> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Jenkins

> Set up a Jenkins pipeline for CodeAnt CI scan.

## Jenkins Pipeline Workflow

Add the following to your `Jenkinsfile`. It will trigger on every build and kick off a CodeAnt analysis scan:

```groovy Jenkinsfile expandable theme={"theme":"css-variables"}
pipeline {
    agent any

    environment {
        ACCESS_TOKEN = credentials('codeant-token')  // Your CodeAnt API token (cdt_…) - see https://docs.codeant.ai/settings/api-tokens

        // Uncomment and set to customize which scanners to run
        // Options: sast, sca, secrets, antipatterns, iac, all
        // If not defined, script defaults to: sast,sca
        // SCANNERS = 'all'
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Fetch CodeAnt scan script') {
            steps {
                sh '''
                    export API_BASE="https://api.codeant.ai"
                    curl -sS -X GET "${API_BASE}/analysis/ci/scan/script/get" \
                        --output start_scan.sh.b64
                '''
            }
        }

        stage('Make script executable') {
            steps {
                sh '''
                    base64 -d start_scan.sh.b64 > start_scan.sh
                    chmod +x start_scan.sh
                '''
            }
        }

        stage('Trigger CodeAnt analysis') {
            steps {
                script {
                    // Extract the full organization/repository name from the Git URL
                    def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

                    sh """
                        bash start_scan.sh \\
                            -a "\$ACCESS_TOKEN" \\
                            -r "${repoName}" \\
                            -c "\${GIT_COMMIT}" \\
                            -b "\${GIT_BRANCH##*/}" \\
                            -s github \\
                            -i "" \\
                            -e "" \\
                            --scanners "\$SCANNERS"
                    """
                }
            }
        }
    }
}
```

## Script Parameters

The `start_scan.sh` script accepts the following parameters:

### Required Parameters

| Parameter | Flag | Description | Example |
| - | - | - | - |
| **Access Token** | `-a, --access-token` | CodeAnt API token (`cdt_…`) used to authenticate the scan - see [API Tokens](/settings/api-tokens) | `$ACCESS_TOKEN` |
| **Repository** | `-r, --repo` | Repository name in `organization/repository` format | `myorg/myrepo` |
| **Commit ID** | `-c, --commit-id` | Git commit SHA to analyze | `${GIT_COMMIT}` |
| **Service** | `-s, --service` | Git service provider | `github`, `gitlab`, `bitbucket` |

### Optional Parameters

| Parameter | Flag | Default | Description | Example |
| - | - | - | - | - |
| **Branch** | `-b, --branch` | *(empty)* | Branch name for the analysis | `main`, `develop` |
| **Scanners** | `--scanners` | `sast,sca` | Comma-separated list of scanners to run | `all`, `sast`, `sast,sca,secrets` |
| **Include Files** | `-i, --include-files` | *(empty)* | Glob patterns for files to include in analysis | `"src/**/*.js"` |
| **Exclude Files** | `-e, --exclude-files` | *(empty)* | Glob patterns for files to exclude from analysis | `"**/test/**"` |
| **Polling Interval** | `-p, --polling-interval` | `30` | Seconds between result polling attempts | `20` |
| **Timeout** | `-t, --timeout` | `300` | Maximum seconds to wait for results | `600` |
| **No Wait** | `-n, --no-wait` | `false` | Skip waiting for results, only trigger the scan | *(flag only)* |
| **Quality Gate** | `-q, --quality-gate` | `false` | Evaluate the whole-repo quality gate and **fail the build** (exit 1) if it does not pass. Writes `results.json`, `codeant.sarif`, `codeant-qg.xml` | *(flag only)* |

### Scanner Options

🔍 **Available Scanners:**

The `--scanners` flag allows you to customize which security scanners run during analysis:

* **`sast`** - Static Application Security Testing (code vulnerabilities)
* **`sca`** - Software Composition Analysis (dependency vulnerabilities)
* **`secrets`** - Secret detection (API keys, passwords, tokens)
* **`antipatterns`** - Code quality and duplicate code detection
* **`iac`** - Infrastructure as Code security (Terraform, CloudFormation, etc.)
* **`all`** - Run all available scanners

**Default:** If not specified, runs `sast,sca`

**Examples:**

* Run all scanners: `--scanners "all"`
* Only SAST: `--scanners "sast"`
* SAST + Secrets: `--scanners "sast,secrets"`
* Full security suite: `--scanners "sast,sca,secrets,iac"`

### Quality Gate Enforcement

🚦 **Block the build on the whole-repository posture:**

Pass `--quality-gate` (`-q`) to turn the scan into an enforced gate. After the scan completes, CodeAnt evaluates the **entire repository** against your thresholds and the script **exits non-zero** if the gate fails - failing the pipeline. This is the Checkmarx / SonarQube-style whole-repo gate; it is independent of the new-code/PR quality gate.

