Introduction

The Code Scan plugin of Devtron allows you to perform the code scanning using Trivy. By integrating the Code Scan plugin into your workflow you can detect common Vulnerabilities, Misconfigurations, License Risks, and Exposed Secrets in your code.

Prerequisites

Before integrating the Code Scan plugin, install the Vulnerability Scanning (Trivy/Clair) integration from Devtron Stack Manager.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the Build and Deploy from Source Code.

5. Fill the required fields in the Create build pipeline window and navigate to the Pre-build stage.

1. Under 'TASKS', click the + Add task button.

2. Select the Code Scan plugin.

3. Enter the following user inputs with appropriate values.

User Inputs

Task Name

Enter the name of your task

e.g., Code Scanning

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., The Code Scan plugin is integrated for scanning the in-code vulnerabilities.

Input Variables

No input variables are required for the Code Scan plugin.

Output Variables

Code Scan will not be generating an output variable.

Click Update Pipeline.

We have multiple plugins available in Devtron. At the moment, here are the plugins for which user guide is available.

• Codacy

• Code-Scan

• Copacetic

• Copy Container Image

• Dependency track - Maven & Gradle

• Dependency track - NodeJS

• Dependency track - Python

• GoLang-migrate

• Jenkins

• Jira Issue Validator

• Jira Issue Updater

• K6 Load Testing

• Pull images from container repository

• Semgrep

• SonarQube

• SonarQube v1.1.0

Introduction

The Container Image Exporter plugin facilitates the export of container images into tarball files and then uploads these files to cloud storage. This process simplifies the transfer of container images, particularly beneficial for air-gapped environments where external network access is restricted. By converting images to tarballs, you can easily transport them via physical drives to the isolated systems. This approach is especially valuable in scenarios where direct network-based transfers are not permitted.

Prerequisites

Before integrating the Container Image Exporter plugin, you need to properly configure your cloud storage to store the generated tarball files.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the Build and Deploy from Source Code.

5. Fill the required fields in the Create build pipeline window and navigate to the Post-Build stage.

1. Under 'TASKS', click the + Add task button.

2. Select the Container Image Exporter plugin.

3. Enter the following user inputs with appropriate values.

User Inputs

Task Name

Enter the name of your task

e.g., Container Image Exporter

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., The Container Image Exporter plugin is integrated to generate a tarball archive of docker images

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

Container Image Exporter will not be generating an output variable.

Click Update Pipeline.

Introduction

The Cosign plugin by Devtron enables secure signing of your container images, enhancing supply chain security. It authenticates your identity as the creator and ensures image integrity, allowing users to verify the source and detect any tampering. This provides greater assurance to developers incorporating your artifacts into their workflows.

Prerequisites

Before integrating the Cosign plugin, ensure that you have configured the Cosign and have a set of private and public keys to sign the container images.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the Build and Deploy from Source Code.

5. Fill the required fields in the Create build pipeline window and navigate to the Post-build stage.

1. Under 'TASKS', click the + Add task button.

2. Click the Cosign plugin.

3. Enter the following user inputs with appropriate values.

User Inputs

Task Name

Enter the name of your task

e.g., Signing of container images

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., The Cosign plugin is integrated for ensuring the authenticity of container images.

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

Cosign will not be generating an output variable.

Click Update Pipeline.

Introduction

The Copacetic plugin of Devtron helps you patch your container image vulnerabilities traced by the security scan Devtron performed on your container image. By integrating the Copacetic plugin into your workflow and enabling the Scan for vulnerabilities at your Build stage, you can:

• Trace the vulnerabilities of your container images, and the Copacetic plugin will automatically patch the container image vulnerabilities for you.

Prerequisites

Before integrating the Copacetic plugin, install the Vulnerability Scanning (Trivy/Clair) integration from Devtron Stack Manager. Once the integration is installed, make sure you have enabled Scan for vulnerabilities at the Build stage or integrated the Code-Scan plugin in the Pre-build stage.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the Build and Deploy from Source Code.

5. Fill the required fields in the Create build pipeline window and navigate to the Post-build stage.

1. Under 'TASKS', click the + Add task button.

2. Click the Copacetic plugin.

3. Enter the following user inputs with appropriate values.

User Inputs

Task Name

Enter the name of your task.

e.g., Patch container image vulnerability

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., The Copacetic plugin is configured to patch the vulnerabilities in container image

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

Copacetic will not be generating an output variable.

