Plug-in integrations

Black Duck Documentation
Version
2026.4

Plug-ins are the easiest way to integrate testing into your CI/CD pipeline. Choose from CI/CD plug-in integrations derived from either of the CLI clients above: Detect or the Bridge CLI.

Detect-based CLI plug-ins

Jenkins

The Detect Extension for Jenkins enables you to install and run Black Duck Detect in your Jenkins instance.

Capabilities include:

  • Performing compositional analysis and functioning as a Black Duck intelligent scan client.

  • Sending scan results to your Black Duck SCA server, which generates risk analysis when identifying open source components, licenses, and security vulnerabilities.

  • Running Detect as either of the following:

    • A post-build action in a Jenkins Freestyle job.

    • Pipeline step using a Pipeline script in a Pipeline job.

Azure

The Detect Extension for Azure DevOps is designed to integrate Black Duck Detect seamlessly into Azure DevOps build and release pipelines.

It includes the ability to:

  • Run a component scan in an Azure DevOps job.

  • Create projects and releases in Black Duck SCA through the Azure DevOps job.

  • Make results available on the Black Duck SCA server.

GitHub

The Detect GitHub Action plug-in integrates Black Duck Detect into GitHub action workflows.

Capabilities include all of the following:

  • Run a component scan in a GitHub workflow.

  • Upload results to a project in Black Duck SCA.

  • Configure Detect in either of two modes:

    • Rapid scan mode to get detailed Black Duck policy reports (default behavior)

    • Intelligent scan mode to upload your data into Black Duck for more detailed analysis.

Note: As of October 2024, we recommend using the newer, Bridge-based GitHub Action for creating new pipelines, rather than Detect GitHub Action.

Bridge-based CI Plug-ins

Our latest plug-ins are built with the Bridge CLI Client under the hood, so you get the same benefits without writing the code.

Capabilities include:

  • SAST and SCA scanning

  • Scan in synchronous or asynchronous (non-blocking) mode

  • Scan whenever new code is merged to a branch

  • Scan whenever a pull request is created/updated

  • Decorate PRs with comments

  • Create Fix PRs (Black Duck SCA only)

  • Generates a SARIF file

  • Post results to SCM (GitHub advanced security)

  • Post results to any supported server (see the list of products above).

  • Make issues available in your instance of Black Duck SCA, Coverity, Polaris, or SRM.

  • Fail the build in your CI system when a high-severity issue is found.

Bridge plug-ins for Black Duck are available on the following platforms: