Using Rapid Scan Static for pull request workflows

This example uses polaris_test_sast_type to run a full SAST scan on branch pushes and a rapid scan for pull requests. Pull request comments are enabled by setting polaris_prComment_enabled to true. The github_token parameter uses the GitHub Actions build token (secrets.GITHUB_TOKEN) provided to the workflow to authenticate with GitHub and post comments for eligible findings associated with pull request changes. For information about configuring the required permissions, see GitHub prerequisites.

- name: Polaris Scan
  uses: blackduck-inc/black-duck-security-scan@v2
  with:
    polaris_server_url: ${{ vars.POLARIS_SERVERURL }}
    polaris_access_token: ${{ secrets.POLARIS_ACCESSTOKEN }}
    polaris_assessment_types: SAST,SCA
    polaris_test_sast_type: ${{ github.event_name != 'pull_request' && 'SAST-FULL' || 'SAST-RAPID' }}
    polaris_application_name: polaris-${{ github.event.repository.name }}
    polaris_prComment_enabled: true
    github_token: ${{ secrets.GITHUB_TOKEN }}

This example uses polaris_test_sast_type to run a full SAST scan on branch pushes and a rapid scan for pull requests. Pull request comments are enabled by setting polaris_prcomment_enabled to true. The azure_token parameter uses the Azure DevOps build token provided to the pipeline (System.AccessToken) to authenticate with Azure DevOps and post comments for eligible findings associated with pull request changes. For information about configuring the required permissions, see Setting up Black Duck Security Scan Extension.

variables:
  - group: poc.polaris.blackduck.com
  - name: SAST_TYPE
    ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
      value: 'SAST-RAPID'
    ${{ else }}:
      value: 'SAST-FULL'

steps:
- task: BlackDuckSecurityScan@2
  displayName: 'Polaris Scan'
  inputs:
    polaris_server_url: $(POLARIS_SERVERURL)
    polaris_access_token: $(POLARIS_ACCESSTOKEN)
    polaris_assessment_types: 'SAST,SCA'
    polaris_test_sast_type: $(SAST_TYPE)
    polaris_application_name: $(Build.Repository.Name)
    polaris_prcomment_enabled: true
    azure_token: $(System.AccessToken)
    include_diagnostics: false
    mark_build_status: 'SucceededWithIssues'

This example uses BRIDGE_POLARIS_TEST_SAST_TYPE to run a full SAST scan on the main, master, develop, stage, and release branches, and a rapid scan on merge requests that target those branches.

• A GitLab personal access token (PAT) is required to be configured as a masked CI/CD variable named GITLAB_USER_TOKEN. The BRIDGE_GITLAB_USER_TOKEN parameter uses this token to authenticate with GitLab and post comments for eligible findings associated with merge request changes. For information about creating and configuring the required token, see Configure GitLab user token.

• Pull request comments are enabled by setting BRIDGE_POLARIS_PRCOMMENT_ENABLED to true.

variables:
  SCAN_BRANCHES: "/^(main|master|develop|stage|release)$/"

polaris:
  stage: security

  rules:
    - if: ($CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ $SCAN_BRANCHES &&
           $CI_PIPELINE_SOURCE == 'merge_request_event')
      variables:
        BRIDGE_POLARIS_TEST_SAST_TYPE: "SAST-RAPID"

    - if: ($CI_COMMIT_BRANCH =~ $SCAN_BRANCHES &&
           $CI_PIPELINE_SOURCE != 'merge_request_event')

  variables:
    BRIDGE_GITLAB_USER_TOKEN: $GITLAB_USER_TOKEN
    BRIDGE_POLARIS_ACCESSTOKEN: $POLARIS_ACCESSTOKEN
    BRIDGE_POLARIS_SERVERURL: $POLARIS_SERVER_URL
    BRIDGE_POLARIS_APPLICATION_NAME: $CI_PROJECT_NAMESPACE-$CI_PROJECT_NAME
    BRIDGE_POLARIS_ASSESSMENT_TYPES: "SAST,SCA"
    BRIDGE_POLARIS_PRCOMMENT_ENABLED: "true"

  extends: .run-black-duck-tools

This example is a multibranch pipeline that uses polaris_test_sast_type to run a full SAST scan on protected branches and a rapid scan for pull requests that target those branches. Pull request comments are enabled by setting polaris_prComment_enabled to true.

