{"id":14984691,"url":"https://github.com/praqma/sdelements-plugin","last_synced_at":"2025-04-10T21:21:54.491Z","repository":{"id":47176613,"uuid":"126199195","full_name":"Praqma/sdelements-plugin","owner":"Praqma","description":"Jenkins plugin for SD Elements risk assessment tool by Security Compass","archived":false,"fork":false,"pushed_at":"2021-09-09T19:46:49.000Z","size":443,"stargazers_count":3,"open_issues_count":4,"forks_count":6,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-24T18:52:25.002Z","etag":null,"topics":["jenkins-ci","jenkins-plugin","plugin","security"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Praqma.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-03-21T15:21:28.000Z","updated_at":"2020-11-11T16:17:06.000Z","dependencies_parsed_at":"2022-09-21T12:44:19.430Z","dependency_job_id":null,"html_url":"https://github.com/Praqma/sdelements-plugin","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Praqma%2Fsdelements-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Praqma%2Fsdelements-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Praqma%2Fsdelements-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Praqma%2Fsdelements-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Praqma","download_url":"https://codeload.github.com/Praqma/sdelements-plugin/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248299021,"owners_count":21080448,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["jenkins-ci","jenkins-plugin","plugin","security"],"created_at":"2024-09-24T14:09:31.679Z","updated_at":"2025-04-10T21:21:54.469Z","avatar_url":"https://github.com/Praqma.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Jenkins SD Elements plugin\n\n[![Build Status](https://travis-ci.org/Praqma/sdelements-plugin.svg?branch=master)](https://travis-ci.org/Praqma/sdelements-plugin\n)\n\nJenkins integration for [SD Elements risk assessment](https://www.securitycompass.com/sdelements) by [Security Compass](https://www.securitycompass.com/).\n\nAdd a post-build action to pass/fail your job, based on the status of the risk assessment.\n\nDeveloped by Praqma, funded by Security Compass\n\n## Features\n\n* Configure SD Elements servers in Jenkins global configuration (Jenkins -\u003e Configure system)\n* Configure post-build action in Jenkins job to check for risk compliance:\n  * Configure project ID from SD Elements\n  * Chose SD Elements server (from the one configured globally)\n* Post-build step will query project risk compliance:\n  * Risk status pass allows successful build\n  * Risk status fail fails the build, but configuration allows to set unstable\n  * Failure to determine risk status will fail the build, error message can be found in build console output\n  * If mandatory SD Element project survey isn't completed, job fails\n\nUI and summary:\n\n* Left menu `SD Elements` links SD Elements server URL configured for the job\n* In summary section `SD Elements Risk Status` links to the project page in SD Elements for the project configured in the job\n\n## Getting started\n\n_See also screenshots below_.\n\n### Downloading a pre-release version\n\nIf you're not using the update center, you can download the latest plugin (`.hpi`) release from this page: https://github.com/Praqma/sdelements-plugin/releases\n\n### Installing plugin from .hpi file\n\nIn Jenkins you go to `manage plugins` -\u003e `advanced` -\u003e `upload plugin` and select the `.hpi` you just downloaded.\n\nRemember, when doing manual install plugin dependencies are **NOT** installed, so for this plugin you'll need to install the [Plain Credentials Plugin](https://wiki.jenkins.io/display/JENKINS/Plain+Credentials+Plugin) first.\n\n### Configuring credentials\n\nThe plugin only supports the usage of credentials using a generated token. You need to generate a token in SD Elements for your user that can read the status of projects. You do that by clicking `\u003cyour name\u003e` in the upper right corner, and the `api` and then you generate your token by clicking the `Generate` button.\n\nOnce you've created your SD Elements token you need to create an instance of your SD Elements server configuration in Jenkins:\n\n`Manage Jenkins` -\u003e `Configure system` -\u003e `Security Compass SD Elements configuration`\n\nFill in a chosen name for the connection, server address and add a credential to use. For this you need to use the `Secret text` where you put in your generated api token.\n\n### Finding your project id\n\nIn order to obtain your project id for use in a job, you need to log into SD Elements using a browser first. Use your username and password.