devops===》Jenkins（pipeline）+gitlab+sonar代码扫描漏洞扫描

Posted 2022-12-02 一夜暴富--gogogo

一、sonar基本概念及使用

Sonarqube是一个开源的代码质量检测工具，可以单独使用，也可以作为一个检测步骤放在Jenkins的pipeline CI/CD 流水线。简单的理解，他通过一个snarqube scanner 的工具来扫描代码，然后把结果发给 sonarqube server，用户可以在这个sonarqube server的网页界面查看报告。

当我们把Jenkins和 sonarqube整合的时候，Jenkins调用 sonarqube scanner 扫描，把结果发送给sonarqube 服务器，然后服务器完成报告之后，通过 webhook再把结果发过Jenkins，Jenkins根据结果判断是否继续运行pipeline

1.sonar创建webhooks

url填写jenkins的地址：http://jenkinsurl/sonarqube-webhook/(密码可不填）

2.Jenkins的pipeline

以Java代码为例（两种方法）

#1.第一种方法：在gitlab代码目录下上传sonar-project.properties文件，内容如下：

# must be unique in a given SonarQube instance
sonar.projectKey=test
# this is the name and version displayed in the SonarQube UI. Was mandatory prior to SonarQube 6.1.
sonar.projectName=test
sonar.projectVersion=0.0.1

# Path is relative to the sonar-project.properties file. Replace "\\" by "/" on Windows.
# This property is optional if sonar.modules is set.
sonar.sources=.
sonar.exclusions=**/test/**,**/target/**

sonar.java.source=1.8
sonar.java.target=1.8

# Encoding of the source code. Default is default system encoding
sonar.sourceEncoding=UTF-8

#####pipeline：
pipeline 
agent any

parameters 
gitParameter branchFilter: 'origin/(.*)', defaultValue: 'master', name: 'BRANCH', type: 'PT_BRANCH'
string defaultValue: 'mvn clean package -U', description: '打包命令', name: 'mvnArgs', trim: false
tools 
maven 'MAVEN'
jdk 'JDK'
nodejs 'NODEJS'


stages 
stage('pull') 
steps 
cleanWs()
checkout([$class: 'GitSCM', branches: [[name: "$params.BRANCH"]], doGenerateSubmoduleConfigurations: false, extensions: [], submoduleCfg: [], userRemoteConfigs: [[credentialsId: '0-4a15-b78d-708e01dfcc07', url: "ssh://git仓库地址"]]])



stage('SonarQubeanalysis')    #代码扫描
steps
script 
scannerHome = tool 'sonarscanner'   #与Jenkins全局变量设置里名称一致

withSonarQubeEnv('sonarqube')     #与Jenkins系统设置里name一致
sh "$scannerHome/bin/sonar-scanner -Dsonar.java.binaries=. -Dsonar.sources=."



stage("Quality Gate")    
steps 
script 
            sleep(10)   //这里遇到一个坑  返回状态出现阻塞现象 加sleep 后正常

            timeout(15) 

                  //利用sonar webhook功能通知pipeline代码检测结果，未通过质量阈，pipeline将会fail

                  def qg = waitForQualityGate()

                      if (qg.status != 'OK') 

                          error "未通过Sonarqube的代码质量阈检查，请及时修改！failure: $qg.status"

                          bearychatSend message:"Jenkins发布项目 $env.JOB_NAME 第$env.BUILD_NUMBER，代码静态检测结果:未通过：$qg.status",webhook: "$bearychat_url"

                      

                  

              



stage('MVN') 
steps 
sh "$params.mvnArgs"

#2.第二种方法（直接编写pipeline不用定义sonar-project.properties文件，所需参数通过-D指定）：
 def createVersion() 
    return new Date().format('yyyyMMddHHmmss')

 pipeline 
    agent any
environment 
        _version = createVersion()
    
parameters 
  gitParameter branchFilter: 'origin/(.*)', defaultValue: 'master', name: 'BRANCH', type: 'PT_BRANCH'
  string defaultValue: 'mvn clean package', description: '打包命令', name: 'mvnArgs', trim: false    
 tools 
        maven 'MAVEN'
        jdk 'JDK'
        nodejs 'NODEJS'
    
     
stages 
        stage('pull') 
            steps 
                cleanWs()
                checkout([$class: 'GitSCM', branches: [[name: "$params.BRANCH"]], doGenerateSubmoduleConfigurations: false, extensions: [], submoduleCfg: [], userRemoteConfigs: [[credentialsId: '07-4a15-b78d-708e01d07', url: "ssh://git仓库地址"]]])
            
        
 stage('SonarQubeanalysis') 
            steps
                script 
                 scannerHome =  tool 'sonarscanner'
                
            withSonarQubeEnv('sonarqube') 
                sh "$scannerHome/bin/sonar-scanner  -Dsonar.projectKey=devops-iov-base -Dsonar.projectVersion=$_version -Dsonar.projectName=devops-iov-base -Dsonar.java.binaries=.  -Dsonar.sources=."
            
            
        
           stage("Quality Gate") 
               steps 
                   timeout(time: 1, unit: 'HOURS')       
                   sleep (10)      
                   waitForQualityGate abortPipeline: true     
                       
                
        
 
        stage('MVN') 
            steps 
            sh  "$params.mvnArgs"
            
        
  stage('docker-build') 
            steps 
                 
              script
                    env.COMMIT= sh(returnStdout: true, script: 'git rev-parse --short HEAD').trim()
                  	sh """
                  	#!/bin/bash
                   echo $COMMIT
                   echo $_version
				   docker login test.com --username 123456 --password eyJhbGciOiJSUzI1NiIsImtpZCI6IlZVRFM6
                   docker build  --build-arg test -t test.com/test/test:$params.BRANCH-$COMMIT-$_version . 
                   docker push  test.com/test/test:$params.BRANCH-$COMMIT-$_version
                   docker rmi test.com/test/test:$params.BRANCH-$COMMIT-$_version
			    """
              
            
         
        stage('docker-deploy') 
            steps 
                 
              script
                    env.COMMIT= sh(returnStdout: true, script: 'git rev-parse --short HEAD').trim()
                  	sh """
                  	#!/bin/bash
                   echo $COMMIT
                   echo $_version
				   cp /data/jenkins/deploy/devops/service-deploy.sh .
				   cp /data/jenkins/deploy/devops/test.yml .
				   sed  -i 's/:5.0_beta/:'$params.BRANCH-$COMMIT-$_version'/'  test.yml
				   sed -i "/sleep 2/i docker pull test.com/test/test:$params.BRANCH-$COMMIT-$_version" service-deploy.sh
				   scp -P 22 service-deploy.sh  root@172.17.1:/data/ota-deploy/scripts
				   scp -P 22 test.yml  root@172.17:/data/ota-deploy/scripts
				  ssh -p 22 -tt root@172.17 << remotessh
				  cd /data/ota-deploy/scripts 
				  sh service-deploy.sh iov-base
				  exit
				  remotessh
			    """
              
            
        

构建成功后会在sonar的web的界面生成项目，也可在Jenkins上查看