An open API service indexing awesome lists of open source software.

https://github.com/lfreleng-actions/sonatype-lifecycle-scan-action

Performs a Sonatype Lifecycle security scan/audit of a repository
https://github.com/lfreleng-actions/sonatype-lifecycle-scan-action

security security-scan sonatype

Last synced: 5 months ago
JSON representation

Performs a Sonatype Lifecycle security scan/audit of a repository

Awesome Lists containing this project

README

          

# 🔍 Sonatype Lifecycle Scan

Runs a Sonatype Lifecycle (Nexus IQ) scan.

## sonatype-lifecycle-scan-action

## Usage Example

```yaml
steps:
- name: "Sonatype Lifecycle Scan"
uses: lfreleng-actions/sonatype-lifecycle-scan-action@main
with:
nexus_iq_password: ${{ secrets.nexus_iq_password }}
scan_targets: 'my-project-folder'
```

## Inputs

| Name | Required | Default | Description |
| ----------------- | -------- | -------- | ---------------------------------------------------- |
| nexus_iq_server | True | | Nexus IQ Server URL |
| nexus_iq_username | True | | Nexus IQ USERNAME |
| nexus_iq_password | True | | Nexus IQ Password |
| java_distribution | False | temurin | JAVA SE distribution to setup/run for Nexus CLI tool |
| java_version | False | 17 | Java runtime to setup/run for Nexus CLI tool |
| iq_cli_version | False | 2.4.2-01 | Specific version of Nexus CLI to setup/run |
| application_id | False | | Organisation and project name in Nexus IQ |
| scan_targets | False | . | Location of file(s) or folder(s) to scan |
| no_checkout | False | false | Do not checkout local repository; used for testing |
| debug | False | false | Enable debugging output |

### Required Inputs

For the mandatory inputs, create the following Github variables at the
organisation level so that all repositories can use them:

- NEXUS_IQ_SERVER
- NEXUS_IQ_USERNAME

Also, the following secret:

- NEXUS_IQ_PASSWORD

Pass the values of these variables to the action from the calling workflow.