Click Update Pipeline.

Codacy is an automated code analysis/quality tool that helps developers to ship better software in a faster manner.

Prerequisite: Make sure you have set up an account in Codacy or get the API keys from an admin.

1. On the Edit build pipeline page, select the Pre-Build Stage (or Post-Build Stage).

2. Click + Add task.

3. Select Codacy from PRESET PLUGINS.

• Enter a relevant name in the Task name field. It is a mandatory field.

• Enter a descriptive message for the task in the Description field. It is an optional field.

• Provide a value for the input variable. Note: The value may be any of the values from the previous build stages, a global variable, or a custom value.

• Trigger/Skip Condition refers to a conditional statement to execute or skip the task. You can select either:

  • Set trigger conditions or

  • Set skip conditions

• Pass/Failure Condition refers to conditions to execute pass or fail of your build. You can select either:

  • Set pass conditions or

  • Set failure conditions

• Click Update Pipeline.

Introduction

Building container images in CI often results in a growing number of images, not all of which are production-ready. Therefore, it's a best practice to maintain a separate repository exclusively for storing production-builds. However, this would involve copying the container image (production-ready) from your existing repository to the production repository.

This plugin helps you copy a container image to a desired container repository. The pushing of image can be between repositories of the same container registry or between repositories of different container registry. One of the major usecases this plugin serves is multi-cloud deployments.

The plugin can be used at post CI, pre-CD, and post-CD. Moreover, you can also customize the image tag pattern for the copied image.

Steps to Use

1. Go to App Configuration tab of your application.

2. Select Workflow Editor and click your deployment pipeline.
3. In this example, we will be adding the plugin in pre-CD stage; therefore, go to Pre-Deployment stage tab of your deployment pipeline and click Add task.
4. From the list of plugins, choose Copy container image.
5. Add the image destination in the field given for DESTINATION_INFO variable. The format is registry-name | username/repository-name.

   • registry-name is the name you gave to your container registry while adding it in Global Configuration → OCI/Container Registry.

   • user-name is the your account name registered with you container registry, e.g., DockerHub.

   • repository-name is the name of the repository within your container registry that hosts the container images of your application.

6. Click Update Pipeline.

7. Go to the Build & Deploy tab of your application and click Select Image in the pre-deployment stage.
8. Choose a CI image that you wish to copy to the destination and click Trigger Stage.
9. The copying process will initiate, and once it is successful, the tag for the copied image would reflect at all relevant screens:

   • Destination Repository

   • CD Pipeline (Image Selection)

Introduction

The Devtron CI Trigger plugin allows you to trigger the CI stages of the target Devtron App from the current application workflow. This plugin offers flexibility in managing application dependencies. For example, by incorporating this plugin into your application workflow, you can trigger CI builds of other applications that contain dependencies required by your current application, ensuring a smooth and coordinated CI/CD process.

Prerequisites

Before integrating the Devtron CI Trigger plugin, you need to properly configure the target CI pipeline of the Devtron App to ensure smooth execution.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the Build and Deploy from Source Code.

5. Fill the required fields in the Create build pipeline window and navigate to the Create deployment pipeline.

6. Fill the required fields in the Deployment Stage window and navigate to the Pre-Deployment stage.

1. Under 'TASKS', click the + Add task button.

2. Select the Devtron CI Trigger plugin.

3. Enter the following with appropriate values.

User Inputs

Task Name

Enter the name of your task

e.g., Triggers CI Pipeline

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., The Devtron CI Trigger plugin is integrated for triggering the CI stage of another application.

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

Devtron CI Trigger will not be generating an output variable.

Click Update Pipeline.

Configuring Dependency Track for Python in pre-build or post build task creates a bill of materials from Python projects and environments and uploads it to D-track for to identify and reduce risk in the software supply chain.

Prerequisite: Make sure you have set up an account in dependency track or get the API keys from an admin.

1. On the Edit build pipeline page, select the Pre-Build Stage (or Post-Build Stage).

2. Click + Add task.

3. Select Dependency track for Python from PRESET PLUGINS.

• Enter a relevant name in the Task name field. It is a mandatory field.

• Enter a descriptive message for the task in the Description field. It is an optional field.

• Provide a value for the input variable. Note: The value may be any of the values from the previous build stages, a global variable, or a custom value.

