jenkinsci/dependency-check-plugin

Stars
129
Rank 279,262 (Top 6 %)
Language
Java
License
Apache License 2.0
Created over 11 years ago
Updated 3 months ago

jenkinsci/dependency-check-plugin

jenkinsci

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Jenkins plugin for OWASP Dependency-Check. Inspects project components for known vulnerabilities (e.g. CVEs).

Dependency-Check Jenkins Plugin

Dependency-Check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2017: A9 - Using Components with Known Vulnerabilities. This plug-in can independently execute a Dependency-Check analysis and visualize results.

Usage

The plugin has three main components: a globally defined tool configuration, a builder, and a publisher.

Global Tool Configuration

One or more Dependency-Check versions can be installed via the Jenkins Global Tool Configuration. The installation of Dependency-Check can be performed automatically, which will download and extract the official Command-Line Interface (CLI) from Github, or an official distribution can be installed manually and the path to the installation referenced in the configuration.

Builder

The builder performs an analysis using one of the pre-defined Dependency-Check CLI installations. Configuration specific to Jenkins is minimal, with important aspects of the job configuration being the 'Arguments' field, which is sent directly to the CLI installation defined.

Publisher

The publisher works independently of the tool configuration or builder and is responsible for reading dependency-check-report.xml and generating metrics, trends, findings, and optionally failing the build or putting it into a warning state based on configurable thresholds.

When a job has the publisher configured, a trending chart will display the total number of findings grouped by severity.

The chart is interactive. Hovering over a build will display high-level severity information.

Per-build results may be viewed. Findings are displayed in an interactive table which can be sorted, searched on, and paginated through. Each findings can be expanded to reveal additional details.

Mailing List

Subscribe: [[email protected]] subscribe

Post: [[email protected]] post

Copyright & License

Dependency-Check is Copyright (c) Jeremy Long. All Rights Reserved.

Dependency-Check Jenkins Plugin is Copyright (c) Steve Springett. All Rights Reserved.

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the [LICENSE.txt] license file for the full license.

jenkins

Jenkins automation server

docker

Docker official jenkins repo

pipeline-examples

A collection of examples, tips and tricks and snippets of scripting for the Jenkins Pipeline plugin

blueocean-plugin

Blue Ocean is a reboot of the Jenkins CI/CD User Experience

configuration-as-code-plugin

Jenkins Configuration as Code Plugin

kubernetes-plugin

Jenkins plugin to run dynamic agents in a Kubernetes/Docker environment

job-dsl-plugin

A Groovy DSL for Jenkins Jobs - Sweeeeet!

pipeline-plugin

Obsolete home for Pipeline plugins

JenkinsPipelineUnit

Framework for unit testing Jenkins pipelines

gitlab-plugin

A Jenkins plugin for interfacing with GitLab

jenkinsfile-runner

A command line tool to run Jenkinsfile as a function

java-client-api

A Jenkins API client for Java

jenkins-scripts

Scripts in Groovy, shell, Ruby, Python, whatever for managing/interacting with Jenkins

build-monitor-plugin

Jenkins Build Monitor Plugin

git-plugin

Git repository access for Jenkins jobs

slack-plugin

A Jenkins plugin for posting notifications to a Slack channel

pipeline-model-definition-plugin

docker-workflow-plugin

Jenkins plugin which allows building, testing, and using Docker images from Jenkins Pipeline projects.

ghprb-plugin

github pull requests builder plugin for Jenkins

docker-plugin

Jenkins Cloud Plugin that uses Docker

docker-inbound-agent

Docker image for a Jenkins agent which can connect to Jenkins using TCP or Websocket protocols

helm-charts

Jenkins helm charts

pipeline-aws-plugin

Jenkins Pipeline Step Plugin for AWS

jenkins.rb

Deprecated, see https://www.jenkins.io/jep/7

generic-webhook-trigger-plugin

Can receive any HTTP request, extract any values from JSON or XML and trigger a job with those values available as variables. Works with GitHub, GitLab, Bitbucket, Jira and many more.

email-ext-plugin

Jenkins Email Extension Plugin

dingtalk-plugin

Dingtalk for jenkins

warnings-ng-plugin

Jenkins Warnings Plugin - Next Generation

plugin-installation-manager-tool

Plugin Manager CLI tool for Jenkins

mesos-plugin

Mesos Cloud Jenkins Plugin

github-plugin

Jenkins GitHub plugin

ec2-plugin

Jenkins ec2 plugin

ssh-steps-plugin

Jenkins pipeline steps which provides SSH facilities such as command execution or file transfer for continuous delivery.

ansicolor-plugin

Jenkins ANSI Color Plugin

pipeline-utility-steps-plugin

Small, miscellaneous, cross platform utility steps for Jenkins Pipeline jobs.

