Vulkro on Jenkins

This pipeline scans the repository, publishes SARIF and JUnit reports, and fails on Critical or High findings (or, for a pull request, on new findings only).

Jenkinsfile

pipeline {
    agent any
    environment {
        // CI key from the portal, stored as a "Secret text" credential
        VULKRO_ACCOUNT_TOKEN = credentials('vulkro-ci-key')
        VULKRO_BIN_DIR = "${WORKSPACE}/.vulkro-bin"
    }
    stages {
        stage('Install') {
            steps {
                sh 'curl -fsSL https://dist.vulkro.com/install.sh | bash'
            }
        }
        stage('Scan') {
            steps {
                sh '''
                    export PATH="$VULKRO_BIN_DIR:$PATH"
                    vulkro scan ci . --format sarif > vulkro.sarif || true
                    vulkro scan ci . --format junit > vulkro.junit.xml || true
                '''
            }
            post {
                always {
                    archiveArtifacts artifacts: 'vulkro.sarif, vulkro.junit.xml', allowEmptyArchive: true
                    junit allowEmptyResults: true, testResults: 'vulkro.junit.xml'
                }
            }
        }
        stage('Gate') {
            steps {
                script {
                    if (env.CHANGE_TARGET) {
                        sh '''
                            git fetch origin "+refs/heads/${CHANGE_TARGET}:refs/remotes/origin/${CHANGE_TARGET}"
                            export PATH="$VULKRO_BIN_DIR:$PATH"
                            vulkro gate --base "origin/${CHANGE_TARGET}"
                        '''
                    } else {
                        sh 'export PATH="$VULKRO_BIN_DIR:$PATH"; vulkro scan ci .'
                    }
                }
            }
        }
    }
}

Set the secret

Create a CI key in the customer portal (app.vulkro.com, Settings) and store it as a Jenkins "Secret text" credential with the id vulkro-ci-key. The pipeline exposes it as VULKRO_ACCOUNT_TOKEN and the scan signs in with it, so no vulkro login step is needed. A CI key works during the 14-day trial and on paid plans, and uses no device seat. See CI keys.

What fails the build

The Scan stage only writes reports. The Gate stage fails the build:

• On a pull request (multibranch, where CHANGE_TARGET is set), vulkro gate exits 1 only on findings that are new compared with the target branch.
• Otherwise, the ci preset exits 1 on Critical or High findings (or the [quality_gate] thresholds in vulkro.toml, when you set them).

Exit code	Meaning
0	No findings at the gate level
1	Findings at the gate level, or no licence (license_required on stderr)
2	Error: bad arguments, git or IO failure

Air-gapped agents

An agent with no route out uses a licence file instead of a CI key. Store the base64 of your .lic file (base64 -w0 your.lic) as a "Secret text" credential, expose it as VULKRO_LICENSE_B64 instead of VULKRO_ACCOUNT_TOKEN, set VULKRO_OFFLINE = '1', and install from your internal mirror. See Offline mode.