Jenkins

Jenkins Pipeline Workflow

Add the following to your Jenkinsfile. It will trigger on every build and kick off a CodeAnt analysis scan:

Jenkinsfile

pipeline {
    agent any

    environment {
        ACCESS_TOKEN = credentials('codeant-token')  // Your CodeAnt API token (cdt_…) - see https://docs.codeant.ai/settings/api-tokens

        // Uncomment and set to customize which scanners to run
        // Options: sast, sca, secrets, antipatterns, iac, all
        // If not defined, script defaults to: sast,sca
        // SCANNERS = 'all'
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Fetch CodeAnt scan script') {
            steps {
                sh '''
                    export API_BASE="https://api.codeant.ai"
                    curl -sS -X GET "${API_BASE}/analysis/ci/scan/script/get" \
                        --output start_scan.sh.b64
                '''
            }
        }

        stage('Make script executable') {
            steps {
                sh '''
                    base64 -d start_scan.sh.b64 > start_scan.sh
                    chmod +x start_scan.sh
                '''
            }
        }

        stage('Trigger CodeAnt analysis') {
            steps {
                script {
                    // Extract the full organization/repository name from the Git URL
                    def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

                    sh """
                        bash start_scan.sh \\
                            -a "\$ACCESS_TOKEN" \\
                            -r "${repoName}" \\
                            -c "\${GIT_COMMIT}" \\
                            -b "\${GIT_BRANCH##*/}" \\
                            -s github \\
                            -i "" \\
                            -e "" \\
                            --scanners "\$SCANNERS"
                    """
                }
            }
        }
    }
}

Script Parameters

The start_scan.sh script accepts the following parameters:

Required Parameters

Parameter	Flag	Description	Example
Access Token	`-a, --access-token`	CodeAnt API token (`cdt_…`) used to authenticate the scan - see API Tokens	`$ACCESS_TOKEN`
Repository	`-r, --repo`	Repository name in `organization/repository` format	`myorg/myrepo`
Commit ID	`-c, --commit-id`	Git commit SHA to analyze	`${GIT_COMMIT}`
Service	`-s, --service`	Git service provider	`github`, `gitlab`, `bitbucket`

Optional Parameters

Parameter	Flag	Default	Description	Example
Branch	`-b, --branch`	(empty)	Branch name for the analysis	`main`, `develop`
Scanners	`--scanners`	`sast,sca`	Comma-separated list of scanners to run	`all`, `sast`, `sast,sca,secrets`
Include Files	`-i, --include-files`	(empty)	Glob patterns for files to include in analysis	`"src/*/.js"`
Exclude Files	`-e, --exclude-files`	(empty)	Glob patterns for files to exclude from analysis	`"/test/"`
Polling Interval	`-p, --polling-interval`	`30`	Seconds between result polling attempts	`20`
Timeout	`-t, --timeout`	`300`	Maximum seconds to wait for results	`600`
No Wait	`-n, --no-wait`	`false`	Skip waiting for results, only trigger the scan	(flag only)
Quality Gate	`-q, --quality-gate`	`false`	Evaluate the whole-repo quality gate and fail the build (exit 1) if it does not pass. Writes `results.json`, `codeant.sarif`, `codeant-qg.xml`	(flag only)

Scanner Options

🔍 Available Scanners: The --scanners flag allows you to customize which security scanners run during analysis:

sast - Static Application Security Testing (code vulnerabilities)
sca - Software Composition Analysis (dependency vulnerabilities)
secrets - Secret detection (API keys, passwords, tokens)
antipatterns - Code quality and duplicate code detection
iac - Infrastructure as Code security (Terraform, CloudFormation, etc.)
all - Run all available scanners

Default: If not specified, runs sast,sca Examples:

Run all scanners: --scanners "all"
Only SAST: --scanners "sast"
SAST + Secrets: --scanners "sast,secrets"
Full security suite: --scanners "sast,sca,secrets,iac"

