https://github.com/lfreleng-actions/sonatype-lifecycle-scan-action
Performs a Sonatype Lifecycle security scan/audit of a repository
https://github.com/lfreleng-actions/sonatype-lifecycle-scan-action
security security-scan sonatype
Last synced: 5 months ago
JSON representation
Performs a Sonatype Lifecycle security scan/audit of a repository
- Host: GitHub
- URL: https://github.com/lfreleng-actions/sonatype-lifecycle-scan-action
- Owner: lfreleng-actions
- License: other
- Created: 2025-06-11T08:14:49.000Z (about 1 year ago)
- Default Branch: main
- Last Pushed: 2025-10-08T12:12:44.000Z (10 months ago)
- Last Synced: 2025-10-08T14:24:33.133Z (10 months ago)
- Topics: security, security-scan, sonatype
- Homepage:
- Size: 118 KB
- Stars: 0
- Watchers: 0
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# 🔍 Sonatype Lifecycle Scan
Runs a Sonatype Lifecycle (Nexus IQ) scan.
## sonatype-lifecycle-scan-action
## Usage Example
```yaml
steps:
- name: "Sonatype Lifecycle Scan"
uses: lfreleng-actions/sonatype-lifecycle-scan-action@main
with:
nexus_iq_password: ${{ secrets.nexus_iq_password }}
scan_targets: 'my-project-folder'
```
## Inputs
| Name | Required | Default | Description |
| ----------------- | -------- | -------- | ---------------------------------------------------- |
| nexus_iq_server | True | | Nexus IQ Server URL |
| nexus_iq_username | True | | Nexus IQ USERNAME |
| nexus_iq_password | True | | Nexus IQ Password |
| java_distribution | False | temurin | JAVA SE distribution to setup/run for Nexus CLI tool |
| java_version | False | 17 | Java runtime to setup/run for Nexus CLI tool |
| iq_cli_version | False | 2.4.2-01 | Specific version of Nexus CLI to setup/run |
| application_id | False | | Organisation and project name in Nexus IQ |
| scan_targets | False | . | Location of file(s) or folder(s) to scan |
| no_checkout | False | false | Do not checkout local repository; used for testing |
| debug | False | false | Enable debugging output |
### Required Inputs
For the mandatory inputs, create the following Github variables at the
organisation level so that all repositories can use them:
- NEXUS_IQ_SERVER
- NEXUS_IQ_USERNAME
Also, the following secret:
- NEXUS_IQ_PASSWORD
Pass the values of these variables to the action from the calling workflow.