Scanhub Jenkinsfile Rule (SL023)

Checks for deprecated Scanhub configurations in the project root and Jenkinsfile.

Description

This rule identifies and warns about deprecated Scanhub-related configurations that can be removed from the project root directory and the Jenkinsfile.

Rationale

Deprecated Scanhub configurations are no longer needed and should be removed to keep the project clean.

Findings

  • WARNING

    • Project root contains a .github directory

    • Jenkinsfile contains deprecated @Library(['scanhub'])_ or @Library(['scanhub', 'codeql-linux'])_

    • Jenkinsfile contains booleanParam(name: 'OIS_SCAN')

    • Jenkinsfile contains ${scanhub.SCANHUB_CONTAINERS}

    • Jenkinsfile contains triggers { cron(scanhubCron()) }

    • Jenkinsfile contains 'initialize CodeQL' stage

    • Jenkinsfile contains 'OIS SwA' stage

    • jenkins.yaml contains 'enableOisScan' or OIS references

Noncompliant

Deprecated Scanhub configurations in Jenkinsfile
@Library(['scanhub', 'codeql-linux']) _

pipeline {
    agent any
    triggers {
        cron(scanhubCron())
    }
    stages {
        stage('initialize CodeQL') {
            steps {
                echo 'Initializing CodeQL'
            }
        }
        stage('OIS SwA') {
            steps {
                echo 'Running OIS SwA'
            }
        }
    }
}
Deprecated OIS configurations in jenkins.yaml
enableOisScan: false
jiraProject: CKM # required for OIS scan functionality

Compliant

Clean Jenkinsfile without Scanhub configurations
pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                echo 'Building...'
            }
        }
    }
}
Clean jenkins.yaml without OIS configurations
image: /ckm/my-service
language: java
buildTool: skaffold-maven
imageTool: skaffold
moduleDir: .

Configuration

This rule has no configuration.