stackrox / jenkins-plugin

The StackRox Jenkins Plugin for image scanning and security

jenkins-plugin

The StackRox Jenkins Plugin for image scanning and security.

Configuration

Please take a look at plugin README

Development

Setup

0. Requirements

• Podman/Docker
• Java 8

1. Create HPI file

 cd stackrox-container-image-scanner
 ./mvnw package && ./mvnw hpi:hpi

2. Run Jenkins with plugin installed

cp  stackrox-container-image-scanner/target/stackrox-container-image-scanner.hpi jenkins/
docker build -t jenkins-test  jenkins
docker run -d --add-host host.docker.internal:host-gateway -p 8080:8080 jenkins-test

4. Run the E2E tests

export JENKINS_ROX_ENDPOINT='https://host.docker.internal:8000' # endpoint accessed by jenkins
export ROX_ENDPOINT='https://localhost:8000' # endpoint accessed from local machine
export ROX_PASSWORD=... # stackrox admin password
make -C functionaltest-jenkins-plugin test

5. This project uses Lombok so you may need to enable Annotation Processing

Updating API Schema

1. Go to recent version of running rox instance (e.g. https://k8s.demo.stackrox.com)
2. Navigate to API Docs /main/apidocs
3. Download OpenAPI specification (link may change between versions)
4. Convert JSON to YAML (e.g. with https://editor.swagger.io/)
5. Add authorization methods if it's not defined
   • In components: add

   securitySchemes:
       basicAuth:
           type: http
           scheme: basic
       bearerAuth:
           type: http
           scheme: bearer

   • In root add:

   security:
     - basicAuth: [ ]
     - bearerAuth: [ ]

6. Save changes in stackrox-container-image-scanner/api.yaml

jenkins-plugin's Issues

Unify build process for tests and plugin

Currently we have maven and gradle. It will be best if functional tests uses the same build tool as jenkins plugin. Ideally it should also use the same deps and generated code. To solve this we may need to move from maven to gradle in jenkins plugin and create a multi project build. This will allow us to share dependencies and generated artifacts between tests and plugin.

RFE shorten name for the security scan

Hello, i just noticed that this is a little bit escalating:

jenkins-plugin/stackrox-container-image-scanner/src/main/java/com/stackrox/jenkins/plugins/ViewStackroxResultsAction.java

Line 26 in 6380360

return "StackRox Report for " + getNames().collect(Collectors.joining(", "));

maybe something like

return "StackRox Report" 

would be better/enough

because as you see in the screenshot, with some images(had to blur it), this is really really huge:

Bug Plugin incompatible with darkmode

When you use the darkmode in jenkins

the plugin output is looking like this: