Skip to content

Commit bdc4327

Browse files
keanjapesankeanjapesan
committed
Feat: Add Nexus IQ scan through REST API
Additionally convert dep5 config to REUSE.toml as per reusable-workflows enforces using REUSE.toml from now on. Signed-off-by: Kevin Sandi <[email protected]> Change-Id: I2004c34ebec30bc10b0fce32bf0d9c89374edd8a
1 parent 6d7c4d1 commit bdc4327

File tree

6 files changed

+159
-52
lines changed

6 files changed

+159
-52
lines changed

‎.reuse/dep5‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎REUSE.toml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
version = 1
2+
3+
[[annotations]]
4+
path = ".github/**"
5+
precedence = "aggregate"
6+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
7+
SPDX-License-Identifier = "EPL-1.0"
8+
9+
[[annotations]]
10+
path = "node_modules/**"
11+
precedence = "aggregate"
12+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
13+
SPDX-License-Identifier = "EPL-1.0"
14+
15+
[[annotations]]
16+
path = "tests/.mypy**"
17+
precedence = "aggregate"
18+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
19+
SPDX-License-Identifier = "EPL-1.0"
20+
21+
[[annotations]]
22+
path = "tests/__pycache__/**"
23+
precedence = "aggregate"
24+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
25+
SPDX-License-Identifier = "EPL-1.0"
26+
27+
[[annotations]]
28+
path = "relnotes/**"
29+
precedence = "aggregate"
30+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
31+
SPDX-License-Identifier = "EPL-1.0"
32+
33+
[[annotations]]
34+
path = "releasenotes/**"
35+
precedence = "aggregate"
36+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
37+
SPDX-License-Identifier = "EPL-1.0"
38+
39+
[[annotations]]
40+
path = "jjb/**"
41+
precedence = "aggregate"
42+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
43+
SPDX-License-Identifier = "EPL-1.0"
44+
45+
[[annotations]]
46+
path = ".jjb-test/**"
47+
precedence = "aggregate"
48+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
49+
SPDX-License-Identifier = "EPL-1.0"
50+
51+
[[annotations]]
52+
path = "docs/**"
53+
precedence = "aggregate"
54+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
55+
SPDX-License-Identifier = "CC-BY-4.0"
56+
57+
[[annotations]]
58+
path = "jenkins-admin/**"
59+
precedence = "aggregate"
60+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
61+
SPDX-License-Identifier = "EPL-1.0"
62+
63+
[[annotations]]
64+
path = "schema/**"
65+
precedence = "aggregate"
66+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
67+
SPDX-License-Identifier = "EPL-1.0"
68+
69+
[[annotations]]
70+
path = "reusable-tox-run-action/**"
71+
precedence = "aggregate"
72+
SPDX-FileCopyrightText = "2017 The Linux Foundation"
73+
SPDX-License-Identifier = "EPL-1.0"

‎docs/jjb/lf-go-jobs.rst‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,16 @@ Calls go-test.sh script against a Go project.
1717
lf-infra-nexus-iq-go-cli
1818
------------------------
1919

20-
Calls nexus-iq-go-cli.sh to CLM scan a Go project.
20+
Calls nexus-iq-go-cli.sh to CLM scan a Go project through CLI.
21+
22+
:Required Parameters:
23+
24+
:NEXUS_IQ_PROJECT_NAME: Nexus IQ project name that will receive the CLM scan results.
25+
26+
lf-infra-nexus-iq-go-api
27+
------------------------
28+
29+
Calls nexus-iq-go-api.sh to CLM scan a Go project through REST API.
2130

2231
:Required Parameters:
2332

‎jjb/lf-go-jobs.yaml‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,14 @@
1717
NEXUS_IQ_PROJECT_NAME={nexus-iq-project-name}
1818
- shell: !include-raw-escape: ../shell/nexus-iq-go-cli.sh
1919

