Finite State Analysis

finitestate.io

The Finite State Analysis Jenkins Plugin provides multiple post-build actions for integrating with the Finite State platform using the Finite State CLT (Command Line Tool).

This plugin gives you the ability to add Post Build actions and Pipeline steps for:

• Freestyle projects
• Multi-configuration projects
• Pipeline (Declarative and Scripted)

• Finite State Analyze Binary: Upload and analyze binary files
• Finite State Import SBOM: Import SBOM files for analysis
• Finite State Import 3rd Party Scan: Import third-party scan results
• Downloads and manages the Finite State CLT automatically
• Secure credential management for API tokens
• Logs upload URLs for easy access to results

To use this plugin, follow the following steps:

1. Install the plugin in your Jenkins instance.
2. Create or edit your Freestyle project or Multi-configuration project.
3. Click on the Add a Post-build Actions dropdown and select one of the Finite State options:
   • Finite State - Analyze Binary
   • Finite State - Import SBOM
   • Finite State - Import 3rd Party Scan
4. Generate an API Token: You need to generate an API token from your Finite State instance. Navigate to your Finite State domain (e.g., if your domain is fs-yolo.finitestate.io, go to https://fs-yolo.finitestate.io/settings/api-tokens) and generate a new API token. This token will be used to authenticate with the Finite State platform.
5. Complete the fields following the below reference. For sensitive fields like API Token, we use the credentials plugin, so be sure to create the text credential for this field and select the correct one on the dropdown.

Uploads binary files to Finite State for comprehensive analysis.

Imports SBOM (Software Bill of Materials) files to Finite State for analysis.

Imports third-party scan results to Finite State for analysis.

1. Add any of the Finite State post-build actions to your Jenkins job
2. Configure the required fields for your chosen action
3. Run the build

The plugin will:

1. Download the CLT if it doesn't exist
2. Execute the appropriate action (upload, import SBOM, or import scan)
3. Log the results in the build output
4. Mark the build as successful if the operation completes

You can use these steps directly in Pipelines. The step names are the Jenkins symbols shown below.

• finiteStateAnalyzeBinary
• finiteStateImportSbom
• finiteStateImportThirdParty

• Analyze Binary

pipeline {
  agent any
  stages {
    stage('Finite State Binary Analysis') {
      steps {
        finiteStateAnalyzeBinary(
          subdomain: 'fs-your-subdomain.finitestate.io',
          apiTokenCredentialsId: 'your-jenkins-string-credentials-id',
          binaryFilePath: 'build/firmware.bin',
          projectName: 'My Project',
          projectVersion: '1.2.3',
          scaEnabled: true,
          sastEnabled: false,
          configEnabled: false,
          externalizableId: false,
          preRelease: false
        )
      }
    }
  }
}

• Import SBOM

pipeline {
  agent any
  stages {
    stage('Finite State Import SBOM') {
      steps {
        finiteStateImportSbom(
          subdomain: 'fs-your-subdomain.finitestate.io',
          apiTokenCredentialsId: 'your-jenkins-string-credentials-id',
          sbomFilePath: 'sbom/cyclonedx.json',
          projectName: 'My Project',
          projectVersion: '1.2.3',
          externalizableId: false,
          preRelease: false
        )
      }
    }
  }
}

• Import 3rd Party Scan

pipeline {
  agent any
  stages {
    stage('Finite State Import 3rd Party Scan') {
      steps {
        finiteStateImportThirdParty(
          subdomain: 'fs-your-subdomain.finitestate.io',
          apiTokenCredentialsId: 'your-jenkins-string-credentials-id',
          scanFilePath: 'reports/sonarqube.json',
          scanType: 'sonarqube_scan',
          projectName: 'My Project',
          projectVersion: '1.2.3',
          externalizableId: false,
          preRelease: false
        )
      }
    }
  }
}

Notes:

• Use apiTokenCredentialsId (the ID of a Secret Text credential containing your Finite State API token).

• If you set externalizableId: true, the step will use the Jenkins Run Externalizable ID as the project version.

• For the scanType field in the finiteStateImportThirdParty step, you must select one of the supported scan types from the list in section Third-Party scanType values (exact identifiers) below. The value you provide should match exactly one of the identifiers in the "Third-Party scanType values" table. This ensures your scan is properly recognized and processed by the Finite State platform.

• These options are presented in the UI as three checkboxes: Binary SCA, Binary SAST, and Configuration Analysis.

• At runtime, the plugin builds the CLI flag --upload by concatenating the enabled scan types as a comma-separated list (e.g., --upload=sca,sast).

• If none are selected, SCA is enforced by default.

• SCA: Binary Software Composition Analysis (default)

• SAST: Binary Static Application Security Testing

• Configuration Analysis: Configuration and security analysis

The plugin supports a comprehensive list of third-party scanning tools including:

Popular Tools:

• GitLab SAST/DAST/Container Scan: GitLab's built-in security scanning
• SonarQube: Code quality and security analysis
• Snyk: Vulnerability scanning for dependencies and containers
• Trivy: Container and infrastructure vulnerability scanner
• Semgrep: Static analysis for security and bugs
• Bandit: Python security linter
• Gosec: Go security linter
• ESLint: JavaScript/TypeScript linting with security rules

Cloud Security:

• AWS Prowler: AWS security assessment
• AWS Security Hub: AWS security findings
• Azure Security Center: Azure security recommendations
• Checkov: Infrastructure as Code security scanning

Container Security:

• Clair: Container vulnerability scanning
• Anchore: Container image analysis
• Twistlock: Container security platform

Dependency Scanning:

• Dependency Check: OWASP dependency vulnerability scanner
• Retire.js: JavaScript library vulnerability scanner
• NPM Audit: Node.js package vulnerability scanning
• Yarn Audit: Yarn package vulnerability scanning

And many more... including Acunetix, Burp Suite, Checkmarx, Fortify, Qualys, Tenable, Veracode, ZAP, and over 100 other supported tools.

For the complete list of supported tools and their expected file formats, refer to the dropdown in the Jenkins configuration.

Use these values for the scanType field in Pipelines (e.g., scanType: 'sonarqube_scan'). The left column is the UI label; the right column is the exact scanType identifier accepted by the step.

• Jenkins 2.479.3 or later
• Java 8 or later (for running the CLT)
• Internet access to download the CLT from your Finite State instance

• API tokens are stored securely using Jenkins credentials
• The CLT is downloaded over HTTPS with authentication
• No sensitive data is logged in the build output

Report issues and enhancements in the Github issue tracker.

Refer to our contribution guidelines

Licensed under MIT, see LICENSE

Please follow the steps described in the Developer Guide