Multibranch pipeline

Continuous integration for Polaris

Declarative pipeline syntax example

Add the following code snippet to your Jenkinsfile in your project root directory that you want to scan. (Make sure to provide the required parameters, such as product, polaris_server_url, polaris_access_token, and polaris_assessment_types, with the appropriate values.)

Simplified example


pipeline {
    agent any
    stages {
        stage("BlackDuckSecruityScan") {
            when {
                // Triggering Black Duck Security Scan on master branch or Pull Request
                anyOf {
                    branch 'master'
                    branch pattern: "PR-\\d+", comparator: "REGEXP"
                }
            }
            steps {
                script {
                    def status = security_scan product: 'polaris',
                        // Uncomment if below parameters are not set in global configuration
                        // polaris_server_url: 'POLARIS_SERVER_URL',
                        // polaris_access_token: 'POLARIS_TOKEN', 
                        // bitbucket_token: 'BITBUCKET_TOKEN', // Used for PR comment. Use github_token for GitHub or gitlab_token for GitLab
                        // bitbucket_username:'BITBUCKET_USERNAME' // Used for bitbucket cloud pr comment if app password is set as bitbucket_token 
                            polaris_assessment_types: 'SAST,SCA'
    
                        // Pull Request Comments
                        //  polaris_prComment_enabled: true,
    
                        // Enable Polaris Fix PR
                        //  polaris_fixpr_enabled: true,

                        // SARIF report generation
                        //  polaris_reports_sarif_create: true,

                        // Binary scan: requires polaris_assessment_types set to SCA only
                        //  polaris_test_sca_type: 'SCA-BINARY',
                        //  polaris_artifactToUpload: '/path/to/binary-file',

                        // SCA container scan: requires polaris_assessment_types set to SCA only
                        //  polaris_test_sca_type: 'SCA-CONTAINER',
                        //  polaris_artifactToUpload: '/path/to/container.tar.gz',
                        //  polaris_container_name: 'unique-container-name', // use for filtering
                            
                        // Mark build status if issues found
                        //  mark_build_status: 'UNSTABLE'
                    
                    // Uncomment to add custom logic based on return status
                    // if (status == 8) { unstable 'policy violation' }
                    // else if (status != 0) { error 'plugin failure' }
                }
            }
        }
    }
}