Quality Gate Enforcement

🚦 Block the build on the whole-repository posture: Pass --quality-gate (-q) to turn the scan into an enforced gate. After the scan completes, CodeAnt evaluates the entire repository against your thresholds and the script exits non-zero if the gate fails - failing the pipeline. This is the Checkmarx / SonarQube-style whole-repo gate; it is independent of the new-code/PR quality gate. Configure thresholds in Settings → Code Analysis → Quality Gates using the “(Full Code / CI Pipeline)” metrics. These run only in the pipeline, never on pull requests:

(Full Code / CI Pipeline) SAST Security Rating ≤ C
(Full Code / CI Pipeline) SCA Security Rating ≤ C
(Full Code / CI Pipeline) IaC Security Rating ≤ C
(Full Code / CI Pipeline) Duplicate Code Percentage > 30

The gate groups results into three status checks: SAST (app security + IaC), SCA (dependencies), and SCR (duplicate code). Use --scanners to scope the gate (e.g. --scanners "sast,sca"). Reports are written to the workspace and can be published:

codeant.sarif - SARIF 2.1.0 for the code-scanning tab
codeant-qg.xml - JUnit XML (renders as a native test report)
results.json - full verdict, per-metric ratings, and findings

Note: --quality-gate requires a commit SHA (-c) and cannot be combined with --no-wait (the gate needs the scan results).

Jenkinsfile

stage('CodeAnt Quality Gate') {
    steps {
        script {
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')
            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    --scanners "all" \\
                    --quality-gate \\
                    -t 600
            """
        }
    }
    post { always { junit 'codeant-qg.xml' } }
}

Execution Time Considerations

⏱️ Performance Options:

With result waiting (default): ~7 minutes
- Triggers scan and waits for complete analysis results
- Includes both security and SCA (Software Composition Analysis) results
- Best for comprehensive CI/CD pipelines where you need immediate feedback
With --no-wait flag: ~2 minutes
- Only triggers the scan and returns immediately
- Results can be fetched later or viewed in the CodeAnt dashboard
- Ideal for faster CI runs or when results can be processed asynchronously

Example Configurations

Fast CI Mode (No Wait)

Jenkinsfile

stage('Trigger CodeAnt analysis (Fast Mode)') {
    steps {
        script {
            // Extract the full organization/repository name from the Git URL
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    -n  # Returns in ~2 minutes
            """
        }
    }
}

Comprehensive Analysis (Wait for Results)

Jenkinsfile

stage('Trigger CodeAnt analysis (Full Results)') {
    steps {
        script {
            // Extract the full organization/repository name from the Git URL
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    -b "\${GIT_BRANCH##*/}" \\
                    -p 20 \\
                    -t 600  # Wait up to 10 minutes
            """
        }
    }
}

Custom File Filtering

Jenkinsfile

stage('Trigger CodeAnt analysis (Custom Files)') {
    steps {
        script {
            // Extract the full organization/repository name from the Git URL
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    -i "src/**/*.{js,ts}" \\
                    -e "**/node_modules/**,**/dist/**" \\
                    -n
            """
        }
    }
}

Parameterized Pipeline

Jenkinsfile

pipeline {
    agent any
    
    parameters {
        string(name: 'REPO_NAME', defaultValue: 'myorg/myrepo', description: 'Repository name')
        choice(name: 'SERVICE', choices: ['github', 'gitlab', 'bitbucket'], description: 'Git service provider')
        choice(name: 'SCANNERS', choices: ['sast,sca', 'all', 'sast', 'sast,secrets', 'sast,sca,secrets,iac'], description: 'Scanners to run')
        booleanParam(name: 'FAST_MODE', defaultValue: false, description: 'Use fast mode (no-wait)')
        string(name: 'INCLUDE_PATTERN', defaultValue: '', description: 'File include patterns')
        string(name: 'EXCLUDE_PATTERN', defaultValue: '', description: 'File exclude patterns')
    }

    environment {
        ACCESS_TOKEN = credentials('codeant-token')  // Your CodeAnt API token (cdt_…) - see https://docs.codeant.ai/settings/api-tokens
    }

