Package org.jenkinsci.plugins.cortexcloud.scanner

Class ScanOutputParser

java.lang.Object
org.jenkinsci.plugins.cortexcloud.scanner.ScanOutputParser
public final class ScanOutputParser extends Object
Parser for Cortex CLI "image scan --output-format json" output. The CLI (verified against v0.31.0 on a live tenant) emits: <SCAN_INTRO_START>{"imageName":...,"scanners":[...]}<SCAN_INTRO_END> {"asset_name":"alpine:3.2","image_id":"sha256:...","analysis":[ {"type":"Malware","distribution":{...},"findings":[]}, {"type":"Secrets","distribution":{...},"findings":[]}, {"type":"Vulnerability","distribution":{...},"findings":[ {XDM finding}, ... ]} ]} Each finding uses XDM-namespaced keys, with the interesting values nested under xdm.finding.normalized_fields: - xdm.vulnerability.cve_id, .severity, .cvss_score - xdm.vulnerability.status (e.g. "fixed in 1.33.2"), .cve_vendor_link, .fix_date, .publish_date - xdm.software_package.id / .version Note: the distribution counts are unreliable (total was 0 even with 20 findings), so severity counts are derived from the findings themselves. The parser strips the intro block, isolates the main JSON object, and maps findings onto the Vulnerability view model. It falls back gracefully (returns null) when no parseable JSON is present, in which case gating relies on the CLI exit code alone.

  • Field Details

    • DATA_PREFIX

      public static final String DATA_PREFIX
      Legacy data marker used by the twistcli-based plugin (still tolerated).
      See Also:

  • Method Details

    • parse

      public static CortexScanResult parse(String output)
      Parameters:
      output - raw CLI stdout
      Returns:
      a parsed CortexScanResult, or null if none could be extracted