• Trigger/Skip Condition refers to a conditional statement to execute or skip the task. You can select either:

  • Set trigger conditions or

  • Set skip conditions

• Click Update Pipeline.

Configuring Dependency Track for NodeJs in pre-build or post build task creates a bill of materials from Maven & Gradle projects and environments and uploads it to D-track for to identify and reduce risk in the software supply chain.

Prerequisite: Make sure you have set up an account in dependency track or get the API keys from an admin.

1. On the Edit build pipeline page, select the Pre-Build Stage (or Post-Build Stage).

2. Click + Add task.

3. Select Dependency track for Maven & Gradle from PRESET PLUGINS.

• Enter a relevant name in the Task name field. It is a mandatory field.

• Enter a descriptive message for the task in the Description field. It is an optional field.

• Provide a value for the input variable. Note: The value may be any of the values from the previous build stages, a global variable, or a custom value.

• Trigger/Skip Condition refers to a conditional statement to execute or skip the task. You can select either:

  • Set trigger conditions or

  • Set skip conditions

• Click Update Pipeline.

Introduction

The CraneCopy plugin by Devtron facilitates the transfer of multi-architecture container images between registries. When integrated into Devtron's Post-build stage, this plugin allows you to efficiently copy and store your container images to a specified target repository.

Prerequisites

No prerequisites are required for integrating the CraneCopy plugin.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the Build and Deploy from Source Code.

5. Fill the required fields in the Create build pipeline window and navigate to the Post-build stage.

1. Under 'TASKS', click the + Add task button.

2. Click the CraneCopy plugin.

3. Enter the following with appropriate values.

User Inputs

Task Name

Enter the name of your task

e.g., Copy and store container images

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., The CraneCopy plugin is integrated to copy the container images from one registry to another.

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

CraneCopy will not be generating an output variable.

Click Update Pipeline.

Configuring Dependency Track for NodeJs in pre-build or post build task creates a bill of materials from NodeJs projects and environments and uploads it to D-track for to identify and reduce risk in the software supply chain.

Prerequisite: Make sure you have set up an account in dependency track or get the API keys from an admin.

1. On the Edit build pipeline page, select the Pre-Build Stage (or Post-Build Stage).

2. Click + Add task.

3. Select Dependency track for NodeJs from PRESET PLUGINS.

• Enter a relevant name in the Task name field. It is a mandatory field.

• Enter a descriptive message for the task in the Description field. It is an optional field.

• Provide a value for the input variable. Note: The value may be any of the values from the previous build stages, a global variable, or a custom value.

• Trigger/Skip Condition refers to a conditional statement to execute or skip the task. You can select either:

  • Set trigger conditions or

  • Set skip conditions

• Click Update Pipeline.

Introduction

The Devtron CD Trigger plugin allows you to trigger the PRE-CD, CD, or POST-CD stages of target Devtron App from within your current application workflow. This plugin offers flexibility in managing application dependencies and deployment sequences. For example, by incorporating this plugin at the pre-deployment stage of your application workflow, you can deploy another application that contains dependencies required by your current application, ensuring a coordinated deployment process.

Prerequisites

Before integrating the Devtron CD Trigger plugin, you need to properly configure the target Devtron App to ensure smooth execution.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the Build and Deploy from Source Code.

5. Fill the required fields in the Create build pipeline window and navigate to the Create deployment pipeline.

6. Fill the required fields in the Deployment Stage window and navigate to the Post-Deployment stage.

1. Under 'TASKS', click the + Add task button.

2. Select the Devtron CD Trigger plugin.

3. Enter the following with appropriate values.

User Inputs

Task Name

Enter the name of your task

e.g., Triggers CD Pipeline

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., The Devtron CD Trigger plugin is integrated for triggering the CD stage of another application.

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

Devtron CD Trigger will not be generating an output variable.

Click Update Pipeline.

Introduction

Jenkins is an open-source Continuous Integration (CI) server. You can manage multiple stages of software delivery using Jenkins including Automated testing, Static Code Analysis, Building, Packaging, and Deploying. With Devtron's Jenkins plugin, you can:

• Trigger pre-configured Jenkins jobs from Devtron and stream the logs to the Devtron dashboard.

• Execute Jenkins build pipelines through Devtron and deploy to target environments using the Devtron CD pipeline.

