Jenkins-hosted release: 18.v7f17b_86cf4b_8. Official source: jenkinsci/awarely-scan-plugin.
Install the plugin and review release formats. Pins: CLI v0.12.0 and managed Syft 1.54.1.
Generate an SBOM during a build, check it with Awarely Monitor, and explicitly synchronize one inventory source when appropriate. The plugin uses the same CLI and managed Syft as the terminal workflow. It does not build your application or install its dependencies.
English walkthrough · Ghid în română · Security boundaries
This is the dedicated plugin repository. The Awarely CLI has its own source and release cycle. Jenkins project hosting and release permissions are approved. The first official release has been published to the Jenkins artifact repository; Update Center and plugin-site indexing can follow later. See hosting readiness.
Download the preserved historical 0.2.0 release from this repository's releases. The historical 0.1.0-alpha.1 preview and its original signatures remain in the scanner repository; see release verification.
| Collector | Input in the build workspace | Collection |
|---|---|---|
npm |
Directory with an npm lockfile | Native manifest collection |
npm-syft |
Built/installed Node.js directory | Managed Syft |
python |
Directory with requirements.txt | Native, partial inventory |
python-syft |
Directory containing an installed virtual environment | Managed Syft |
java |
Built Java artifacts and their dependencies | Managed Syft |
other |
NuGet, Go, Composer, RubyGems or Cargo application files | Managed Syft; NuGet/Go CVE checks supported; other ecosystems unevaluated |
linux |
The Linux Jenkins agent | Focused packages, or all installed packages |
import |
An external CycloneDX application SBOM | Validated application-package import |
existing |
A previously generated Awarely inventory | Reuse without rescanning |
Actions are local (default), check and sync. Linux collection inventories the agent, not a container image or production server. See the CLI coverage contract.
- Run
preflightOnly: truein a staging job to check the agent, paths, approvals and credential format without scanning or contacting Monitor. Turn it off for the real scan; it does not disable other job steps. - Choose
policyResult: 'FAILURE'to stop the step when severity/incomplete policy trips, or retain the compatibleUNSTABLEdefault. Reports are preserved. - Open Awarely Scan → Changes since the previous build for component and observed CVE-match differences. Incompatible or incomplete evidence is explained, never presented as confirmed remediation.
The walkthrough includes copyable Pipeline examples and field-by-field guidance. Help is also available next to fields in Freestyle and the Pipeline Snippet Generator. Pipeline is supported through Jenkins' SimpleBuildStep bridge; an active scan is nonresumable across a controller restart. See the walkthrough for restart recovery and the separate controller/agent network requirements.
Use JDK 21 and Maven with the Jenkins baseline declared in pom.xml:
mvn -B -ntp verify
The output is target/awarely-scan.hpi. Development tool manifests deliberately fail closed until release archive and executable digests have been authenticated. Do not replace pins with arbitrary downloads or bypass verification.
Jenkins-hosted releases use the Jenkins Incrementals/CD version scheme. A local development build is a snapshot, not a replacement for the published release. See contributing and release verification.