -|depTrackClassifier|'application'|The component type (e.g. application, library, firmware, ...) that should be set in the SBOM file.
456 -Will be later shown as classifier for the project in Dependency Track.
457 -See [[CycloneDX Metadata Component Type>>https://cyclonedx.org/docs/1.6/json/#metadata_component_type]] for supported values.
458 -|=(% colspan="1" rowspan="2" %)Trivy|trivySeverity|'High'|String which sets the minimum severity of Trivy findings that has to be reached to mark the Trivy Results stage as unstable.
459 -Possible values are: "None", "Unknown", "Negligible", "Low", "Medium", "High", "Critical".
460 -|trivyBuildResult|'SUCCESS'|String which sets the overall build result when the result of the Trivy scan reaches trivyServerity.
461 -Possible values are: "SUCCESS", "UNSTABLE" or "FAILURE"
462 462  |=(% rowspan="7" %)(((
463 463  Deployment
464 464  )))|(((
© 2018-2025 T-Systems International GmbH