Jenkins - CodeAnt AI

Jenkins Pipeline Workflow

Add the following to your Jenkinsfile. It will trigger on every build and kick off a CodeAnt analysis scan:

pipeline {
    agent any

    environment {
        ACCESS_TOKEN = credentials('codeant-token')  // Your CodeAnt API token (cdt_…) - see https://docs.codeant.ai/settings/api-tokens

        // Uncomment and set to customize which scanners to run
        // Options: sast, sca, secrets, antipatterns, iac, all
        // If not defined, script defaults to: sast,sca
        // SCANNERS = 'all'
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Fetch CodeAnt scan script') {
            steps {
                sh '''
                    export API_BASE="https://api.codeant.ai"
                    curl -sS -X GET "${API_BASE}/analysis/ci/scan/script/get" \
                        --output start_scan.sh.b64
                '''
            }
        }

        stage('Make script executable') {
            steps {
                sh '''
                    base64 -d start_scan.sh.b64 > start_scan.sh
                    chmod +x start_scan.sh
                '''
            }
        }

        stage('Trigger CodeAnt analysis') {
            steps {
                script {
                    // Extract the full organization/repository name from the Git URL
                    def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

                    sh """
                        bash start_scan.sh \\
                            -a "\$ACCESS_TOKEN" \\
                            -r "${repoName}" \\
                            -c "\${GIT_COMMIT}" \\
                            -b "\${GIT_BRANCH##*/}" \\
                            -s github \\
                            -i "" \\
                            -e "" \\
                            --scanners "\$SCANNERS"
                    """
                }
            }
        }
    }
}

Script Parameters

The start_scan.sh script accepts the following parameters:

Required Parameters

Parameter	Flag	Description	Example
Access Token	`-a, --access-token`	CodeAnt API token (`cdt_…`) used to authenticate the scan - see API Tokens	`$ACCESS_TOKEN`
Repository	`-r, --repo`	Repository name in `organization/repository` format	`myorg/myrepo`
Commit ID	`-c, --commit-id`	Git commit SHA to analyze	`${GIT_COMMIT}`
Service	`-s, --service`	Git service provider	`github`, `gitlab`, `bitbucket`

Optional Parameters

Parameter	Flag	Default	Description	Example
Branch	`-b, --branch`	(empty)	Branch name for the analysis	`main`, `develop`
Scanners	`--scanners`	`sast,sca`	Comma-separated list of scanners to run	`all`, `sast`, `sast,sca,secrets`
Include Files	`-i, --include-files`	(empty)	Glob patterns for files to include in analysis	`"src/*/.js"`
Exclude Files	`-e, --exclude-files`	(empty)	Glob patterns for files to exclude from analysis	`"/test/"`
Polling Interval	`-p, --polling-interval`	`30`	Seconds between result polling attempts	`20`
Timeout	`-t, --timeout`	`300`	Maximum seconds to wait for results	`600`
No Wait	`-n, --no-wait`	`false`	Skip waiting for results, only trigger the scan	(flag only)
Quality Gate	`-q, --quality-gate`	`false`	Evaluate the whole-repo quality gate and fail the build (exit 1) if it does not pass. Writes `results.json`, `codeant.sarif`, `codeant-qg.xml`	(flag only)

Scanner Options

🔍 Available Scanners: The --scanners flag allows you to customize which security scanners run during analysis:

sast - Static Application Security Testing (code vulnerabilities)
sca - Software Composition Analysis (dependency vulnerabilities)
secrets - Secret detection (API keys, passwords, tokens)
antipatterns - Code quality and duplicate code detection
iac - Infrastructure as Code security (Terraform, CloudFormation, etc.)
all - Run all available scanners

Default: If not specified, runs sast,sca Examples:

Run all scanners: --scanners "all"
Only SAST: --scanners "sast"
SAST + Secrets: --scanners "sast,secrets"
Full security suite: --scanners "sast,sca,secrets,iac"

Quality Gate Enforcement

🚦 Block the build on the whole-repository posture: Pass --quality-gate (-q) to turn the scan into an enforced gate. After the scan completes, CodeAnt evaluates the entire repository against your thresholds and the script exits non-zero if the gate fails - failing the pipeline. This is the Checkmarx / SonarQube-style whole-repo gate; it is independent of the new-code/PR quality gate. Configure thresholds in Settings → Code Analysis → Quality Gates using the “(Full Code / CI Pipeline)” metrics. These run only in the pipeline, never on pull requests:

(Full Code / CI Pipeline) SAST Security Rating ≤ C
(Full Code / CI Pipeline) SCA Security Rating ≤ C
(Full Code / CI Pipeline) IaC Security Rating ≤ C
(Full Code / CI Pipeline) Duplicate Code Percentage > 30

The gate groups results into three status checks: SAST (app security + IaC), SCA (dependencies), and SCR (duplicate code). Use --scanners to scope the gate (e.g. --scanners "sast,sca"). Reports are written to the workspace and can be published:

codeant.sarif - SARIF 2.1.0 for the code-scanning tab
codeant-qg.xml - JUnit XML (renders as a native test report)
results.json - full verdict, per-metric ratings, and findings

Note: --quality-gate requires a commit SHA (-c) and cannot be combined with --no-wait (the gate needs the scan results).

stage('CodeAnt Quality Gate') {
    steps {
        script {
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')
            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    --scanners "all" \\
                    --quality-gate \\
                    -t 600
            """
        }
    }
    post { always { junit 'codeant-qg.xml' } }
}

Execution Time Considerations

⏱️ Performance Options:

