Hosted Repository Analysis

To use the feature you will need to enable the feature flag for Nexus Repository shown below and connect Lifecycle to the Repository. Refer to Connecting IQ Server for details.

../sonatype-work/nexus3/etc/nexus.properties

nexus.app.scan.enabled=true

The API calls on this page will require either an organizationId for new applications or an existing applicationId. You can locate the organizationId from the Lifecycle UI or by calling the Organization REST API. The applicationId can be found in the Lifecycle UI or by calling the Application REST API.

Target specific artifacts inside the hosted repository for a Lifecycle analysis. Using an organizationId this endpoint will automatically add applications to the Lifecycle organization when not present.

Example for automatically created application name

For an artifact in the repository /maven-hosted/org/slf4j/slf4j-api/, the automatically created application name will be org-slf4j-slf4j-api

POST /service/rest/v1/scan/execute/{repostoryName}/{path}

The above command required a body element to be included. Review the Lifecycle parameters section for the Organization or Application IDs.

The optional StageId defaults to the build stage.

{
  "iqOrganizationId": "string",
  "iqApplicationId": "string",
  "iqStageTypeId": "string
}

Example curl command

curl commands should be run against the Nexus Repository instance where the repository/artifact to be scanned is located.

curl -X POST -u <username>:<password> \
  "<host>/service/rest/v1/scan/execute/{repositoryName}/{path}
  -H "Content-Type: application/json" \
  -d "{\"iqOrganizationId\": \"a5c56d00972e41188601c02700ced17c\", \"iqStageTypeId\": \"release\"}"

Example response

{
  "scanId": "b163b59b1f36425099ad91a18f353d3b",
  "reportUrl": "ui/links/application/commons-fileupload-commons-fileupload/report/b163b59b1f36425099ad91a18f353d3b"
}

If there are multiple versions of an artifact found the scan path target, then the latest version number (not the most recently uploaded version) will be retrieved and scanned.

Hosted repository analysis may be configured to monitor an artifact's namespace for new versions of an artifact and run an analysis of any new artifacts with higher version numbers submitted to the hosted repository. The new version and scan will replace the latest Lifecycle report for that application if one exists already.

POST /service/rest/v1/scan/configure/{repostoryName}/{path}

{
  "iqOrganizationId": "string",
  "iqApplicationId": "string",
  "iqStageTypeId": "release",
  "scanTargetRegex": "^.*war$",
  "scanTriggerRegexes": [
      "^.*jar$",
      "^.*zip$"
  ]
}

GET /service/rest/v1/scan/configure/{repostoryName}

DELETE /service/rest/v1/scan/configure/{repostoryName}/{path}