docker-agent

Base Docker image for Jenkins Agents

ansible-plugin

Jenkins Ansible plugin

workflow-cps-global-lib-plugin

hashicorp-vault-plugin

Jenkins plugin to populate environment variables from secrets stored in HashiCorp's Vault.

lib-file-leak-detector

Java agent that detects file handle leak

bitbucket-branch-source-plugin

Bitbucket Branch Source Plugin

gerrit-trigger-plugin

remoting

Jenkins Remoting module

workflow-aggregator-plugin

android-emulator-plugin

Android Emulator plugin for Jenkins

docker-slaves-plugin

A Jenkins plugin to run builds inside Docker containers

github-branch-source-plugin

GitHub Branch Source Plugin

pipeline-stage-view-plugin

Visualizes Jenkins pipelines

jenkinsfile-runner-github-actions

Jenkins single-shot pipeline execution in a GitHub Action POC

amazon-ecs-plugin

Amazon EC2 Container Service Plugin for Jenkins

trilead-ssh2

Patched trilead-ssh2 used in Jenkins

cucumber-reports-plugin

Jenkins plugin to generate cucumber-jvm reports

docker-build-publish-plugin

performance-plugin

Performance Test Running and Reporting for Jenkins CI

jira-plugin

Jenkins jira plugin

gitea-plugin

This plugin provides the Jenkins integration for Gitea.

embeddable-build-status-plugin

Embed build status of Jenkins jobs in web pages

stashnotifier-plugin

A Jenkins Plugin to notify Atlassian Stash|Bitbucket of build results

docker-ssh-agent

Docker image for Jenkins agents connected over SSH

workflow-cps-plugin

http-request-plugin

This plugin does a request to an url with some parameters.

kubernetes-pipeline-plugin

Kubernetes Pipeline is Jenkins plugin which extends Jenkins Pipeline to provide native support for using Kubernetes pods, secrets and volumes to perform builds

stapler

Stapler web framework

tfs-plugin

Jenkins tfs plugin

jep

Jenkins Enhancement Proposals

kubernetes-cd-plugin

A Jenkins plugin to deploy to Kubernetes cluster

jacoco-plugin

Jenkins JaCoCo Plugin

qy-wechat-notification-plugin

企业微信Jenkins构建通知插件

swarm-plugin

Jenkins swarm plugin

git-client-plugin

Git client API for Jenkins plugins

subversion-plugin

Jenkins subversion plugin

git-parameter-plugin

Jenkins plugin for chosing Revision / Tag before build

role-strategy-plugin

Jenkins Role-Strategy plugin

groovy-sandbox

(Deprecated) Compile-time transformer to run Groovy code in a restrictive sandbox

jenkins-design-language

Styles, assets, and React classes for Jenkins Design Language

acceptance-test-harness

Acceptance tests cases for Jenkins and its plugins based on selenium and docker.

publish-over-ssh-plugin

gitlab-branch-source-plugin

A Jenkins Plugin for GitLab Multibranch Pipeline jobs and Folder Organization

scm-sync-configuration-plugin

Jenkins scm-sync-configuration plugin

pipeline-as-yaml-plugin

Jenkins Pipeline As Yaml Plugin

selenium-plugin

Jenkins selenium plugin

docker-build-step-plugin

jira-trigger-plugin

Triggers a build when a certain condition is matched in JIRA

code-coverage-api-plugin

Deprecated Jenkins Code Coverage Plugin

gradle-plugin

Jenkins gradle plugin

cobertura-plugin

Jenkins cobertura plugin

credentials-plugin

Provides Jenkins with extension points to securely store, manage, and bind credentials data to other Jenkins plugins, builds, pipelines, etc.

jira-steps-plugin

Jenkins pipeline steps for integration with JIRA.

artifactory-plugin

Jenkins artifactory plugin

build-flow-plugin

A plugin to manage job orchestration

github-oauth-plugin

Jenkins authentication plugin using GitHub OAuth as the source.

throttle-concurrent-builds-plugin

pipeline-graph-view-plugin

promoted-builds-plugin

Jenkins Promoted Builds Plugin

ssh-slaves-plugin

SSH Build Agents Plugin for Jenkins

github-pr-coverage-status-plugin

Nice test coverage icon for your pull requests just from Jenkins

jenkins-test-harness

Unit test framework for Jenkins core and its plugins

localization-zh-cn-plugin

Chinese Localization for Jenkins

opentelemetry-plugin

Monitor and observe Jenkins with OpenTelemetry.

office-365-connector-plugin

Office 365 Connector plugin sends jobs status notifications to Microsoft Teams or Outlook