Overview
This article outlines the integration of the JFrog Jenkins Plugin and JFrog CLI for scanning NPM builds within a Jenkins pipeline. By leveraging these tools developers can effectively manage their builds and ensure that they are free from vulnerabilities identified by JFrog Xray.
Prerequisites
Before proceeding, ensure you have the following:
Jenkins: Installed and configured.
JFrog Platform: Access to JFrog Artifactory and JFrog Xray.
JFrog CLI: Installed on your Jenkins server to facilitate interaction with JFrog services.
Step 1: Installing the JFrog Jenkins Plugin
To utilize the capabilities of JFrog within Jenkins, install the JFrog Plugin.
Step 2: Configuring JFrog Platform Credentials
After the plugin installation, configure the necessary credentials for JFrog Platform access and configure JFrog CLI.
Step 3: Creating and Configuring the Jenkins Pipeline
Next, create a Jenkins Pipeline that will automate the NPM build and scanning workflow.
Example Pipeline Script
Here is a sample pipeline script illustrating the integration:
pipeline {
agent any
tools {
jfrog 'jfrog-cli'
}
stages {
stage('Git Clone') {
steps {
git branch: 'master', url: "https://github.com/jfrog/project-examples.git"
}
}
stage('NPM Install') {
steps {
dir('npm-example') {
// Configure npm project's repositories
jf 'npm-config --repo-resolve jfrog-npm-remote --repo-deploy jfrog-npm-local'
// Install dependencies
jf 'npm install'
// Pack and deploy the npm package
jf 'npm publish'
}
}
}
stage('Publish Build Info') {
steps {
jf 'rt bp'
}
}
stage('Build Scan') {
steps {
jf 'bs'
}
}
}
}
Pipeline Stages Involved:
Clone Repository: Clones the repository containing the project code from Git.
NPM Configuration and Installation: Configures NPM to point to the appropriate JFrog repositories and installs project dependencies.
Publish NPM Package: Publishes the built NPM package to JFrog Artifactory.
Publish Build Information: Utilizes JFrog CLI to report build information to Artifactory.
Scan Build with Xray: Initiates a vulnerability scan with JFrog Xray on the built artifacts.
Note:
It is crucial to index the build prior to scanning with JFrog Xray, as this enables Xray to effectively analyze the dependencies. Failing to do so may result in the following error during the pipeline execution:
Here are the steps to index the build. This process enables Xray to analyze the dependencies and scan for vulnerabilities
Step 4: Save the Pipeline Configuration and Execute
After configuring the pipeline, save your changes and execute it by clicking Build Now in the Jenkins project dashboard.
Step 5: Monitoring Build Scans and Results
After the build execution, monitor the results returned by JFrog Xray for any identified vulnerabilities.
Scenario 1: Building NPM Project with Vulnerabilities
In this case, the build process is interrupted due to the detection of security vulnerabilities by JFrog Xray, which indicates that the project contains dependencies with known risks.
During the "Scan Build with Xray" stage, JFrog Xray may identify vulnerabilities in the produced artifacts. If any vulnerabilities are detected, they may lead to build failures based on their severity and the configured policies.
- Example of Detected Vulnerabilities:
- CVE-2024-43799:
- Severity: Medium
- Affected Component: send
- Version Affected: 0.16.2
- Fixed Version: [0.19.0]
- Reason for Build Failure:
- Security Violations: Builds fail if CVEs that meet policies are configured.
Sample Xray Policy: If your project’s policies dictate that builds must fail upon detecting specific vulnerabilities (e.g., all severity CVEs), JFrog Xray will prevent successful build completion.
Scenario 2: Building NPM Project with No Vulnerabilities
When scanning an NPM project that has no detected vulnerabilities, the build successfully completes, demonstrating that all dependencies are secure. This allows the team to confidently proceed with deployment, knowing that their application has undergone thorough security checks.
Conclusion:
Integrating the JFrog Jenkins Plugin and JFrog CLI enables a pipeline for NPM build scanning using JFrog Xray. By following the outlined steps, developers can automate their build process while ensuring compliance and security throughout their application lifecycle. This proactive approach to vulnerability management enhances the overall integrity and security of applications deployed within the pipeline.