With result waiting (default): ~7 minutes
- Triggers scan and waits for complete analysis results
- Includes both security and SCA (Software Composition Analysis) results
- Best for comprehensive CI/CD pipelines where you need immediate feedback
With --no-wait flag: ~2 minutes
- Only triggers the scan and returns immediately
- Results can be fetched later or viewed in the CodeAnt dashboard
- Ideal for faster CI runs or when results can be processed asynchronously

Example Configurations

Fast CI Mode (No Wait)

stage('Trigger CodeAnt analysis (Fast Mode)') {
    steps {
        script {
            // Extract the full organization/repository name from the Git URL
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    -n  # Returns in ~2 minutes
            """
        }
    }
}

Comprehensive Analysis (Wait for Results)

stage('Trigger CodeAnt analysis (Full Results)') {
    steps {
        script {
            // Extract the full organization/repository name from the Git URL
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    -b "\${GIT_BRANCH##*/}" \\
                    -p 20 \\
                    -t 600  # Wait up to 10 minutes
            """
        }
    }
}

Custom File Filtering

stage('Trigger CodeAnt analysis (Custom Files)') {
    steps {
        script {
            // Extract the full organization/repository name from the Git URL
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    -i "src/**/*.{js,ts}" \\
                    -e "**/node_modules/**,**/dist/**" \\
                    -n
            """
        }
    }
}

Parameterized Pipeline

pipeline {
    agent any
    
    parameters {
        string(name: 'REPO_NAME', defaultValue: 'myorg/myrepo', description: 'Repository name')
        choice(name: 'SERVICE', choices: ['github', 'gitlab', 'bitbucket'], description: 'Git service provider')
        choice(name: 'SCANNERS', choices: ['sast,sca', 'all', 'sast', 'sast,secrets', 'sast,sca,secrets,iac'], description: 'Scanners to run')
        booleanParam(name: 'FAST_MODE', defaultValue: false, description: 'Use fast mode (no-wait)')
        string(name: 'INCLUDE_PATTERN', defaultValue: '', description: 'File include patterns')
        string(name: 'EXCLUDE_PATTERN', defaultValue: '', description: 'File exclude patterns')
    }

    environment {
        ACCESS_TOKEN = credentials('codeant-token')  // Your CodeAnt API token (cdt_…) - see https://docs.codeant.ai/settings/api-tokens
    }

    stages {
        stage('Run CodeAnt analysis') {
            steps {
                script {
                    def noWaitFlag = params.FAST_MODE ? '-n' : ''
                    def includeFlag = params.INCLUDE_PATTERN ? "-i \"${params.INCLUDE_PATTERN}\"" : '-i ""'
                    def excludeFlag = params.EXCLUDE_PATTERN ? "-e \"${params.EXCLUDE_PATTERN}\"" : '-e ""'
                    def scannersFlag = params.SCANNERS ? "--scanners \"${params.SCANNERS}\"" : ''

                    sh """
                        export API_BASE="https://api.codeant.ai"
                        curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \
                            --output start_scan.sh.b64
                        base64 -d start_scan.sh.b64 > start_scan.sh
                        chmod +x start_scan.sh
                        bash start_scan.sh \
                            -a "\$ACCESS_TOKEN" \
                            -r "${params.REPO_NAME}" \
                            -c "\${GIT_COMMIT}" \
                            -b "\${GIT_BRANCH##*/}" \
                            -s ${params.SERVICE} \
                            ${includeFlag} \
                            ${excludeFlag} \
                            ${scannersFlag} \
                            ${noWaitFlag}
                    """
                }
            }
        }
    }
}

Tips:

Create a CodeAnt token under API Tokens in the user menu (your email at the bottom-left) - see API Tokens and add it as a Secret text credential with the ID codeant-token in Jenkins → Credentials → System → Global credentials

Use --no-wait for PR checks to keep them fast, and full analysis for main branch merges

Adjust timeout based on your repository size - larger repos may need more time

File patterns support standard glob syntax for precise control over what gets analyzed

Customize scanners based on your needs - use --scanners "all" for comprehensive coverage or specific combinations like --scanners "sast,secrets" for targeted security checks

Default scanners (sast,sca) provide a good balance between coverage and execution time

How it works

Download script We fetch a small Bash helper (start_scan.sh) from the CodeAnt CI endpoint.
Make it runnable Mark the script executable so you can invoke it directly.
Invoke the scan The script POSTs your repo, commit, and file-globs to /analysis/ci/scan, using your token for auth.
Pipeline feedback
- On success, you’ll see a parsed JSON response in the job log.
- On failure (non-2xx HTTP), the script exits non-zero, failing your pipeline immediately.

With this in place, every push will automatically kick off a CodeAnt analysis run - and your CI status will reflect whether any HIGH-severity issues were detected.## Token permission This pipeline authenticates with a CodeAnt API token (cdt_…). If the token is scoped, give it the Codeant CI/CD role - it covers scans, quality gates, and test-coverage upload - scoped to the repositories this pipeline runs on (or All repositories). A token missing the required permission is rejected with an HTTP 403 token_scope_forbidden error that names the permission it needs. See API token permissions.

​Jenkins Pipeline Workflow

​Script Parameters

​Required Parameters

​Optional Parameters

​Scanner Options

​Quality Gate Enforcement

​Execution Time Considerations

​Example Configurations

​Fast CI Mode (No Wait)

​Comprehensive Analysis (Wait for Results)

​Custom File Filtering

​Parameterized Pipeline

​How it works