How to Use checkmarxASTScanner in Jenkins Shared Library (Groovy Script)

[prasanthteam]

Hi Team,

I'm working on integrating the Checkmarx AST Scanner into our Jenkins pipeline using a shared library written in Groovy.

Currently, I am able to invoke the checkmarxASTScanner step directly inside a Jenkinsfile, and it works as expected.

Working example inside Jenkinsfile:

Issue:

When trying to use the checkmarxASTScanner step inside a shared library Groovy method (for example under vars/ or src/), I am unable to import or invoke it properly.

Example that does not work:

The above fails to execute, and I understand it may be because checkmarxASTScanner is a Jenkins pipeline step that needs a Script context.

What I'm Trying to Achieve:

I would like to wrap the checkmarxASTScanner invocation in a reusable shared library method, so I can call it with custom parameters across multiple pipelines, like this:

checkmarxHelper.runScan(this, scanParams)

Questions:

What is the recommended way to invoke checkmarxASTScanner from a shared library?

Is there an API or wrapper class exposed by com.checkmarx.jenkins.CheckmarxScanBuilder that can be used programmatically within a shared library?

Can you provide a working example or best practice for this use case?

Thanks in advance for your help!

[chamacs]

@prasanthteam Not sure if you figured this out already, so posting just in case.

The simple approach is to use a global var in the shared lib. My working example is as follows.

In shared library - vars/checkmarxScan.groovy

#!groovy

def call(Map config = [:]) {
    checkmarxASTScanner(
        // Override global configs
        useOwnServerCredentials: true,
        serverUrl: config.serverUrl,
        tenantName: config.tenantName,
        checkmarxInstallation: config.checkmarxInstallation,
        credentialsId: config.credentialsId,

        // Project configs
        projectName: config.projectName,
        branchName: config.branchName,

        // Cx CLI configurations
        useOwnAdditionalOptions: true,
        additionalOptions: config.additionalOptions
    )
}

My declarative pipeline using the shared library (with placeholder values instead of my specific configurations):

#!groovy
@Library('jenkins-shared-lib-sandbox') _

pipeline {
    agent any

    stages {
        stage('Checkout Source') {
            steps {
                // checkout step here
            }
        }

        stage('CxOne SAST Scan') {
            steps {
                // Custom Shared Library Usage
                checkmarxScan(
                    serverUrl: 'CXONE_SERVER_URL',
                    tenantName: 'CXONE_TENANT_NAME',
                    checkmarxInstallation: 'CXONE_CLI_INSTALLATION',
                    credentialsId: 'CXONE_CREDS_ID',
                    projectName: 'CXONE_PROJECT_NAME',
                    branchName: 'CXONE_BRANCH_NAME',
                    additionalOptions: '--scan-types sast --debug'
                )
            }
        }
    }
}

The Jenkins shared lib for 'jenkins-shared-lib-sandbox' is defined on the folder this pipeline is in.