Skip to content

Run CodeCheck in your CI pipeline (Jenkins)

SciTools runs Understand + CodeCheck in its own CI on every commit; here's the pattern.

Prerequisites

  • Understand (or the CLI kit) installed on the build agent, and licensed for the agent (env var or und -setlicensecode).
  • A saved CodeCheck configuration (create it once in the GUI — see run from the command line) that ships with the project's .und.

Jenkins Freestyle: Execute Shell

After configuring the job's SCM/triggers, add an Execute Shell (or Windows batch) step:

#!/bin/bash -x
UND=/path/to/scitools/bin/linux64/und
PROJ=/path/to/project.und
GITREV=$(git rev-parse HEAD)

# 1. Update analysis for the changed files
"$UND" -db "$PROJ" analyze -changed

# 2. Run the saved config on this commit's files; fail the step on violations
"$UND" -db "$PROJ" codecheck -exitstatus -gitfiles "$GITREV" \
       -sarif "$WORKSPACE/codecheck_output/results.sarif" \
       "MyConfig" "$WORKSPACE/codecheck_output"
  • -gitfiles $GITREV scopes the check to the commit's files (fast, incremental).
  • -exitstatus makes the step's exit code the violation count → non-zero fails the build. (Exit codes truncate to one byte — exactly 256 violations exits 0 — so for a strict gate also check the report output; see gate a build.)
  • -sarif writes results your CI can archive or a plugin can display.

Full switch reference: und codecheck.

Prefer a plugin over a shell step?

The Understand Jenkins plugin wraps these steps and reports violations through Warnings Next Generation instead of a raw shell script.

Fail the run on undocumented deviations

If suppressions carry deviation records, the pipeline can insist every deviation is documented:

"$UND" -db "$PROJ" codecheck -exitstatus errors "MyConfig" "$WORKSPACE/codecheck_output"

A suppression that names a template but leaves required fields unanswered is an analysis error, named in the log (Incomplete ignore record: template "MISRA Deviation" requires Justification), and -exitstatus errors returns the analysis error count — so one undocumented deviation is a non-zero exit. Freeform suppressions and templates without required fields never count, so the check enforces exactly the policy the project's own templates declare. The full workflow is Turn suppressions into deviation records.

Gate only on new violations

To avoid failing on pre-existing issues in legacy code, either scope with -gitfiles/-changedfiles or compare against a baseline inspection with -previous <old.sarif> (emits New_/Fixed_ reports). See baseline violations.

Beyond the CodeCheck step