Continuous integration for Polaris

We created multiple options so you can choose the type of integration that best supports the task and your way of doing CI/CD development.

Overview

First, choose your approach:

CLI: Scripting the command line client directly into a build script or a workflow in your CI platform.
CI: Adding a plug-in to existing pipelines that run in your SCM repository or in Jenkins. Plug-ins are available in the marketplace and in many cases can be added to your configuration file by following step-by-step instructions in the documentation.
API: Use REST APIs to call services built into the product (for example, retrieve issue data and import the data into your internal dashboards).

Secondly, select the option tailored to the security products and CI/CD platforms you use.

Bridge CLI

The Bridge CLI is useful when you want a unified CLI for all the security tools offered by Black Duck: Polaris, Coverity Connect or Coverity deployed in the cloud, Black Duck, or Software Risk Manager.

Bridge does all the following:

SAST and SCA scanning
Scan in synchronous or asynchronous (non-blocking) mode
Scan whenever new code is merged to a branch
Scan whenever a pull request is created/updated
Decorate pull requests with comments
Create automatic pull requests for new fixes ("Fix PRs") - Black Duck only
Generate a SARIF file
Post results to SCM (GitHub advanced security)
Post results to any supported server (see the list of products above)

For more information, see the Using Bridge CLI with Polaris.

Plug-ins

Plug-ins are the easiest way to integrate testing into your CI/CD pipeline. All of the plug-ins are derived from the Bridge CLI, so you get the same benefits without writing all the code.

You can use the Bridge CI/CD plug-ins with any of the following products or with a combination of them: Black Duck, Coverity, Polaris, or Software Risk Manager.

Capabilities include:

SAST and SCA scanning
Scan in synchronous or asynchronous (non-blocking) mode
Scan whenever new code is merged to a branch
Scan whenever a pull request is created/updated
Decorate pull requests with comments
Create automatic pull requests for new fixes ("Fix PRs") - Black Duck only
Generate a SARIF file
Post results to SCM (GitHub advanced security)
Post results to any supported server (see the list of products above)
Make issues available in your instance of Black Duck, Coverity, Polaris, or Software Risk Manager.
Fail the build in your CI system when a high-severity issue is found

Bridge-based plug-ins are available on the following platforms:

Black Duck Security App for GitHub

The Black Duck Security App for GitHub provides a streamlined user interface for configuring security scans across your GitHub repositories. With this app, you can:

Generate and deploy workflows to multiple repositories at once
Configure scan options through a user-friendly interface
Automatically set up Polaris scans for your repositories
Review and customize generated workflow files before deployment

The app integrates seamlessly with GitHub's organization structure and permissions model, making it an ideal choice for teams that need efficient repository management.

For more information, see GitHub App – Black Duck Security.

APIs

A standardized, well-documented set of application programming interfaces is available for Polaris. Available APIs include:

Table 1. Polaris APIs and their functions
API name	Description
Audit	Retrieves detailed information about actions and events in Polaris. Audit records are discarded after 7 days.
Identity and Access Management	Provides authentication and authorization for all public APIs of the Polaris Platform.
Bug Tracking Integration	Creates tickets in Azure DevOps or Jira for issues you export from Polaris.
Notification	Manage your organization's notification settings (including notification settings for users).
Findings	Provides lists and counts of issues and issue families.
Policies	Use this service to create issue policies, component policies, and test scheduling policies. Use issue policies to automate actions when issues with specific properties are detected in a test (including setting fix-by dates, if necessary). Actions include: Sending email notifications Breaking a build Creating a ticket in Azure DevOps or Jira Use component policies to automate actions when components with specific properties are detected in a SCA test. Actions include: Sending email notifications Breaking a build Use test scheduling policies to automate tests of SCM-integrated branches on a weekly or daily basis.
Portfolio	Manages portfolios, portfolio items (applications), and portfolio sub-items (projects).
Reports	Generates, lists, and downloads reports.
Repos Integration	Manages scans in repositories, including GitHub and GitLab.
Tests	Creates and updates tests. Retrieves artifacts related to tests.
Tools	Handles retrieval of command line tools and tool-related information. Use this service to download Bridge CLI, the Polaris command line interface.

To begin using Polaris APIs, try the API Quickstart.

Other (out-of-the-box) integrations

In addition to the devops-focused integrations, other integrations are available that allow Polaris to interoperate with various tools and platforms. For more information, see Out-of-the-box integrations.