Jenkins Pipeline

This page explains how to integrate HoundDog.ai’s code scanner with Jenkins Pipeline.

Prerequisites

Your Jenkins agent (s) must have the following:

• Docker Engine
• Git
• Minimum 2 GB of memory allocated to Docker
• Network access to Docker Hub and, for result uploads, to your HoundDog.ai environment

Defining the Required Pipeline Credentials

First, follow the steps in API Keys to generate a HoundDog.ai organization API key. Then follow the steps in the Jenkins documentation to create a secret text credential named hounddog-api-key using the value of your key.

Defining the Scan Step in Jenkinsfile

Next, add a new stage in the Jenkinsfile at the root of your repository. Here is an example which scans your repository and uploads the results to the HoundDog.ai Cloud Platform:

Jenkinsfile

pipeline {
    agent any
    stages {
        stage('Run HoundDog.ai Scan') {
            environment {
                HOUNDDOG_API_KEY = credentials('hounddog-api-key')
            }
            steps {
                sh '''
                docker run --pull=always --rm -t -v .:/data \
                    -e HOUNDDOG_API_KEY=$HOUNDDOG_API_KEY \
                    hounddogai/hounddog hounddog scan --ci jenkins
                '''
            }
        }
    }
}

Blocking the Pipeline Upon Detecting Vulnerabilities

By default the scanner exits with code 0 (success) even when risky dataflows are found. To halt the pipeline upon detecting vulnerabilities, provide the --fail-severity-threshold option to the hounddog scan command:

Jenkinsfile

pipeline {
    agent any
    stages {
        stage('Run HoundDog.ai Scan') {
            environment {
                HOUNDDOG_API_KEY = credentials('hounddog-api-key')
            }
            steps {
                sh '''
                docker run --pull=always --rm -t -v .:/data \
                    -e HOUNDDOG_API_KEY=$HOUNDDOG_API_KEY \
                    hounddogai/hounddog hounddog scan --ci jenkins \
                    --fail-severity-threshold=medium
                '''
            }
        }
    }
}

The scan results still upload to the Cloud Platform before the stage fails, so the platform always reflects the latest scan.

To view all available command-line options for the hounddog scan command, see Scanner Configuration.