Before using this example, ensure that the following prerequisites are met:

• Install the Black Duck Security Scan plugin to integrate with a Polaris server instance.
• Install and configure the appropriate Branch Source plugin to enable Jenkins to integrate with a source code repository and validate pull request events.
• Configure the following Jenkins Black Duck Security Scan Plugin parameters via Dashboard > Manage Jenkins > System:
  • Polaris server URL and access token. These enable the pipeline to integrate with the Polaris server.
  • Source code management token for the repository to enable the Black Duck Security Scan plugin to inject pull request review comments for new security issues uncovered during a pull request scan.

  See configure global settings in the UI in the getting started guide for further details.

• Access to a Jenkins Multibranch Pipeline Project.

pipeline {
    agent {
        label 'node'
    }

    environment {
        REPO_NAME = "${env.GIT_URL.tokenize('/.')[-2]}"

        FULLSCAN = "${env.BRANCH_NAME ==~ /^(main|master|develop|stage|release)$/ ? 'true' : 'false'}"
        PRSCAN = "${env.CHANGE_TARGET ==~ /^(main|master|develop|stage|release)$/ ? 'true' : 'false'}"

        POLARIS_SAST_TYPE = "${env.PRSCAN == 'true' ? 'SAST-RAPID' : 'SAST-FULL'}"
    }

    stages {
        stage('Polaris') {
            when {
                anyOf {
                    environment name: 'FULLSCAN', value: 'true'
                    environment name: 'PRSCAN', value: 'true'
                }
            }

            steps {
                security_scan(
                    product: 'polaris',
                    polaris_assessment_types: 'SAST,SCA',
                    polaris_application_name: "${REPO_NAME}",
                    polaris_prComment_enabled: true,
                    polaris_test_sast_type: "${env.POLARIS_SAST_TYPE}",
                    mark_build_status: 'UNSTABLE'
                )
            }
        }
    }

    post {
        always {
            cleanWs()
        }
    }
}

This example uses BRIDGE_POLARIS_TEST_SAST_TYPE to run a full SAST scan on protected branches and a rapid scan for pull requests that target those branches.

• Store a Bitbucket repository access token as a secured repository variable named BITBUCKET_REPO_ACCESS_TOKEN. The BRIDGE_BITBUCKET_API_TOKEN parameter uses this token to authenticate with Bitbucket and post comments for eligible findings associated with pull request changes. For information about creating and configuring the required token, see Setting up Black Duck Security Scan Pipe.
• Pull request comments are enabled by setting BRIDGE_POLARIS_PRCOMMENT_ENABLED to true.

definitions:
  services:
    docker:
      memory: 3072 # Allocate 3GB (3072MB) memory to docker service

  steps:
    - step: &blackduck-security-scan
        name: Polaris Black Duck Security Scan

        script:
          - |
              if [[ -z $BITBUCKET_PR_ID ]]; then
                export POLARIS_SAST_TYPE="SAST-FULL"
              else
                export POLARIS_SAST_TYPE="SAST-RAPID"
              fi

          ## For compiled languages, replace standard pipe with image containing build tools.
          ## - pipe: docker://your-registry/your-custom-image:tag
          - pipe: blackduck-inc/blackduck-security-scan:1.6.0
            variables:
              BRIDGE_POLARIS_SERVERURL: $POLARIS_SERVERURL
              BRIDGE_POLARIS_ACCESSTOKEN: $POLARIS_ACCESSTOKEN
              BRIDGE_POLARIS_ASSESSMENT_TYPES: "SCA,SAST"
              BRIDGE_POLARIS_TEST_SAST_TYPE: $POLARIS_SAST_TYPE
              BRIDGE_POLARIS_APPLICATION_NAME: $BITBUCKET_REPO_SLUG
              BRIDGE_POLARIS_PRCOMMENT_ENABLED: "true"
              BRIDGE_BITBUCKET_API_TOKEN: $BITBUCKET_REPO_ACCESS_TOKEN

pipelines:
  pull-requests:
    "**":
      - step: *blackduck-security-scan

  branches:
    "{main,master,develop,stage,release}":
      - step: *blackduck-security-scan