Prerequisites

Before integrating the Jenkins plugin, ensure that you have properly configured your Jenkins job and also have the necessary parameters set for triggering from Devtron.

Steps

1. Go to Applications → Devtron Apps.

2. Click on your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the CREATE JOB PIPELINE.

5. Enter the required fields in the Basic configuration window.

6. Under 'TASKS', click the + Add task button.

7. Click the Jenkins plugin.

8. Enter the following user inputs with appropriate values.

User Inputs

Task Name

Enter the name of your task.

e.g. Jenkins_Job

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g. Trigger the build Job of Jenkins

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

Jenkins will not be generating an output variable.

Click Update Pipeline.

Introduction

The DockerSlim plugin by Devtron helps you to optimize your container deployments by reducing Docker image size. Now with these lighter Docker images, you can perform faster deployments and enhance overall system efficiency.

Prerequisites

No prerequisites are required for integrating the DockerSlim plugin.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the Build and Deploy from Source Code.

5. Fill the required fields in the Create build pipeline window and navigate to the Post-build stage.

1. Under 'TASKS', click the + Add task button.

2. Click the DockerSlim plugin.

3. Enter the following user inputs with appropriate values.

User Inputs

Task Name

Enter the name of your task

e.g., Reduce Docker image size

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., The DockerSlim plugin is integrated for reducing the size of Docker image.

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

DockerSlim will not be generating an output variable.

Click Update Pipeline.

Migrate reads migrations from sources file and applies them in correct order to a database.

Prerequisite: Make sure you have SQL files in format used by the golang-migrate tool.

official-documentation: https://github.com/golang-migrate/migrate postgres-example: https://github.com/golang-migrate/migrate/tree/master/database/postgres

1. On the Edit build pipeline page, select the Pre-Build Stage (or Post-Build Stage). or

2. Click + Add task.

3. Select GoLang-migrate from PRESET PLUGINS.

• Enter a relevant name in the Task name field. It is a mandatory field.

• Enter a descriptive message for the task in the Description field. It is an optional field.

• Provide a value for the input variable. Note: The value may be any of the values from the previous build stages, a global variable, or a custom value.

• Trigger/Skip Condition refers to a conditional statement to execute or skip the task. You can select either:

  • Set trigger conditions or

  • Set skip conditions

• Click Update Pipeline.

Notes

• Use in-cluster/ Execute tasks in application environment feature in pre-deploy or post-deploy, in case when the database service is not reachable or accessible from devtron cluster.

• In case the DB_TYPE is not supported for your database, then use POST_COMMAND as

  Copy

  POST_COMMAND: 
       docker run -v $PWD:$PWD $MIGRATE_IMAGE   -path $PWD/$SCRIPT_LOCATION -database <myDB-connection-string>" goto $MIGRATE_TO_VERSION;

• use DB_PASSWORD with scope-variable feature for more security.

Introduction

The Jira Issue Validator plugin extends the filtering capabilities of the Devtron CI and lets users perform validation based on Jira Ticket ID status. This plugin ensures that only builds associated with valid Jira tickets are executed, improving the accuracy of the CI process.

Prerequisites

• A Jira account with the necessary API access.

• The API credentials (username, password, and base URL) for your Jira instance. Obtain the API credentials from your Jira admin if required.

• A pull request raised with your Git provider. Title of pull request must contain the Jira ID.

• Jira Issue (e.g., REDOC-12)

• Webhook added to the git repository. Click here to know more.

Steps

1. On the Edit build pipeline page, go to the Pre-Build Stage (or Post-Build Stage).

2. Click + Add task.

3. Select Jira Issue Validator from the list of plugins.

   • Enter a task name (mandatory).

   • Optionally, enter a description.

   • Provide values for the input variables.

   Variable	Format	Description

   • Trigger/Skip Condition allows you to set conditions under which this task will execute or be skipped.

   • Pass/Failure Condition allows you to define conditions that determine whether the build passes or fails based on Jira validation.

4. Go to the Build Stage.

5. Select Pull Request in the Source Type dropdown.

6. Use filters to fetch only the PRs matching your regex. Here are few examples:

   • Title can be a regex pattern (e.g., ^(?P<jira_Id>([a-zA-Z0-9-].*))) to extract the Jira ID from the PR title. Only those PRs fulfilling the regex will be shown for image build process.

   • State can be ^open$, where only PRs in open state will be shown for image build process.

