Skip to main content
Ensuring that every software package in your CI/CD pipeline is free from vulnerabilities and compliant with licensing terms is a cornerstone of a robust DevOps security strategy. In this guide, we’ll cover two complementary approaches and highlight leading tools to help you secure your software supply chain.

​
Two Complementary Strategies

  1. Centralized Artifact Repository Scanning
    All build artifacts are published to a single repository (e.g., Artifactory or Nexus), where they automatically undergo security and license compliance checks before release.
  2. Build-Phase Tooling Integration
    Security and license scans are embedded into each build job, enforcing compliance gates at build time and preventing non-compliant artifacts from ever reaching the repository.
Combining both repository-based scans and build-phase tooling ensures maximum coverage and early detection of issues.
StrategyDescriptionBenefits
Centralized Artifact Repository ScanArtifacts are scanned post-build in a central registry.Consistent policy enforcement, audit trails
Build-Phase Tooling IntegrationScans occur during the build process (CI job).Immediate feedback, prevents bad artifacts
The image outlines two strategies for evaluating tools for package security and license compliance: implementing scanning within a centralized artifact repository and integrating tooling within the build phase of the pipeline.

​
Key Tooling Solutions

Below is an overview of popular tools aligned to these strategies, each playing a distinct role in a comprehensive DevOps security workflow:
The image is a table listing tools for package security and license compliance, with "Artifactory," "SonarQube," and "Mend Bolt" categorized as "Artifact Repository," "Code Quality Assessment," and "Build Process Scanning," respectively.
ToolCategoryPrimary Function
ArtifactoryArtifact RepositoryStores binaries and dependencies; integrates with scanners
SonarQubeStatic Code AnalysisDetects code smells, security vulnerabilities, and standards
Mend BoltBuild Process ScanningEnforces open-source vulnerability and license policies

​
Artifactory

A universal repository manager that securely stores build artifacts, metadata, and container images. Integrates with security and license scanners to validate every component before release.
Learn more ›

​
SonarQube

Performs deep static analysis on your source code to catch security issues, code smells, and maintain code quality standards ahead of the packaging stage.
Learn more ›

​
Mend Bolt

(formerly WhiteSource Bolt) A lightweight scanner that plugs into CI pipelines—GitHub Actions, Azure DevOps, Jenkins—to automatically detect open-source vulnerabilities and licensing risks with each build.
Learn more › Each of these solutions helps enforce security and compliance controls as close to the source as possible, reducing risk and accelerating release velocity.

Watch Video