Code repo scanning
Table of Contents
Code repo scanning
Both twistcli and the Jenkins plugin can evaluate package dependencies in your code repositories for vulnerabilities.
The runtimes supported are:
- Go
- Java
- Node.js
- Python
- Ruby
Integrate code scanning into CI builds
Point the Jenkins plugin to your code repo in the build directory.
Prerequisites:
You’ve installed and configured the Prisma Cloud Jenkins plugin.- In your Jenkins job configuration, clickAdd build step, and selectScan Prisma Cloud Code Repositories.
- Configure the repo scan.
- InRepository Name, specify the name to be used when reporting the results in Console.
- InRepository path, specify the path to the repo in the build directory.For example, it could simply be the current working directory (.) or some relative directory.
- ClickSave, and then execute a build job.To see the scan results, log into Console, and go toMonitor > Vulnerabilities > Code repositories > CI. Prisma Cloud evaluates the contents of the repo according to the policy you’ve specified inDefend Vulnerabilities > Code repositories > CI. Prisma Cloud ships with a single default rule that alerts on all vulnerabilities.
Use twistcli to scan repos in the CI
If you’re using a CI tool other than Jenkins, Prisma Cloud ships a command line utility that can be invoked from the shell in the build pipeline.
For more information, see code repo scanning with twistcli.