Python library

Run static code security analysis

Available since 1.2

Run static code analysis using M2A standards with bandit.

Info: bandit will be installed manually using the pre-configured version. pip must be availabe in the context runtime

Signature

python.static_code_sec_analysis(String[] excluded = [])

Parameter

• excluded is a list of path to exclude for the analysis. By default, it will ignore test, packer, build and features

Examples

Simple usage:

utils.build_notify(currentBuild, 'my-static-analysis', "Static analysis"){
    python.static_code_sec_analysis()
}

Run dependency security vulnerability analysis

Available since 1.2

Run dependency analysis for known CVEs using M2A standards with security.

Info: security will be installed manually using the pre-configured version. pip must be availabe in the context runtime

Signature

python.dependency_sec_analysis()

Examples

Simple usage using utils.build_notify:

utils.build_notify(currentBuild, 'my-dependecy-analysis', "Dependency analysis"){
    python.dependency_sec_analysis()
}

Run isolated dependency security vulnerability analysis

Available since 1.12

Same check as dependency_sec_analysis, but safety runs from its own virtualenv in /tmp/safety-venv instead of being installed into the project’s environment. The project’s installed packages are exported with pip list --format=freeze to safety/requirements.txt and scanned from there.

Use this when the project’s environment is incompatible with the pinned safety version, e.g. setuptools 81+ no longer ships pkg_resources, which safety 2.x imports. It also keeps safety’s own dependencies out of both the project’s environment and the scan results.

Info: python with the venv module and pip must be available in the context runtime

Signature

python.isolated_dependency_sec_analysis(ArrayList extra_ignored_ids = [])

Parameter

• extra_ignored_ids is a list of vulnerability IDs to ignore in addition to the M2A defaults

Examples

Simple usage using utils.build_notify:

utils.build_notify(currentBuild, 'my-dependecy-analysis', "Dependency analysis"){
    python.isolated_dependency_sec_analysis()
}