@@ -63,19 +63,11 @@ pipeline {
6363 options { timestamps() }
6464 environment {
6565 COMMIT_SHA_LONG = sh(returnStdout : true , script : " echo \$ (git rev-parse " + " HEAD)" ). trim()
66- SEMGREP_DEPLOYMENT_ID = 1
67- INPUT_PUBLISHURL = " https://semgrep.snowflake.com"
6866
6967 // environment variables for semgrep_agent (for findings / analytics page)
7068 // remove .git at the end
71- SEMGREP_REPO_URL = env. GIT_URL . replaceFirst(/ ^(.*).git$/ ,' $1' )
72- SEMGREP_BRANCH = " ${ CHANGE_BRANCH} "
73- SEMGREP_JOB_URL = " ${ BUILD_URL} "
7469 // remove SCM URL + .git at the end
75- SEMGREP_REPO_NAME = env. GIT_URL . replaceFirst(/ ^https:\/\/ github.com\/ (.*).git$/ , ' $1' )
7670
77- SEMGREP_COMMIT = " ${ GIT_COMMIT} "
78- SEMGREP_PR_ID = " ${ env.CHANGE_ID} "
7971 BASELINE_BRANCH = " ${ env.CHANGE_TARGET} "
8072 }
8173 stages {
@@ -84,38 +76,6 @@ pipeline {
8476 checkout scm
8577 }
8678 }
87- stage(' Semgrep_agent' ) {
88- agent {
89- docker {
90- label ' parallelizable-c7'
91- image ' nexus.int.snowflakecomputing.com:8087/returntocorp/semgrep-agent:v1'
92- args ' -u root'
93- }
94- }
95- when {
96- expression { env. CHANGE_ID && env. BRANCH_NAME . startsWith(" PR-" ) }
97- }
98- steps{
99- wrap([$class : ' MaskPasswordsBuildWrapper' ]) {
100- withCredentials([
101- [$class : ' UsernamePasswordMultiBinding' , credentialsId :
102- ' b4f59663-ae0a-4384-9fdc-c7f2fe1c4fca' , usernameVariable :
103- ' GIT_USERNAME' , passwordVariable : ' GIT_PASSWORD' ],
104- string(credentialsId :' SEMGREP_APP_TOKEN' , variable : ' SEMGREP_APP_TOKEN' ),
105-
106- ]) {
107- script {
108- try {
109- sh
' export SEMGREP_DIR=semgrep-scan-$(pwd | rev | cut -d \' /\' -f1 | rev) && mkdir -p ../$SEMGREP_DIR && cp -R . ../$SEMGREP_DIR && cd ../$SEMGREP_DIR && git fetch https://$GIT_USERNAME:[email protected] /$SEMGREP_REPO_NAME.git $BASELINE_BRANCH:refs/remotes/origin/$BASELINE_BRANCH && python -m semgrep_agent --baseline-ref $(git merge-base origin/$BASELINE_BRANCH HEAD) --publish-token $SEMGREP_APP_TOKEN --publish-deployment $SEMGREP_DEPLOYMENT_ID && cd ../ && rm -r $SEMGREP_DIR' 110- wgetUpdateGithub(' success' , ' semgrep' , " ${ BUILD_URL} " , ' 123' )
111- } catch (err) {
112- wgetUpdateGithub(' failure' , ' semgrep' , " ${ BUILD_URL} " , ' 123' )
113- }
114- }
115- }
116- }
117- }
118- }
11979 }
12080}
12181
0 commit comments