Jenkins

Integrate netbobr firewall rule analysis into Jenkins pipelines. Jenkins imports SARIF through the Warnings Next Generation plugin. A scripted block can tell netbobr's policy failures (exit 2) apart from tool errors (exit 1).

Declarative Pipeline

A minimal Jenkinsfile stage that fails on high or critical findings:

pipeline {
    agent any
    tools {
        nodejs 'Node-20'
    }
    stages {
        stage('Firewall Analysis') {
            steps {
                sh 'npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on high'
            }
        }
    }
}

Jenkins fails the stage when the shell command returns a non-zero exit code. With --fail-on high, medium findings pass. The build fails on high or critical findings and DENY verdicts (exit 2), and on errors such as a missing file, an invalid config or an invalid flow (exit 1).

With SARIF Report

Import findings into Jenkins using the Warnings Next Generation plugin, and still fail the build correctly:

pipeline {
    agent any
    tools {
        nodejs 'Node-20'
    }
    stages {
        stage('Firewall Analysis') {
            steps {
                script {
                    def rc = sh(
                        script: 'npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on high --output sarif --output-file results.sarif',
                        returnStatus: true
                    )
                    if (fileExists('results.sarif')) {
                        recordIssues tool: sarif(pattern: 'results.sarif')
                    }
                    if (rc == 2) {
                        error "netbobr: findings at or above HIGH, or DENY verdicts (exit code 2)"
                    } else if (rc != 0) {
                        error "netbobr did not complete (exit code ${rc}): see the console log"
                    }
                }
            }
        }
    }
}

• returnStatus: true captures the exit code, so the SARIF report is recorded before the build result is decided. Do not use || true: it also hides tool errors.
• The Warnings Next Generation Plugin imports the SARIF report and displays findings in the build results.

With PDF Artifact

Generate a PDF compliance report and archive it as a build artifact:

pipeline {
    agent any
    tools {
        nodejs 'Node-20'
    }
    stages {
        stage('Firewall Analysis') {
            steps {
                sh 'npx --yes @netbobr/cli@2 analyze rules.json --fail-on none --output pdf --output-file report.pdf'
                archiveArtifacts artifacts: 'report.pdf'
            }
        }
    }
}

--fail-on none makes this a report-only step: it never fails on findings, but still fails on errors (exit 1). The PDF report is downloadable from the build page under Build Artifacts.

Custom Exit Code Handling

Use a scripted block to mark policy failures as UNSTABLE while errors still fail the build:

pipeline {
    agent any
    tools {
        nodejs 'Node-20'
    }
    stages {
        stage('Firewall Analysis') {
            steps {
                script {
                    def rc = sh(
                        script: 'npx --yes @netbobr/cli@2 analyze rules.json --fail-on medium --quiet',
                        returnStatus: true
                    )
                    if (rc == 2) {
                        unstable "netbobr: findings at or above MEDIUM, or DENY verdicts (exit code 2)"
                    } else if (rc != 0) {
                        error "netbobr did not complete (exit code ${rc}): see the console log"
                    }
                }
            }
        }
    }
}

The build outcome follows the exit code:

--quiet keeps the console short. Errors, including invalid flows, are still printed.

For two thresholds, run netbobr twice: --fail-on high with error on any non-zero code, then --fail-on medium with the UNSTABLE handling above.

With Configuration

Load zones and zone policies, custom rules, zone attributes and disabled rules from a session saved in the web app. A flow between zones whose policy is Deny, or one matched by a custom rule with a DENY override, fails the gate at any --fail-on level except none.

To override the default risk score weights or thresholds, add flat weights and thresholds keys to the config file (see Thresholds). A session's old riskWeights block is ignored with a warning.

sh 'npx --yes @netbobr/cli@2 analyze rules.json --config netbobr-config.json --fail-on medium'

Cloud exports and Terraform source are analyzed with --cloud-format aws-sg, azure-nsg, gcp-fw, tf-plan, tf-hcl, k8s-netpol or auto.

Exit Code Reference

--fail-on takes info, low, medium (the default), high, critical or none. none is report-only: it never exits 2, and errors still exit 1.