**Configure thresholds** in **Settings → Code Analysis → Quality Gates** using the **"(Full Code / CI Pipeline)"** metrics. These run only in the pipeline, never on pull requests:

* `(Full Code / CI Pipeline) SAST Security Rating` `≤` `C`
* `(Full Code / CI Pipeline) SCA Security Rating` `≤` `C`
* `(Full Code / CI Pipeline) IaC Security Rating` `≤` `C`
* `(Full Code / CI Pipeline) Duplicate Code Percentage` `>` `30`

The gate groups results into three status checks: **SAST** (app security + IaC), **SCA** (dependencies), and **SCR** (duplicate code). Use `--scanners` to scope the gate (e.g. `--scanners "sast,sca"`).

**Reports** are written to the workspace and can be published:

* `codeant.sarif` - SARIF 2.1.0 for the code-scanning tab
* `codeant-qg.xml` - JUnit XML (renders as a native test report)
* `results.json` - full verdict, per-metric ratings, and findings

> **Note:** `--quality-gate` requires a commit SHA (`-c`) and cannot be combined with `--no-wait` (the gate needs the scan results).

```groovy Jenkinsfile expandable theme={"theme":"css-variables"}
stage('CodeAnt Quality Gate') {
    steps {
        script {
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')
            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    --scanners "all" \\
                    --quality-gate \\
                    -t 600
            """
        }
    }
    post { always { junit 'codeant-qg.xml' } }
}
```

### Execution Time Considerations

⏱️ **Performance Options:**

* **With result waiting** (default): \~7 minutes
  * Triggers scan and waits for complete analysis results
  * Includes both security and SCA (Software Composition Analysis) results
  * Best for comprehensive CI/CD pipelines where you need immediate feedback

* **With `--no-wait` flag**: \~2 minutes
  * Only triggers the scan and returns immediately
  * Results can be fetched later or viewed in the CodeAnt dashboard
  * Ideal for faster CI runs or when results can be processed asynchronously

### Example Configurations

#### Fast CI Mode (No Wait)

```groovy Jenkinsfile expandable theme={"theme":"css-variables"}
stage('Trigger CodeAnt analysis (Fast Mode)') {
    steps {
        script {
            // Extract the full organization/repository name from the Git URL
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    -n  # Returns in ~2 minutes
            """
        }
    }
}
```

#### Comprehensive Analysis (Wait for Results)

```groovy Jenkinsfile expandable theme={"theme":"css-variables"}
stage('Trigger CodeAnt analysis (Full Results)') {
    steps {
        script {
            // Extract the full organization/repository name from the Git URL
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    -b "\${GIT_BRANCH##*/}" \\
                    -p 20 \\
                    -t 600  # Wait up to 10 minutes
            """
        }
    }
}
```

#### Custom File Filtering

```groovy Jenkinsfile expandable theme={"theme":"css-variables"}
stage('Trigger CodeAnt analysis (Custom Files)') {
    steps {
        script {
            // Extract the full organization/repository name from the Git URL
            def repoName = env.GIT_URL.replaceAll(/.*[\/:]([^\/]+\/[^\/]+?)(\.git)?$/, '$1')

            sh """
                export API_BASE="https://api.codeant.ai"
                curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \\
                    --output start_scan.sh.b64
                base64 -d start_scan.sh.b64 > start_scan.sh
                chmod +x start_scan.sh
                bash start_scan.sh \\
                    -a "\$ACCESS_TOKEN" \\
                    -r "${repoName}" \\
                    -c "\${GIT_COMMIT}" \\
                    -s github \\
                    -i "src/**/*.{js,ts}" \\
                    -e "**/node_modules/**,**/dist/**" \\
                    -n
            """
        }
    }
}
```