\n\nThen browse this address (same browser window): `\u003cyour_sd_elememts_server\u003e/api/v2/projects/`. This gives you a json response. Inside the response you'll find a number of entries like: `\"id\":`. These are the project id's you need. The name of the project is in the following `\"slug\"` element.\n\n### Configuring your job\n\nOnce you've determined the project id to use, and have setup a server you can go ahead a configure a job, in the job configuration page click the following:\n\n`Add post-build action` -\u003e `SD Elements`\n\nSelect your configured sd elements server and fill in the project id you've just obtained.\n\n## Screenshots\n\n### Jenkins -\u003e Configure System\n\nAlso called global configuration:\n\n![Global configuration](docs/global-configuration.png)\n  * Credentials must be type `Secret text`, where you supply the SD Elements API token.\n\n\n### Project page (job page)\n\nShows latest status for last build checking risk status.\n\nBelow it **Shows unable to determine risk compliance**, e.g. when it can be found due to configuration errors like wrong server URL, authentication and like. Check console log for description of the problem.\n\n    Invalid token in credentials\n    401 Unauthorized\n    SD Elements compliance status: Undetermined\n    Build step 'SD Elements' changed build result to FAILURE\n\n![Project page - unable to determine risk status](docs/project-page-unable-to-determine-risk-compliance.png)\n\n### Build pages\n\nBuild pages shows historic results for each builds, but the graphics are the same as on the project page. Examples:\n\n\n**Build successful when risk status pass:**\n![Build successful when risk status pass](docs/build-page-risk-status-pass.png)\n\n**Build fails when risk status fails:**\n![Build fails when risk status fails](docs/build-page-risk-status-fail.png)\n\n**Configuration can set build status unstable when risk status fails:**\n![Build fails when risk status fails](docs/build-page-risk-status-fail-job-configured-unstable.png)\n\n**Build will fail when mandatory survey in SD Elements isn't completed:**\n![Build will fail when mandatory survey in SD Elements isn't completed](docs/build-page-risk-status-undetermined-survey-not-completed.png)\n\n\n# Developer information\n\n## Testing\n\nThere are functional tests to run executing most relevant use-cases and some fail-cases.\n\nTo run them you need access to a running SD Elements service, and you must pass your API token and server URL to the test execution.\n\nCurrently project ID's are hard-coded, you need to replace them, see [#29](https://github.com/Praqma/sdelements-plugin/issues/29).\n\n## SD Elements API package\n\nThe integration and communication with the SD Elements service is wrapped in a separate package `io.jenkins.plugins.sdelements.api` to allow it to be extracted as a separate library and reused for developing integration for other CI server if needed.\n\nDesign objectives:\n\n* `io.jenkins.plugins.sdelements.api` shouldn't contain any Jenkins or CI specifics\n* it should wrap communication with the service, as well a interpret the results to hand over simple status to the CI part\n* the CI server should handle the simple interpretation of the result to set build status accordingly, and should rely on error messages and status, text and wording passed from the API\n\n## GitHub Travis setup\n\n### Releases\n\nWe've configured travis releases using the cli with the following commands:\n\n```\n$ travis setup releases\nUsername: ReleasePraqma\nPassword for ReleasePraqma: **********\nFile to Upload: target/sdelements.hpi\nDeploy only from Praqma/sdelements-plugin? |yes| yes\nEncrypt API key? |yes| yes\n```\n\nThe `.travis.yml` was modified slightly we added the tags flag to the deployment section:\n\n```\nlanguage: java\njdk:\n- oraclejdk8\ninstall: true\ncache:\n  directories:\n  - \"$HOME/.m2\"\nscript:\n- mvn package |  egrep -v 'Download(ing|ed)'\ndeploy:\n  provider: releases\n  api_key:\n    secure: SEFzWVEG6H9Zcu7wOzYueGfhAisGiF7o/cMocTdYvGG1z4WwIUtHb1AfKmxbyWna72kybHtdBjnMAJ8l7gwp7UOPpHKsIkBKQ5SXa3S/2Fqj7Aq2UFioeqklqDpOlYSobUyp9epUTJnTwFTUFN4hYKxQG2ZL89xTNk3+5UxRsyH9KbL/4c6Gs8WRpmLKn0h1EHSGHw$\n  file: target/sdelements.hpi\n  skip_cleanup: true\n  on:\n    tags: true\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpraqma%2Fsdelements-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpraqma%2Fsdelements-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpraqma%2Fsdelements-plugin/lists"}