20+
- builder:
21+
name: lf-infra-nexus-iq-go-api
22+
builders:
23+
- inject:
24+
properties-content: |
25+
NEXUS_IQ_PROJECT_NAME={nexus-iq-project-name}
26+
- shell: !include-raw-escape: ../shell/nexus-iq-go-api.sh
27+
2028
############
2129
# WRAPPERS #
2230
############
@@ -344,6 +352,7 @@
344352
git-url: "$GIT_URL/$PROJECT"
345353
github-url: "https://github.com"
346354
java-version: openjdk17 # Scanner is a jar
355+
nexus-iq-use-cli: true
347356
nexus-iq-cli-version: 1.185.0-01
348357
nexus-iq-namespace: "" # Recommend a trailing dash when set. Example: odl-
349358
nexus-target-build: "go.sum"
@@ -395,8 +404,24 @@
395404
- lf-update-java-alternatives:
396405
java-version: "{java-version}"
397406
- shell: "{pre-build-script}"
398-
- lf-infra-nexus-iq-go-cli:
399-
nexus-iq-project-name: "{nexus-iq-namespace}{project-name}"
407+
# With CLI
408+
- conditional-step:
409+
condition-kind: boolean-expression
410+
condition-expression: "{nexus-iq-use-cli}"
411+
steps:
412+
- shell: echo 'Using Nexus IQ CLI'
413+
- lf-infra-nexus-iq-go-cli:
414+
nexus-iq-project-name: "{nexus-iq-namespace}{project-name}"
415+
# With REST API
416+
- conditional-step:
417+
condition-kind: not
418+
condition-operand:
419+
condition-kind: boolean-expression
420+
condition-expression: "{nexus-iq-use-cli}"
421+
steps:
422+
- shell: echo 'Using Nexus IQ REST API'
423+
- lf-infra-nexus-iq-go-api:
424+
nexus-iq-project-name: "{nexus-iq-namespace}{project-name}"
400425

401426
- job-template:
402427
name: "{project-name}-nexus-iq-go-clm-{stream}"

‎releasenotes/notes/nexus-iq-scan-through-api-336e114fb52f6183.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
features:
3+
- |
4+
Add support for running Nexus IQ scan through REST API when CLI option
5+
is not enough, like when scanning a Golang project which requires
6+
scanning the bom.xml file and CLI doesn't support it properly.

‎shell/nexus-iq-go-api.sh‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/bin/bash
2+
# SPDX-License-Identifier: EPL-1.0
3+
##############################################################################
4+
# Copyright (c) 2025 The Linux Foundation and others.
5+
#
6+
# All rights reserved. This program and the accompanying materials
7+
# are made available under the terms of the Eclipse Public License v1.0
8+
# which accompanies this distribution, and is available at
9+
# http://www.eclipse.org/legal/epl-v10.html
10+
##############################################################################
11+
echo "---> nexus-iq-go-api.sh"
12+
# This script installs and runs cyclonedx-gomod to generate an SBOM xml
13+
# for the Go project, then uses Nexus IQ REST API to analyze the Go project
14+
# dependencies and publishes the result to Nexus IQ server.
15+
16+
# stop on error or unbound variable
17+
set -eu
18+
# do not print commands, credentials should not be logged
19+
set +x
20+
21+
# shellcheck disable=SC1090
22+
. ~/lf-env.sh
23+
24+
go version
25+
go mod tidy
26+
27+
echo "INFO: running Nexus IQ scan (through REST API) on project $NEXUS_IQ_PROJECT_NAME and target: bom.xml"
28+
29+
go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
30+
PATH=$PATH:$(go env GOPATH)/bin
31+
export PATH
32+
cyclonedx-gomod mod -output bom.xml -output-version 1.5 # upgrade to latest SBOM schema version when Nexus IQ version >= 180
33+
34+
APP_ID=$(curl -u "${NEXUS_IQ_USER}:${NEXUS_IQ_PASSWORD}" \
35+
-X GET "https://nexus-iq.wl.linuxfoundation.org/api/v2/applications?publicId={$NEXUS_IQ_PROJECT_NAME}" \
36+
-s \
37+
| jq -r ".applications[].id")
38+
39+
curl -u "${NEXUS_IQ_USER}:${NEXUS_IQ_PASSWORD}" \
40+
-X POST -H "Content-Type: application/xml" --data "@bom.xml" \
41+
"https://nexus-iq.wl.linuxfoundation.org/api/v2/scan/applications/$APP_ID/sources/cyclonedx"
42+
43+
echo "---> nexus-iq-go-api.sh ends"

0 commit comments

Comments
 (0)