Jenkins

AppArch has no Jenkins plugin and no Jenkins-specific template. On Jenkins you run the collector container with docker run, the same image used on every other CI. The Git connection itself is a normal credential (GitHub, GitLab, Bitbucket or Azure DevOps).

Jenkins credentials

Under Manage Jenkins → Credentials create:

• A Secret text credential APPARCH_TOKEN - the project’s runner token (see Register a project).
• A Username with password credential apparch-hub - username = installation id, password = installation key. This is what pulls the image from hub.apparch.io; the project token is not a registry credential.

The agent needs Docker.

Pipeline

pipeline {
  agent any
  environment {
    APPARCH_TOKEN = credentials('APPARCH_TOKEN')
  }
  stages {
    stage('AppArch') {
      steps {
        withCredentials([usernamePassword(credentialsId: 'apparch-hub', usernameVariable: 'HUB_USER', passwordVariable: 'HUB_KEY')]) {
          sh 'echo "$HUB_KEY" | docker login hub.apparch.io -u "$HUB_USER" --password-stdin'
        }
        sh '''
          PR_ARGS=""
          if [ -n "$CHANGE_ID" ]; then
            PR_ARGS="-e APPARCH_Collector__Provider__Type=gitlab \
                     -e APPARCH_Collector__Provider__ProjectId=group/project \
                     -e APPARCH_Collector__Provider__PullRequestId=$CHANGE_ID"
          fi
          docker run --rm -v "$WORKSPACE:/workspace:ro" \
            -e APPARCH_Collector__Token="$APPARCH_TOKEN" \
            -e APPARCH_Collector__ApiUrl="https://api.yourdomain.com" \
            $PR_ARGS \
            hub.apparch.io/collectors/dotnet:latest /workspace
        '''
      }
    }
  }
}

PR review vs. full scan

Jenkins does not expose a provider’s merge request variables, so the runner cannot detect a PR on its own. You pass the context explicitly:

Variable	Value
APPARCH_Collector__Provider__Type	gitlab, github, bitbucket or azuredevops
APPARCH_Collector__Provider__ProjectId	The repository on the provider, e.g. group/project
APPARCH_Collector__Provider__PullRequestId	The PR / MR number ($CHANGE_ID in a multibranch pipeline)

Optional: APPARCH_Collector__Provider__BaseUrl, __WebUrl, __BaseSha, __StartSha, __HeadSha, __Title, __Author.

• With these variables the run is a PR review (ArchPilot plus an ArchScan record).
• Without them it is a full scan (ArchScan and ArchSecurity).

Failing the build

Append --fail-on <level> after /workspace (critical, error, warning or info), or set APPARCH_FAIL_ON. When a finding at or above that level exists, the collector exits with code 4 after all results are posted, and Jenkins marks the stage failed. When neither is set, the fail-on level configured in the panel for the workspace applies; with none there either, findings never fail the step.

For other CI systems: Add the runner to CI.