Ant target for executing composer.lock vulnerability check provided by SensioLabs https://security.sensiolabs.org without using the CLI command. The command "ant lock_check" will do everything you need for this check. The definition assumes existing folder structure from http://jenkins-php.org/, you may want to modify those paths.

build-lock.xml

<?xml version="1.0" encoding="UTF-8"?>

<project name="Project-name-here" default="build" basedir=".">

    <target name="lock_check" description="Checks for vulnerabilities through a SensioLabs web service"
            depends="lock_reset,lock_get,lock_show">
        <local name="vulnerabilities.clean"/>
        <loadfile property="vulnerabilities.clean"
                  srcfile="${basedir}/build/logs/check_lock.log">
            <filterchain>
                <linecontainsregexp>
                    <regexp pattern="No known\* vulnerabilities detected"/>
                </linecontainsregexp>
            </filterchain>
        </loadfile>
        <fail message="Vulnerabilities detected" unless="vulnerabilities.clean"/>
    </target>

    <target name="lock_reset" description="Deletes any existing old lock check log files">
        <delete file="${basedir}/build/logs/check_lock.log" failonerror="false" quiet="true"/>
    </target>

    <target name="lock_get" description="Checks for vulnerabilities through a SensioLabs web service">
        <exec dir="${basedir}" executable="curl" failonerror="true">
            <arg value="--silent"/>
            <arg value="-o"/>
            <arg value="${basedir}/build/logs/check_lock.log"/>
            <arg value="-H"/>
            <arg value="Accept: text/plain"/>
            <arg value="https://security.sensiolabs.org/check_lock"/>
            <arg value="-F"/>
            <arg value="[email protected]"/>
        </exec>
    </target>

    <target name="lock_show" description="Displays the result of a vulnerability check">
        <exec dir="${basedir}" executable="cat" failonerror="false">
            <arg value="${basedir}/build/logs/check_lock.log"/>
        </exec>
    </target>

</project>