Run the Safeguard CLI in a Jenkins pipeline and archive the JSON

In a declarative Jenkins pipeline, add a stage that installs the Safeguard CLI, runs safeguard detect with JSON output to a file, and archives that file with archiveArtifacts. Put the archive step in an always post block so the result is kept even when a later stage fails.

The Jenkinsfile

Safeguard's documentation shows a declarative pipeline with a single stage that installs the CLI, runs detect writing JSON, and archives the result. Here is that shape, with version pinning:

pipeline {
  agent any
  environment {
    SAFEGUARD_VERSION = '<version from the download page>'
  }
  stages {
    stage('Safeguard detect') {
      steps {
        sh 'curl -fsSL https://cli.safeguard.sh/install | bash'
        sh 'safeguard detect --path . --format json --output safeguard-detect.json'
      }
    }
  }
  post {
    always {
      archiveArtifacts artifacts: 'safeguard-detect.json', fingerprint: true
    }
  }
}

The installer needs to place the binary somewhere on the PATH of the agent. The documentation names an install directory variable for that. Check where it lands on your agent type, because agent images differ.

Why the post block

Jenkins documents that post conditions such as always run whatever the build result, and its own tour places archiveArtifacts and junit steps there. Without it, a failing test stage would skip the archive and you would lose the scan you came for. The fingerprint option records a fingerprint of archived files so you can trace where a file came from.

Which command to choose

Detect finds secrets and misconfigurations and can write table, JSON or SARIF. Scan builds an SBOM and matches it against vulnerability data. For dependency findings in Jenkins, use scan, and note that it needs syft and grype on the agent. See what the scanners need on a fresh runner.

Credentials and quoting

If you ever pass a token to a step, use the credentials helper in the environment block and single quoted sh strings. Jenkins warns that double quotes make Groovy insert the secret into the command, where it can show up in process listings. Masking in the console is only a courtesy and does not make untrusted jobs safe.

Reading the file afterwards

An archived JSON file is only useful if someone reads it. Add a later stage that parses the file with a small script and prints a count by severity into the build log, so a reviewer sees the headline without downloading anything. Keep that script in the repository and review it like code, because a bug there hides findings.

If you run many agents, check that the archive step runs on the agent that created the file. Archiving works from the workspace of the current node.

Quick check

Where Safeguard fits

Enforcement lives in platform policy gates, not in the CLI. Treat the archived file as evidence and a gate as the decision.

Sources

• Safeguard docs: CI/CD Integration
• Safeguard docs: CLI
• Jenkins: Recording tests and artifacts
• Jenkins: Using a Jenkinsfile

Last reviewed: 19 October 2026.