Scanning & Quality Gate Reference

This reference documents the current scanning controls in JSL and how they are typically used during migration.

jenkins.yaml Controls

Core flags used by JSL:

  • enableOisScan

  • enableSonar

  • enableQualityGate

  • sonarMainBranchOnly

  • sonarReportUrl

  • sonarReportBranch

  • enableFlexline

  • ignoreFlexlineFailure (typically environment override)

  • branchesOisScanRegex

Related defaults can be seen in:

  • jsl/resources/jenkins-service-default.yaml

  • jsl/resources/jenkins-web-default.yaml

Runtime Parameters Exposed by JSL

When enabled by config, JSL exposes runtime parameters such as:

  • OIS_SCAN

  • RUN_OIS_SCAN_ONLY

  • RUN_SONAR_ONLY

  • FLEXLINE

  • IGNORE_FLEXLINE_FAILURE

Parameter generation lives in:

  • jsl/vars/getParameters.groovy

Sonar + Quality Gate Behavior

Sonar is run when enabled in config (or when explicitly run as RUN_SONAR_ONLY), and quality gate waiting is controlled separately:

  • Sonar execution: sonarScan.call(…​)

  • Quality gate wait: waitForQualityGate abortPipeline: true

  • Optional branch scoping: sonarMainBranchOnly

Implementation:

  • jsl/vars/buildServiceProject.groovy

  • jsl/vars/sonarScan.groovy

Important constraint:

  • If Sonar is enabled (or RUN_SONAR_ONLY is requested) and sonarReportUrl is missing, JSL fails fast.

Flexline Behavior

Flexline execution timing depends on release/non-release and image tool:

  • Release + skaffold: scan before push

  • Release + non-skaffold: scan after push

  • Non-release: scan after build

Failure behavior:

  • Can be ignored only in sandbox/non-release when IGNORE_FLEXLINE_FAILURE=true

  • Otherwise Flexline failures fail the build

Implementation:

  • jsl/vars/buildServiceProject.groovy

  • jsl/vars/runFlexlineScan.groovy

OIS Behavior

OIS is controlled by:

  • enableOisScan (config default/visibility)

  • OIS_SCAN and RUN_OIS_SCAN_ONLY (runtime control)

JSL uses these values to decide whether the main build flow should run or scan-only paths should run.

Implementation touchpoints:

  • jsl/vars/getParameters.groovy

  • jsl/vars/buildServiceProject.groovy

Migration Checklist

  1. Decide required scanners per project (enableSonar, enableOisScan, enableFlexline).

  2. Configure required Sonar values (sonarReportUrl, branch behavior).

  3. Define blocking vs non-blocking behavior by environment and branch.

  4. Validate scan-only parameters work as expected before broad rollout.

  5. Document the chosen policy in the service repo to avoid ad-hoc overrides.

Known Gap to Track

  • Current Sonar implementation is Maven-centric (mvn …​ sonar), so non-Maven/JavaScript projects may require custom Sonar integration or JSL enhancements.