contrastExecuteScan

This step evaluates if the audit requirements for Contrast Assess have been fulfilled.

Description

This step evaluates if the audit requirements for Contrast Assess have been fulfilled after the execution of security tests by Contrast Assess.

Usage

We recommend to define values of step parameters via .pipeline/config.yml file.
In this case, calling the step is essentially reduced to defining the step name.
Calling the step can be done either in an orchestrator specific way (e.g. via a Jenkins library step) or on the command line.

JenkinsCommand Line

library('piper-lib-os')

contrastExecuteScan script: this

piper contrastExecuteScan

Outputs

Output type	Details

Parameters

Overview - Step

Name	Mandatory	Additional information
applicationId	yes
organizationId	yes
script	(yes)	reference to Jenkins main pipeline script
server	yes
serviceKey	(yes)	pass via ENV, Vault or Jenkins credentials (userCredentialsId)
userApiKey	(yes)	pass via ENV, Vault or Jenkins credentials (apiKeyCredentialsId)
username	(yes)	pass via ENV, Vault or Jenkins credentials (userCredentialsId)
checkForCompliance	no
verbose	no	activates debug output
vulnerabilityThresholdTotal	no

Overview - Execution Environment

Orchestrator-specific only

These parameters are relevant for orchestrator usage and not considered when using the command line option.

Name	Mandatory	Additional information
stashContent	no

Details

applicationId

Application UUID. It's the Last UUID of application View URL

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	yes
Default	$PIPER_applicationId (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

checkForCompliance

If set to true, the piper step checks for compliance based on vulnerability thresholds. Example - If total vulnerabilities are 10 and vulnerabilityThresholdTotal is set as 0, then the steps throws an compliance error.

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	true
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

organizationId

Organization UUID. It's the first UUID in most navigation URLs.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	yes
Default	$PIPER_organizationId (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

script

The common script environment of the Jenkinsfile running. Typically the reference to the script calling the pipeline step is provided with the this parameter, as in script: this. This allows the function to access the commonPipelineEnvironment for retrieving, e.g. configuration parameters.

back to overview

Scope	Details
Aliases	-
Type	Jenkins Script
Mandatory	yes
Default
Secret	no
Configuration scope	☐ parameter ☐ general ☐ steps ☐ stages
Resource references	none

server

The URL of the Contrast Assess Team server.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	yes
Default	$PIPER_server (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

serviceKey

User Service Key for authorization access to Contrast Assess.

back to overview

Scope	Details
Aliases	service_key
Type	string
Mandatory	yes
Default	$PIPER_serviceKey (if set)
Secret	yes
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	Jenkins credential id:   id: userCredentialsId   reference to: serviceKey Vault resource:   name: contrastVaultSecretName   default value: contrast Vault paths: $(vaultPath)/contrast $(vaultBasePath)/$(vaultPipelineName)/contrast $(vaultBasePath)/GROUP-SECRETS/contrast

stashContent

Jenkins-specific: Used for proper environment setup.

Specific stashes that should be considered for the step execution.

back to overview

Scope	Details
Aliases	-
Type	[]string
Mandatory	no
Default	- buildDescriptor - tests
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

userApiKey

User API key for authorization access to Contrast Assess.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	yes
Default	$PIPER_userApiKey (if set)
Secret	yes
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	Jenkins credential id:   id: apiKeyCredentialsId Vault resource:   name: contrastVaultSecretName   default value: contrast Vault paths: $(vaultPath)/contrast $(vaultBasePath)/$(vaultPipelineName)/contrast $(vaultBasePath)/GROUP-SECRETS/contrast

username

Email to use for authorization access to Contrast Assess.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	yes
Default	$PIPER_username (if set)
Secret	yes
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	Jenkins credential id:   id: userCredentialsId   reference to: username Vault resource:   name: contrastVaultSecretName   default value: contrast Vault paths: $(vaultPath)/contrast $(vaultBasePath)/$(vaultPipelineName)/contrast $(vaultBasePath)/GROUP-SECRETS/contrast

verbose

verbose output

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	false
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

vulnerabilityThresholdTotal

Threshold for maximum number of allowed vulnerabilities.

back to overview

Scope	Details
Aliases	-
Type	int
Mandatory	no
Default	0
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

userCredentialsId

Jenkins 'Username with password' credentials ID containing username (email) and service key to communicate with the Contrast server.

back to overview

Scope	Details
Aliases	-
Type	string
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages

apiKeyCredentialsId

Jenkins 'Secret text' credentials ID containing user API key to communicate with the Contrast server.

back to overview

Scope	Details
Aliases	-
Type	string
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages