Jenkins

1. Add the credential

Create a secret key in Safeguard under Settings → Developer with the scopes scans:trigger and scans:read. In Jenkins, add it under Manage Jenkins → Credentials as a Secret text credential with the ID safeguard-api-key.

The agent needs Linux or macOS with curl. The repository, branch and commit come from the Git plugin's GIT_URL, GIT_COMMIT and BRANCH_NAME (or GIT_BRANCH).

2. Add the stage

Add this stage to your Jenkinsfile (download a full pipeline):

stage('Safeguard scan') {
    when {
        anyOf {
            branch pattern: '^(main)$', comparator: 'REGEXP'
            changeRequest target: '^(main)$', comparator: 'REGEXP'
        }
    }
    steps {
        withCredentials([string(credentialsId: 'safeguard-api-key', variable: 'SAFEGUARD_API_KEY')]) {
            sh '''
                set -eu
                export SAFEGUARD_INSTALL_DIR="$WORKSPACE/.safeguard-bin"
                curl -fsSL https://cli.safeguard.sh/install | bash
                "$SAFEGUARD_INSTALL_DIR/safeguard" ci scan --wait --fail-on critical
            '''
        }
    }
}

Choose the branches

The when block needs a multibranch pipeline, where Jenkins knows the branch.

• branch pattern is a regular expression for the branches whose builds are scanned, for example '^(main|release/.*)$'.
• changeRequest target scans pull requests into matching branches. Remove that line (and anyOf) to scan branch builds only.

In a single-branch (freestyle or plain pipeline) job, delete the when block: every build is scanned, and the branch comes from GIT_BRANCH.

Options

Troubleshooting

• The stage is always skipped. The job is not a multibranch pipeline, so branch and changeRequest never match. Delete the when block.
• curl: command not found. Use an agent with curl; Windows agents are not supported.
• Other errors: see Troubleshooting.