Integrating Fortify Security Scans in Spinnaker Pipelines
summary
Spinnaker calls Jenkins to run Fortify scans and then a custom webhook stage makes an API call to Fortify Software Security Center to fetch JSON results; no plugin or new code is added, only changes to the Orca config. The pipeline parses integer counts for high and critical findings using a SpEL expression and fails the deployment if any high or critical count is greater than zero. This replaces manual checks, automates enforcement of the zero-threshold policy, and works end-to-end.
AI-written summary · about
chapters (11)
- 0:00Introduction and background
- 1:48Problem with Jenkins and Fortify integration
- 3:33Need for end-to-end pipeline automation
- 4:15Custom stages in Spinnaker
- 5:21New automated pipeline flow
- 6:45Benefits of custom webhook stage
- 9:18Implementation of Fortify scan stage
- 12:23Validation and deployment stages
- 13:48Extensibility and future possibilities
- 14:52Alternative integration approaches
- 15:13Q&A and closing remarks
related talks
08mAutomated & Immutable Spinnaker Deployments with Security...
26mAutomate Vulnerability Detection in DevOps with Spinnaker
50mSpinnaker get control over your deployements
23mBuild a Spinnaker pipeline in highly regulated bank environment
43mBuilding a Secure DevOps Pipeline
29mHardening Spinnaker Pipelines
43mAll Aboard: Transforming Software Delivery Using Spinnaker
24mUsing Jenkins and Spinnaker to Supercharge Your Deployment Pipelines