Detailed example


pipeline {
    agent any
    stages {
        stage("BlackDuckSecruityScan") {
            when {
                // Triggering Black Duck Security Scan on master branch or Pull Request
                anyOf {
                    branch 'master'
                    branch pattern: "PR-\\d+", comparator: "REGEXP"
                }
            }
            steps {
                script {
                    def status = security_scan product: 'polaris',
                      // Uncomment if below parameters are not set in global configuration
                      // polaris_server_url: 'POLARIS_SERVER_URL',
                      // polaris_access_token: 'POLARIS_TOKEN',
                      // bitbucket_token: 'BITBUCKET_TOKEN', // Used for PR comment. Use github_token for GitHub or gitlab_token for GitLab
                      // bitbucket_username:'BITBUCKET_USERNAME' // Used for bitbucket cloud pr comment if app password is set as bitbucket_token 
                          polaris_assessment_types: 'SAST,SCA',
                      //Optional for multibranch pipeline
                      // polaris_application_name: 'POLARIS_APPLICATION_NAME', 
                      // polaris_project_name: 'POLARIS_PROJECT_NAME',
                      // polaris_branch_name: 'BRANCH_NAME',
                      // polaris_waitForScan: false,    // Used to support the async mode
                      // project_directory: "PROJECT_DIRECTORY",
                      // Uncomment this to use Source Upload method. Default value is hybrid (build based)
                      // polaris_test_sast_location: 'remote',
                      // polaris_test_sca_location: 'remote',
                      // project_source_archive: "PROJECT_SOURCE_ARCHIVE",
                      // project_source_excludes: "PROJECT_SOURCE_EXCLUDES",
                      // project_source_preserveSymLinks: "PROJECT_SOURCE_PRESERVESYMLINKS",
                      // Uncomment this to use Local Analysis feature
                      // Please use Local Analysis or Source Upload exclusively
                      // polaris_test_sast_location: 'local',
                      // Pull Request Comments
                          polaris_prComment_enabled: true,
                      // polaris_branch_parent_name: 'PARENT_BRANCH_NAME',
                      // Enable SCA and/or SAST Polaris Fix PRs based on polaris_assessment_type setting
                      // polaris_fixpr_enabled: true,
                      // polaris_fixpr_maxCount: 5, // Shared limit across SAST and SCA Fix PRs
                      // polaris_fixpr_useUpgradeGuidance: 'SHORT_TERM,LONG_TERM', // Order of SCA upgrade guidance preference (comma-separated)
                      // polaris_fixpr_filter_severities: 'CRITICAL,HIGH', // SAST and/or SCA Fix PR severity filter
                      // SARIF report generation
                          polaris_reports_sarif_create: true,
                      // Optional parameters
                      // polaris_reports_sarif_file_path: 'SARIF_FILE_PATH',
                      // polaris_reports_sarif_groupSCAIssues: true,
                      // polaris_reports_sarif_issue_types: 'SAST, SCA',
                      // polaris_reports_sarif_severities: 'CRITICAL,HIGH',
                      // Signature scan
                      // polaris_test_sca_type: 'SCA-SIGNATURE',
                      // Binary analysis scan: requires polaris_assessment_types set to SCA only
                      // polaris_test_sca_type: 'SCA-BINARY',
                      // polaris_artifactToUpload: '/path/to/binary-file',
                      // SCA container scan: requires polaris_assessment_types set to SCA only
                      // polaris_test_sca_type: 'SCA-CONTAINER',
                      // polaris_artifactToUpload: '/path/to/container.tar.gz',
                      // polaris_container_name: 'unique-container-name', // use for filtering
                      // Sigma Rapid scan
                      // polaris_test_sast_type: 'SAST_RAPID',
                      // Uncomment below to add arbitrary CL parameters
                      // detect_search_depth: 1,
                      // detect_config_path: '/USER/application.properties',
                      // detect_args: '--detect.diagnostic=true',
                      // coverity_build_command: 'mvn clean install',
                      // coverity_clean_command: 'mvn clean',
                      // coverity_config_path: '/USER/coverity.yml',
                      // coverity_args: '--config-override capture.build.build-command=mvn install',
                      // coverity_version: '2025.9.0',
                      // Mark build status if issues found
                          mark_build_status: 'UNSTABLE'
                   // Uncomment to add custom logic based on return status
                  // if (status == 8) { unstable 'policy violation' }
                  // else if (status != 0) { error 'plugin failure' }
                }
            }
        }
    }
}

Scripted pipeline syntax example

Add the following code snippet to your Jenkinsfile in your project root directory that you want to scan. (Make sure to provide the required parameters, such as product, polaris_server_url, polaris_access_token, and polaris_assessment_types, with the appropriate values.)

Simplified example


node {
    checkout scm
    
    stage("BlackDuckSecruityScan") {
        // Trigger Black Duck Security Scan on master branch or Pull Request
        if (env.BRANCH_NAME == 'master' || env.BRANCH_NAME =~ /^PR-\d+$/) {
            def status = security_scan product: 'polaris',
                // Uncomment if below parameters are not set in global configuration
                // polaris_server_url: 'POLARIS_SERVER_URL',
                // polaris_access_token: 'POLARIS_TOKEN', 
                // bitbucket_token: 'BITBUCKET_TOKEN', // Used for PR comment. Use github_token for GitHub or gitlab_token for GitLab
                // bitbucket_username:'BITBUCKET_USERNAME' // Used for bitbucket cloud pr comment if app password is set as bitbucket_token 
                polaris_assessment_types: 'SAST,SCA'
                // Binary analysis scan: requires polaris_assessment_types set to SCA only
                //  polaris_test_sca_type: 'SCA-BINARY',
                //  polaris_artifactToUpload: '/path/to/binary-file',
                // SCA container scan: requires polaris_assessment_types set to SCA only
                //  polaris_test_sca_type: 'SCA-CONTAINER',
                //  polaris_artifactToUpload: '/path/to/container.tar.gz',
                //  polaris_container_name: 'unique-container-name', // use for filtering

                // Pull Request Comments
                //  polaris_prComment_enabled: true

                // Enable Polaris Fix PR
                //  polaris_fixpr_enabled: true

                // SARIF report generation
                //  polaris_reports_sarif_create: true
                
                // Mark build status if issues found
                //  mark_build_status: 'UNSTABLE'
                
            // Uncomment to add custom logic based on return status
            // if (status == 8) { unstable 'policy violation' }
            // else if (status != 0) { error 'plugin failure' }