7. Click Update Pipeline.

Results

Case 1: If Jira issue exists and the same is found in the PR title

Case 2: If Jira issue is not found

K6 is an open-source tool and cloud service that makes load testing easy for developers and QA engineers.

Prerequisite: Make sure you have set up an account in k6.io or get the API keys from an admin.

1. On the Edit build pipeline page, select the Pre-Build Stage (or Post-Build Stage).

2. Click + Add task.

3. Select K6 Load Testing from PRESET PLUGINS.

• Enter a relevant name in the Task name field. It is a mandatory field.

• Enter a descriptive message for the task in the Description field. It is an optional field.

• Provide a value for the input variable. Note: The value may be any of the values from the previous build stages, a global variable, or a custom value.

• Trigger/Skip Condition refers to a conditional statement to execute or skip the task. You can select either:

  • Set trigger conditions or

  • Set skip conditions

• Click Update Pipeline.

Introduction

The Devtron Job Trigger plugin enables you to trigger Devtron Jobs from your current application workflow. For example, by integrating this plugin at the pre-deployment stage of your application workflow, you can trigger jobs designed to run migration scripts in your database. This ensures that necessary migrations are executed before your application is deployed.

Prerequisites

Before integrating the Devtron Job Trigger plugin, you need to properly configure the target Devtron Job to ensure smooth execution.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the Build and Deploy from Source Code.

5. Fill the required fields in the Create build pipeline window and navigate to the Create deployment pipeline.

6. Fill the required fields in the Deployment Stage window and navigate to the Pre-Deployment stage.

1. Under 'TASKS', click the + Add task button.

2. Select the Devtron Job Trigger plugin.

3. Enter the following with appropriate values.

User Inputs

Task Name

Enter the name of your task

e.g., Triggers Devtron Job

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., The Devtron Job Trigger plugin is integrated for triggering the Devtron Job.

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

Devtron Job Trigger will not be generating an output variable.

Click Update Pipeline.

Introduction

The Jira Issue Updater plugin extends the capabilities of Devtron CI by allowing updates to Jira issues directly from the pipeline. It can add build pipeline status and docker image ID as a comment on Jira tickets, keeping the issue tracking synchronized with your CI processes.

Prerequisites

• A Jira account with the necessary .

• The API credentials (username, password, and base URL) for your Jira instance. Obtain the API credentials from your Jira admin if required.

• A pull request raised with your Git provider. Title of pull request must contain the Jira ID.

• Jira Issue (e.g., REDOC-12)

• Webhook added to the git repository. to know more.

Steps

1. On the Edit build pipeline page, go to the Post-Build Stage.

2. Click + Add task.

3. Select Jira Issue Updater from the list of plugins.

   • Enter a task name (mandatory).

   • Optionally, enter a description.

   • Provide values for the input variables.

   Variable	Format	Description

   • Trigger/Skip Condition allows you to set conditions under which this task will execute or be skipped.

   • Pass/Failure Condition allows you define conditions to determine if the build passes or fails based on the Jira update.

4. Go to the Build Stage.

5. Select Pull Request in the Source Type dropdown.

6. Use filters to fetch only the PRs matching your regex. Here are few examples:

   • Title can be a regex pattern (e.g., ^(?P<jira_Id>([a-zA-Z0-9-].*))) to extract the Jira ID from the PR title. Only those PRs fulfilling the regex will be shown for image build process.

   • State can be ^open$, where only PRs in open state will be shown for image build process.

7. Click Update Pipeline.

Results

Semgrep is a fast, open source, static analysis engine for finding bugs, detecting dependency vulnerabilities, and enforcing code standards.

Prerequisite: Make sure you have set up an account in Semgrep or get the API keys from an admin.

1. On the Edit build pipeline page, select the Pre-Build Stage (or Post-Build Stage).

2. Click + Add task.

3. Select Semgrep from PRESET PLUGINS.

• Enter a relevant name in the Task name field. It is a mandatory field.

• Enter a descriptive message for the task in the Description field. It is an optional field.

• Provide a value for the input variable. Note: The value may be any of the values from the previous build stages, a global variable, or a custom value.

• Trigger/Skip Condition refers to a conditional statement to execute or skip the task. You can select either:

  • Set trigger conditions or

  • Set skip conditions

• Click Update Pipeline.

