Vulkro on Jenkins

Vulkro runs on Jenkins as a couple of sh steps: install the CLI on the agent, run vulkro scan ci, publish the SARIF and JUnit reports, and gate pull requests against a base ref. The snippets below are self-contained, so you can paste them straight into a Jenkinsfile.

Drop into a Jenkinsfile

pipeline {
    agent any
    // CI key from the portal, stored as a Jenkins "Secret text" credential
    environment { VULKRO_ACCOUNT_TOKEN = credentials('vulkro-ci-key') }
    stages {
        stage('Sign in') {
            steps {
                sh '''
                    curl -fsSL https://dist.vulkro.com/install.sh | bash
                    vulkro login
                '''
            }
        }
        stage('Scan') {
            environment { VULKRO_OFFLINE = '1' }
            steps {
                sh '''
                    vulkro scan ci . --format sarif --output vulkro.sarif
                    vulkro scan ci . --format junit --output vulkro.junit.xml
                '''
            }
            post {
                always {
                    archiveArtifacts artifacts: 'vulkro.sarif, vulkro.junit.xml',
                                     allowEmptyArchive: true
                    junit allowEmptyResults: true, testResults: 'vulkro.junit.xml'
                }
            }
        }
        stage('Gate') {
            when { changeRequest() }
            environment { VULKRO_OFFLINE = '1' }
            steps {
                sh 'vulkro gate --base "origin/${CHANGE_TARGET}"'
            }
        }
    }
}

vulkro scan ci runs the scan in CI mode and writes the requested format to the path you pass with --output. Run it once per format you want to publish (SARIF for code scanning, JUnit for the test-results view).

vulkro gate scans the working tree and the base ref and exits non-zero only on findings that are new relative to the base, so pre-existing debt never fails a pull request. See vulkro gate for the full flag list.

Licence the agent

Every machine that scans needs an active trial or Pro, Jenkins agents included. Create a CI key in the customer portal (app.vulkro.com) and store it as a "Secret text" credential (vulkro-ci-key above); the pipeline exposes it as VULKRO_ACCOUNT_TOKEN and vulkro login exchanges it for a lease. A CI key works for the 14-day trial and for paid plans, uses no device seat, and can be revoked. Without it, the scan stage fails with exit code 1 and license_required. An air-gapped agent uses VULKRO_LICENSE_B64 (the base64 of a .lic licence file, also a "Secret text" credential) instead, with no vulkro login step. See Accounts and licensing.

Offline by default

The Scan and Gate stages set VULKRO_OFFLINE=1 in their environment {} blocks so the scanner never reaches the network from the agent, matching the offline-first project posture. The Sign in stage is the only one that goes online. If a particular pipeline needs live CVE-feed updates inside the scan, remove the env var.

Exit codes

Code	Meaning
0	Clean: no findings or gate cleared.
1	Findings or gate failure, or no licence (license_required). Mark the build FAILURE.
2	Internal error. Mark the build FAILURE.