        }
    }
}

Detailed example


node {
    checkout scm
    stage("BlackDuckSecruityScan") {
        // Trigger Black Duck Security Scan on master branch or Pull Request
        if (env.BRANCH_NAME == 'master' || env.BRANCH_NAME =~ /^PR-\d+$/) {
            def status = security_scan product: 'polaris',
                // Uncomment if below parameters are not set in global configuration
                // polaris_server_url: 'POLARIS_SERVER_URL',
                // polaris_access_token: 'POLARIS_TOKEN', 
                // bitbucket_token: 'BITBUCKET_TOKEN', // Used for PR comment. Use github_token for GitHub or gitlab_token for GitLab
                // bitbucket_username:'BITBUCKET_USERNAME' // Used for bitbucket cloud pr comment if app password is set as bitbucket_token 
                polaris_assessment_types: 'SAST,SCA',
                // Optional for multibranch pipeline
                // polaris_application_name: 'POLARIS_APPLICATION_NAME', 
                // polaris_project_name: 'POLARIS_PROJECT_NAME',
                // polaris_branch_name: 'BRANCH_NAME',
                // polaris_waitForScan: false,    // Used to support the async mode
                // project_directory: "PROJECT_DIRECTORY",
                // Uncomment this to use Source Upload method. Default value is hybrid (build based)
                // polaris_test_sast_location: 'remote',
                // polaris_test_sca_location: 'remote',
                // project_source_archive: "PROJECT_SOURCE_ARCHIVE",
                // project_source_excludes: "PROJECT_SOURCE_EXCLUDES",
                // project_source_preserveSymLinks: "PROJECT_SOURCE_PRESERVESYMLINKS",
                // Uncomment this to use Local Analysis feature
                // Please use Local Analysis or Source Upload exclusively
                // polaris_test_sast_location: 'local',
                // Pull Request Comments
                polaris_prComment_enabled: true,
                // polaris_branch_parent_name: 'PARENT_BRANCH_NAME',
                // Enable SCA and/or SAST Polaris Fix PRs based on polaris_assessment_type setting
                // polaris_fixpr_enabled: true,
                // polaris_fixpr_maxCount: 5, // Shared limit across SAST and SCA Fix PRs
                // polaris_fixpr_useUpgradeGuidance: 'SHORT_TERM,LONG_TERM', // Order of SCA upgrade guidance preference (comma-separated)
                // polaris_fixpr_filter_severities: 'CRITICAL,HIGH', // SAST and/or SCA Fix PR severity filter
                // SARIF report generation
                polaris_reports_sarif_create: true,
                // Optional parameters
                // polaris_reports_sarif_file_path: 'SARIF_FILE_PATH',
                // polaris_reports_sarif_groupSCAIssues: true,
                // polaris_reports_sarif_issue_types: 'SAST, SCA',
                // polaris_reports_sarif_severities: 'CRITICAL,HIGH',
                // Signature scan
                // polaris_test_sca_type:"SCA-SIGNATURE",
                // Binary analysis scan: requires polaris_assessment_types set to SCA only
                // polaris_test_sca_type: 'SCA-BINARY',
                // polaris_artifactToUpload: '/path/to/binary-file',
                // SCA container scan: requires polaris_assessment_types set to SCA only
                // polaris_test_sca_type: 'SCA-CONTAINER',
                // polaris_artifactToUpload: '/path/to/container.tar.gz',
                // polaris_container_name: 'unique-container-name', // use for filtering
                // Sigma Rapid scan
                // polaris_test_sast_type: "SAST_RAPID",
                // Uncomment below to add arbitrary CL parameters
                // detect_search_depth: 1,
                // detect_config_path: '/USER/application.properties',
                // detect_args: '--detect.diagnostic=true',
                // coverity_build_command: 'mvn clean install',
                // coverity_clean_command: 'mvn clean',
                // coverity_config_path: '/USER/coverity.yml',
                // coverity_args: '--config-override capture.build.build-command=mvn install',
                // coverity_version: '2025.9.0',
                // Mark build status if issues found
                mark_build_status: 'UNSTABLE'
            // Uncomment to add custom logic based on return status
            // if (status == 8) { unstable 'policy violation' }
            // else if (status != 0) { error 'plugin failure' }
        }
    }
}
Note:
  • If polaris_server_urland polaris_access_token are configured in Jenkins Global Configuration, then it is not necessary to pass these values as a pipeline input parameter.
  • If these values are set both from Jenkins Global Configuration and as a pipeline input parameter, then the pipeline input values will take precedence.