    stages {
        stage('Run CodeAnt analysis') {
            steps {
                script {
                    def noWaitFlag = params.FAST_MODE ? '-n' : ''
                    def includeFlag = params.INCLUDE_PATTERN ? "-i \"${params.INCLUDE_PATTERN}\"" : '-i ""'
                    def excludeFlag = params.EXCLUDE_PATTERN ? "-e \"${params.EXCLUDE_PATTERN}\"" : '-e ""'
                    def scannersFlag = params.SCANNERS ? "--scanners \"${params.SCANNERS}\"" : ''

                    sh """
                        export API_BASE="https://api.codeant.ai"
                        curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \
                            --output start_scan.sh.b64
                        base64 -d start_scan.sh.b64 > start_scan.sh
                        chmod +x start_scan.sh
                        bash start_scan.sh \
                            -a "\$ACCESS_TOKEN" \
                            -r "${params.REPO_NAME}" \
                            -c "\${GIT_COMMIT}" \
                            -b "\${GIT_BRANCH##*/}" \
                            -s ${params.SERVICE} \
                            ${includeFlag} \
                            ${excludeFlag} \
                            ${scannersFlag} \
                            ${noWaitFlag}
                    """
                }
            }
        }
    }
}

Tips:

Create a CodeAnt token under Settings → API Tokens - see API Tokens and add it as a Secret text credential with the ID codeant-token in Jenkins → Credentials → System → Global credentials

Use --no-wait for PR checks to keep them fast, and full analysis for main branch merges

Adjust timeout based on your repository size - larger repos may need more time

File patterns support standard glob syntax for precise control over what gets analyzed

Customize scanners based on your needs - use --scanners "all" for comprehensive coverage or specific combinations like --scanners "sast,secrets" for targeted security checks

Default scanners (sast,sca) provide a good balance between coverage and execution time

How it works

Download script We fetch a small Bash helper (start_scan.sh) from the CodeAnt CI endpoint.
Make it runnable Mark the script executable so you can invoke it directly.
Invoke the scan The script POSTs your repo, commit, and file-globs to /analysis/ci/scan, using your token for auth.
Pipeline feedback
- On success, you’ll see a parsed JSON response in the job log.
- On failure (non-2xx HTTP), the script exits non-zero, failing your pipeline immediately.

With this in place, every push will automatically kick off a CodeAnt analysis run - and your CI status will reflect whether any HIGH-severity issues were detected.## Token permission This pipeline authenticates with a CodeAnt API token (cdt_…). If the token is scoped, give it the Codeant CI/CD role - it covers scans, quality gates, and test-coverage upload - scoped to the repositories this pipeline runs on (or All repositories). A token missing the required permission is rejected with an HTTP 403 token_scope_forbidden error that names the permission it needs. See API token permissions.

Get Started

AI Code Review

Code Security

Cloud Security

Code Quality

Engineering Metrics

IDE, CLI & CI/CD

Rule Reference

Resources

Jenkins Pipeline Workflow

Script Parameters

Required Parameters

Optional Parameters

Scanner Options

Quality Gate Enforcement

Execution Time Considerations

Example Configurations

Fast CI Mode (No Wait)

Comprehensive Analysis (Wait for Results)

Custom File Filtering

Parameterized Pipeline

How it works

​Jenkins Pipeline Workflow

​Script Parameters

​Required Parameters

​Optional Parameters

​Scanner Options

​Quality Gate Enforcement

​Execution Time Considerations

​Example Configurations

​Fast CI Mode (No Wait)

​Comprehensive Analysis (Wait for Results)

​Custom File Filtering

​Parameterized Pipeline

​How it works

Jenkins Pipeline Workflow

Script Parameters

Required Parameters

Optional Parameters

Scanner Options

Quality Gate Enforcement

Execution Time Considerations

Example Configurations

Fast CI Mode (No Wait)

Comprehensive Analysis (Wait for Results)

Custom File Filtering

Parameterized Pipeline

How it works