#### Parameterized Pipeline

```groovy Jenkinsfile expandable theme={"theme":"css-variables"}
pipeline {
    agent any
    
    parameters {
        string(name: 'REPO_NAME', defaultValue: 'myorg/myrepo', description: 'Repository name')
        choice(name: 'SERVICE', choices: ['github', 'gitlab', 'bitbucket'], description: 'Git service provider')
        choice(name: 'SCANNERS', choices: ['sast,sca', 'all', 'sast', 'sast,secrets', 'sast,sca,secrets,iac'], description: 'Scanners to run')
        booleanParam(name: 'FAST_MODE', defaultValue: false, description: 'Use fast mode (no-wait)')
        string(name: 'INCLUDE_PATTERN', defaultValue: '', description: 'File include patterns')
        string(name: 'EXCLUDE_PATTERN', defaultValue: '', description: 'File exclude patterns')
    }

    environment {
        ACCESS_TOKEN = credentials('codeant-token')  // Your CodeAnt API token (cdt_…) - see https://docs.codeant.ai/settings/api-tokens
    }

    stages {
        stage('Run CodeAnt analysis') {
            steps {
                script {
                    def noWaitFlag = params.FAST_MODE ? '-n' : ''
                    def includeFlag = params.INCLUDE_PATTERN ? "-i \"${params.INCLUDE_PATTERN}\"" : '-i ""'
                    def excludeFlag = params.EXCLUDE_PATTERN ? "-e \"${params.EXCLUDE_PATTERN}\"" : '-e ""'
                    def scannersFlag = params.SCANNERS ? "--scanners \"${params.SCANNERS}\"" : ''

                    sh """
                        export API_BASE="https://api.codeant.ai"
                        curl -sS -X GET "\${API_BASE}/analysis/ci/scan/script/get" \
                            --output start_scan.sh.b64
                        base64 -d start_scan.sh.b64 > start_scan.sh
                        chmod +x start_scan.sh
                        bash start_scan.sh \
                            -a "\$ACCESS_TOKEN" \
                            -r "${params.REPO_NAME}" \
                            -c "\${GIT_COMMIT}" \
                            -b "\${GIT_BRANCH##*/}" \
                            -s ${params.SERVICE} \
                            ${includeFlag} \
                            ${excludeFlag} \
                            ${scannersFlag} \
                            ${noWaitFlag}
                    """
                }
            }
        }
    }
}
```

> **Tips:**
>
> * Create a CodeAnt token under **Settings → API Tokens** - see [API Tokens](/settings/api-tokens) and add it as a **Secret text** credential with the ID `codeant-token` in Jenkins → Credentials → System → Global credentials
> * Use `--no-wait` for PR checks to keep them fast, and full analysis for main branch merges
> * Adjust timeout based on your repository size - larger repos may need more time
> * File patterns support standard glob syntax for precise control over what gets analyzed
> * Customize scanners based on your needs - use `--scanners "all"` for comprehensive coverage or specific combinations like `--scanners "sast,secrets"` for targeted security checks
> * Default scanners (`sast,sca`) provide a good balance between coverage and execution time

## How it works

1. **Download script**
   We fetch a small Bash helper (`start_scan.sh`) from the CodeAnt CI endpoint.
2. **Make it runnable**
   Mark the script executable so you can invoke it directly.
3. **Invoke the scan**
   The script POSTs your repo, commit, and file-globs to `/analysis/ci/scan`, using your token for auth.
4. **Pipeline feedback**

   * On success, you'll see a parsed JSON response in the job log.
   * On failure (non-2xx HTTP), the script exits non-zero, failing your pipeline immediately.

With this in place, every push will automatically kick off a CodeAnt analysis run - and your CI status will reflect whether any HIGH-severity issues were detected.## Token permission

This pipeline authenticates with a CodeAnt API token (`cdt_…`). If the token is **scoped**, give it the **Codeant CI/CD** role - it covers scans, quality gates, and test-coverage upload - scoped to the repositories this pipeline runs on (or **All repositories**). A token missing the required permission is rejected with an HTTP `403` `token_scope_forbidden` error that names the permission it needs. See [API token permissions](/settings/api-tokens#permissions-and-scopes).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.