Jenkins Pipeline
Add the following to yourJenkinsfile. It will trigger on every push to your repository and run quality gate checks to detect secrets and other security issues:
Important:
- In Manage Jenkins � Credentials, add a Secret text credential with ID
ACCESS_TOKENcontaining your personal access token.- Jenkins automatically provides
${env.GIT_URL}(repository URL),${env.GIT_COMMIT}(commit SHA), and other build variables.
How it works
- 
Setup environment
 Extract repository information from Jenkins built-in environment variables.
- 
Download script
 We fetch the quality gates script (quality_gates.sh) from the CodeAnt API endpoint.
- 
Start scan
 The script initiates a quality gate scan for your commit using the-o startoperation.
- 
Poll for results
 The script polls for scan results using the-o resultsoperation with:- Timeout: 300 seconds (5 minutes)
- Poll interval: 15 seconds
 
- 
Pipeline feedback
- Success: Quality gate passes if no secrets are detected
- Failure: Quality gate fails if secrets are found, blocking the build
 
Script Parameters
Thequality_gates.sh script accepts the following parameters:
| Parameter | Description | Required | Example | 
|---|---|---|---|
| -a, --access-token | Personal Access Token or repo token | Yes | ${ACCESS_TOKEN} | 
| -r, --repo | Repository in format owner/repository | Yes | ${repoName} | 
| -c, --commit-id | Commit SHA to scan | Yes | ${env.GIT_COMMIT} | 
| -s, --service | VCS provider | Yes | jenkins | 
| -o, --operation | Operation to perform ( startorresults) | Yes | startorresults | 
| -t, --timeout | Timeout in seconds for polling (default: 300) | No | 300 | 
| -p, --poll-interval | Poll interval in seconds (default: 15) | No | 15 | 
| -u, --base-url | Base URL for VCS service (optional) | No | https://github.com | 
Quality Gate Checks
Currently, the quality gate performs the following checks:Secret Detection
- Scans for hardcoded secrets, API keys, passwords, and tokens
- Analyzes only the changed lines since your merge base commit
- Uses high-confidence detection to minimize false positives
- Blocks the build if any secrets are found
Best Practices
- Run on all branches: Quality gates should run on every push to catch issues early
- Block builds: Configure Jenkins to fail the build when quality gates fail
- Review failures: When quality gates fail, review the detected issues immediately
- Keep tokens secure: Never commit access tokens directly - always use Jenkins Credentials
- Use shared libraries: Create shared pipeline libraries for reusable quality gate steps
Jenkins Built-in Variables
The following Jenkins built-in variables are automatically available and used:| Variable | Description | Example | 
|---|---|---|
| ${env.GIT_URL} | Repository URL | https://github.com/user/repo.git | 
| ${env.GIT_COMMIT} | Current commit SHA | abc123def456 | 
| ${env.GIT_BRANCH} | Current branch name | origin/main | 
| ${env.BUILD_NUMBER} | Build number | 42 | 
| ${env.JOB_NAME} | Job name | my-project/main | 
| ${env.WORKSPACE} | Workspace directory | /var/jenkins_home/workspace/job | 
Troubleshooting
Quality gate times out
If the scan takes longer than expected:- Increase the timeout using -t 600(10 minutes)
- Check if the CodeAnt service is operational
- Consider optimizing your repository size
Authentication failures
If you see “Access token invalid”:- Verify your ACCESS_TOKENcredential is correctly configured in Jenkins Credentials
- Ensure the token has appropriate repository permissions
- Check that the credential ID matches exactly
No results returned
If the scan completes but returns no results:- Check that quality gates are enabled for your repository in CodeAnt
- Verify the commit SHA is correct
- Ensure your Jenkins instance has proper integration with CodeAnt
Repository format issues
If you see “Invalid repository format”:- Verify the repository format is extracted correctly from GIT_URL
- Check that the repository name follows owner/repositoryformat
- Debug the repository extraction by adding echo statements
Permission issues
If you see permission denied errors:- Ensure Jenkins has permission to execute shell scripts
- Check that the workspace is writable
- Verify curl is installed on Jenkins agents