Reference B: Jenkins code scan workflow template with checkout

Configure a Jenkins code scan workflow with repository checkout.

This Jenkins workflow automates code scanning using the Cortex CLI. It includes a repository checkout step. Replace placeholder values and generic terms, such as dev, before use.

pipeline {
    agent {
        docker {
            image 'jenkins/agent:alpine'
            args '-u root --privileged -v /var/run/docker.sock:/var/run/docker.sock'
            label '<REPLACE WITH LABLE OF NODE WITH DOCKER INSTALLED>' // Use a docker agent with docker installed
        }
    }

    environment {
        CORTEX_API_KEY = credentials('CORTEX_API_KEY')
        CORTEX_API_KEY_ID = credentials('CORTEX_API_KEY_ID')
        CORTEX_API_URL = '<YOUR_CORTEX_URL>' // Your placeholder
        CORTEX_CLI_VERSION = '0.8.11'
    }

    stages {
        stage('Checkout Repository') {
            steps {
                git branch: 'main', url: 'https://github-example.com/example-repo'
                stash includes: '**/*', name: 'source'
            }
        }

        stage('Install Dependencies') {
            steps {
                sh '''
                apk add --no-cache jq docker
                '''
            }
        }

        stage('Get Temporary Token') {
            environment {
                TEMP_TOKEN = ""
            }
            steps {
                script {
                    def response = sh(script: """
                        curl --location '${env.CORTEX_API_URL}/public_api/cas/v1/cortex-cli/create-token' \
                          --header 'Authorization: ${env.CORTEX_API_KEY}' \
                          --header 'x-xdr-auth-id: ${env.CORTEX_API_KEY_ID}' \
                          --header 'Content-Type: application/json' \
                          --data '{}' \
                          -s
                    """, returnStdout: true).trim()

                    env.TEMP_TOKEN = sh(script: """echo '${response}' | jq -r '.token'""", returnStdout: true).trim()
                }
            }
        }

        stage('Pull Docker Image') {
            steps {
                sh """
                docker pull distributions-dev.traps.paloaltonetworks.com/cli-docker/${env.TEMP_TOKEN}/method:amd64-${env.CORTEX_CLI_VERSION}-dev
                docker tag distributions-dev.traps.paloaltonetworks.com/cli-docker/${env.TEMP_TOKEN}/method:amd64-${env.CORTEX_CLI_VERSION}-dev cortexcli:${env.CORTEX_CLI_VERSION}
                """
            }
        }

        stage('Run Docker Container') {
            // Replace the repo-id with your repository like: owner/repo
            steps {
                unstash 'source'
                env.BRANCH = sh(script: "git rev-parse --abbrev-ref HEAD", returnStdout: true).trim()
                sh """
                docker run --rm --platform linux/amd64 cortexcli:${env.CORTEX_CLI_VERSION} \
                  --api-base-url ${env.CORTEX_API_URL} \
                  --api-key ${env.CORTEX_API_KEY} \
                  --api-key-id ${env.CORTEX_API_KEY_ID} \
                  code scan \
                  --directory . \
                  --repo-id <REPLACE WITH REPO_OWNER/REPO_NAME> \
                  --branch $BRANCH
                """
            }
        }
    }
}