Documentation Index
Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
Use this file to discover all available pages before exploring further.
Jenkins Pipeline
Add the following to yourJenkinsfile. It will trigger on every push to your repository and run quality gate checks to detect secrets and other security issues:
Important:
- In Manage Jenkins � Credentials, add a Secret text credential with ID
ACCESS_TOKENcontaining your personal access token.- Jenkins automatically provides
${env.GIT_URL}(repository URL),${env.GIT_COMMIT}(commit SHA), and other build variables.
How it works
-
Setup environment
Extract repository information from Jenkins built-in environment variables. -
Download script
We fetch the quality gates script (quality_gates.sh) from the CodeAnt API endpoint. -
Start scan
The script initiates a quality gate scan for your commit using the-o startoperation. -
Poll for results
The script polls for scan results using the-o resultsoperation with:- Timeout: 300 seconds (5 minutes)
- Poll interval: 15 seconds
-
Pipeline feedback
- Success: Quality gate passes if no secrets are detected
- Failure: Quality gate fails if secrets are found, blocking the build
Script Parameters
Thequality_gates.sh script accepts the following parameters:
| Parameter | Description | Required | Example |
|---|---|---|---|
-a, --access-token | Personal Access Token or repo token | Yes | ${ACCESS_TOKEN} |
-r, --repo | Repository in format owner/repository | Yes | ${repoName} |
-c, --commit-id | Commit SHA to scan | Yes | ${env.GIT_COMMIT} |
-s, --service | VCS provider | Yes | github |
-o, --operation | Operation to perform (start or results) | Yes | start or results |
-t, --timeout | Timeout in seconds for polling (default: 300) | No | 300 |
-p, --poll-interval | Poll interval in seconds (default: 15) | No | 15 |
-u, --base-url | Base URL for VCS service (optional) | No | https://github.com |
Quality Gate Checks
Currently, the quality gate performs the following checks:Secret Detection
- Scans for hardcoded secrets, API keys, passwords, and tokens
- Analyzes only the changed lines since your merge base commit
- Uses high-confidence detection to minimize false positives
- Blocks the build if any secrets are found
Best Practices
- Run on all branches: Quality gates should run on every push to catch issues early
- Block builds: Configure Jenkins to fail the build when quality gates fail
- Review failures: When quality gates fail, review the detected issues immediately
- Keep tokens secure: Never commit access tokens directly - always use Jenkins Credentials
- Use shared libraries: Create shared pipeline libraries for reusable quality gate steps
Jenkins Built-in Variables
The following Jenkins built-in variables are automatically available and used:| Variable | Description | Example |
|---|---|---|
${env.GIT_URL} | Repository URL | https://github.com/user/repo.git |
${env.GIT_COMMIT} | Current commit SHA | abc123def456 |
${env.GIT_BRANCH} | Current branch name | origin/main |
${env.BUILD_NUMBER} | Build number | 42 |
${env.JOB_NAME} | Job name | my-project/main |
${env.WORKSPACE} | Workspace directory | /var/jenkins_home/workspace/job |
Troubleshooting
Quality gate times out
If the scan takes longer than expected:- Increase the timeout using
-t 600(10 minutes) - Check if the CodeAnt service is operational
- Consider optimizing your repository size
Authentication failures
If you see “Access token invalid”:- Verify your
ACCESS_TOKENcredential is correctly configured in Jenkins Credentials - Ensure the token has appropriate repository permissions
- Check that the credential ID matches exactly
No results returned
If the scan completes but returns no results:- Check that quality gates are enabled for your repository in CodeAnt
- Verify the commit SHA is correct
- Ensure your Jenkins instance has proper integration with CodeAnt
Repository format issues
If you see “Invalid repository format”:- Verify the repository format is extracted correctly from
GIT_URL - Check that the repository name follows
owner/repositoryformat - Debug the repository extraction by adding echo statements
Permission issues
If you see permission denied errors:- Ensure Jenkins has permission to execute shell scripts
- Check that the workspace is writable
- Verify curl is installed on Jenkins agents