Note: The Jenkins plugin is deprecated.
The Black Duck Rapid Scan Static plugin is a Jenkins plugin, intended to be used with the Sigma binary download. This plugin provides the following:
- A Sigma Tool Installation to install on Jenkins Agents to execute the Sigma tool.
-
A Jenkins build step to execute Sigma analysis of source code and to produce a results file (sigma-results.json) that contains the issues found.
- An integration with the Warnings Next Generation Jenkins plugin to record Sigma issues post build.
This chapter explains how you use the Black Duck Rapid Scan Static plugin to execute Sigma in a Jenkins build either as a quality gate or to report static analysis issues.
Note: If you are using the Sigma Docker image, please see Getting the Docker Image for instructions.
The basic workflow for installing, configuring, and using the Black Duck Rapid Scan Static plugin is as follows:
- The administrator downloads the Sigma binaries to be used.
- The administrator installs the Black Duck Rapid Scan Static Jenkins plugin.
- The administrator configures the Sigma installation on the Jenkins agent.
- The user creates a Jenkins Freestyle project or a Jenkins Pipeline.
- The Jenkins Freestyle project or Pipeline is executed as part of the development process.