Azure DevOps - Nexus IQ Extension issue with scan Targets for Java Maven - Sonatype Lifecycle & Repository Firewall - Sonatype Community
Azure DevOps - Nexus IQ Extension issue with scan Targets for Java Maven
post by azizbasha on Apr 15, 2020
Hi
I have created Java Maven pipeline using YAML.
Wherein I am using Nexus IQ Extension 1.2.1 for Nexus IQ Policy Evaluation
below is the Task in my pipeline -
- task: SonatypeIntegrations.nexus-iq-azure-extension.nexus-iq-azure-pipeline-ask.NexusIqPipelineTask@1
displayName: ‘Nexus IQ Policy Evaluation’
inputs:
nexusIqService: $(Serviceconnection.Nexus.IQ.Name)
applicationId: $(appname_nexus_lc)
scanTargets: '**/*.jar, **/*.war, **/*.ear, **/*.tar.gz'
Nexus IQ is unable to scan targets in the Azure DevOps -> Java Build Pipeline.
I have also tried with giving scan targets as below-
scanTargets : ‘$(Build.ArtifactsStagingDirectory)/**/*.war’
Also with hard coded values scanTargets is unable to scan the Artifacts.
any ideas.
post by jyoung on May 11, 2020
I believe this is related, Sign in to sonatype, copying the response from there:
The ability to scan the Artifacts Staging Directory is on the list of improvements we’d like to add to the Azure DevOps extension. The team rotates investment through our portfolio of integrations and there isn’t any planned work on Azure DevOps; however, when we circle back to it, we will entertain how to fulfill this. Thanks for the idea.
post by pimbelien on Jun 17, 2020
Hi Justin
I think I’m facing the exact same problem. The task does not find anything from the Build.ArtifactStagingDirectory even though my .war is right there.
Am I right to assume that basically right now the extension cannot scan from the Artifacts Staging Directory, but it would from some other directory?
post by jyoung on Jun 17, 2020
Correct, currently the scanning occurs within “Build.Repository.LocalPath” but not in “Build.ArtifactStagingDirectory”. We have a ticket in the backlog to fix but no timetable as to when we will be able to address this.
post by vipetrul on Aug 7, 2020
In the meantime, as a workaround you could create a directory symlink from “Build.Repository.LocalPath” to “Build.ArtifactStagingDirectory”.
post by mpuglin on Apr 14, 2021
This issue was addressed in release 1.2.10 of the Azure DevOps extension.