Configuring Sonarqube in pre-build or post build task enhances your workflow with Continuous Code Quality & Code Security.

Prerequisite: Make sure you have set up an account in Sonarqube or get the API keys from an admin.

1. On the Edit build pipeline page, select the Pre-Build Stage (or Post-Build Stage).

2. Click + Add task.

3. Select Sonarqube from PRESET PLUGINS.

• Enter a relevant name in the Task name field. It is a mandatory field.

• Enter a descriptive message for the task in the Description field. It is an optional field.

• Provide a value for the input variable. Note: The value may be any of the values from the previous build stages, a global variable, or a custom value.

• Trigger/Skip Condition refers to a conditional statement to execute or skip the task. You can select either:

  • Set trigger conditions or

  • Set skip conditions

• Click Update Pipeline.

Introduction

The Pull images from container repository plugin helps you poll the specified container repository and fetch the container images to deploy them on your target Kubernetes environments using Devtron's CD pipeline. By integrating this plugin you can:

• Poll the designated container repository to get the specific container image build using external CI like Jenkins and Github actions. Once the image becomes available, you can deploy it to your target Kubernetes environment using Devtron's CD pipeline.

Prerequisites

Before integrating the Pull images from the container repository plugin, ensure that you have a specific container image present at your ECR container repository to pull the image and deploy it to the target environment.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the CREATE JOB PIPELINE.

5. Enter the required fields in the Basic configuration window.

6. Under 'TASKS', click the + Add task button.

7. Select the Pull images from container repository plugin.

8. Enter the following with appropriate values.

User Inputs

Task Name

Enter the name of your task.

e.g., Pull container image

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., Pull container image build by external CI

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

Pull images from container repository will not be generating an output variable.

Click Update Pipeline.

Introduction

The Vulnerability Scanning plugin by Devtron enables you to scan and detect vulnerabilities of your applications using Trivy/Clair. The Vulnerability Scanning plugin is recommended to be integrated into the Job Pipeline, especially when you are using external CI pipelines like Jenkins, GitLab, or GitHub Actions. Based on Vulnerability Scanning results, you can enforce security policies to either proceed with or abort the deployment process, giving you more control over your deployment process.

Prerequisites

Before integrating the Vulnerability Scanning plugin, ensure that you have installed the Vulnerability Scanning (Trivy/Clair) integration from Devtron Stack Manager.

Steps

1. Go to Applications → Devtron Apps.

2. Click your application.

3. Go to App Configuration → Workflow Editor.

4. Click New Workflow and navigate to the CREATE JOB PIPELINE.

5. Enter the required fields in the Basic configuration window.

6. Click Task to be executed.

7. Under 'TASKS', click the + Add task button.

8. Click the Vulnerability Scanning plugin.

9. Enter the following with appropriate values.

User Inputs

Task Name

Enter the name of your task

e.g., Vulnerability Scanning for External CI

Description

Add a brief explanation of the task and the reason for choosing the plugin. Include information for someone else to understand the purpose of the task.

e.g., The Vulnerability Scanning plugin is integrated for detecting vulnerabilities in applications.

Input Variables

Trigger/Skip Condition

Here you can set conditions to execute or skip the task. You can select Set trigger conditions for the execution of a task or Set skip conditions to skip the task.

Output Variables

Vulnerability Scanning will not be generating an output variable.

Click Update Pipeline.

Configuring Sonarqube-v1.1.0 in pre-build or post build task enhances your workflow with Continuous Code Quality & Code Security.

Prerequisite: Make sure you have set up an account in Sonarqube or get the API keys from an admin.

1. On the Edit build pipeline page, select the Pre-Build Stage (or Post-Build Stage).

2. Click + Add task.

3. Select Sonarqube v1.1.0 from PRESET PLUGINS.

• Enter a relevant name in the Task name field. It is a mandatory field.

• Enter a descriptive message for the task in the Description field. It is an optional field.

• Provide a value for the input variable. Note: The value may be any of the values from the previous build stages, a global variable, or a custom value.

• Trigger/Skip Condition refers to a conditional statement to execute or skip the task. You can select either:

  • Set trigger conditions or

  • Set skip conditions

• Pass/Fail Condition refers to a conditional statement to pass or fail the Pre-Build Stage (or Post-Build Stage). You can select either:

  • Set pass conditions or

  • Set failure conditions

• Click Update Pipeline.