Sonatype for Bamboo Data Center

Perform a Lifecycle policy evaluation on files in the build workspace.

Display scan results within Bamboo build workspace.

Provide a link to a comprehensive Lifecycle policy evaluation report indicating violation details and remediation recommendations.

Login as administrator in Bamboo and click on the gear icon in the top right toolbar.

Select Add-ons from the drop-down list.

In the Manage Add-ons section, click Upload Add-on/app link. A dialog opens, enabling you to specify a file, or a URL location.

Choose the location of the Sonatype for Bamboo Data Center file, downloaded previously.

Click Open, and then Upload button.

You will see a message confirming upload of Sonatype for Bamboo Data Center.

In the left-hand navigation area/menu, locate Sonatype. Click on the Configuration link to open the IQ Server Configuration window:

Enter the IQ Server URL - the URL for your IQ Server.

Select an Authentication Method:

1. PKI Authentication: Delegate to the JVM for authentication.

2. User Authentication: Enter a username and password for authentication.

   Tip

   We recommend creating a unique machine account that has access to the application(s) to be linked to your Bamboo Build(s)/Plans.

Click the Save button. Your configuration is saved, displaying the application(s) the user has access to.

Add the Sonatype IQ task to Bamboo, per the steps in the following section.

Navigate to a Bamboo Project > Plan > Stage > and then Job, select the Tasks tab, and then click on the Add task button.

A modal displays a list of available Task types. Lifecycle Policy Evaluation is listed in the Tests type, or you can use search to locate it.

Enter the following information:

1. Task Description: to indicate what the task does.

2. Fail build when IQ Server is unable to evaluate: check this option if you want to fail the build when an IQ evaluation cannot be performed. This could occur if IQ Server is inaccessible. If left unchecked, the build will continue normally even if no policy evaluation is performed.

   Tip

   Details of the application evaluation are provided in the job/build-specific log.

3. Fail build when there are scanning errors: check this option if you want to fail the build when there are scanning errors. This could occur if for example there are malformed files.

4. Organization (optional): the list of Organizations retrieved from the IQ Server. An organization ID can also be specified directly. If an organization is selected and automatic application creation is enabled, a new application will automatically be created under the selected organization, if it does not already exist on the IQ Server.

5. Application: the list of Applications corresponds to the account used during Sonatype for Bamboo Data Center configuration. Remember, this is the Application containing the policies that components in the build will be evaluated against. An application can also be specified that is not in the list. If automatic application creation is enabled, an application with the specified ID will automatically be created if it does not already exist on the IQ Server.

6. Stage: this corresponds to the stage you wish the policy evaluation of the application/project to be run against. Additionally, this will correspond to the stage location when viewing report information via the IQ Server. For example, if you chose the Build stage, summary and dashboard violation results will be displayed accordingly.

7. Scan Targets: the scan targets setting allows you to control which files should be examined with an Apache Ant styled pattern. The pattern is relative to the project workspace root directory and inherits the global configuration.

8. Module Excludes: if you are using the Sonatype CLM for Maven plugin, module files are created, and can contribute to results found during an evaluation.

   

Click the Save button. Lifecycle Policy Evaluation task now appears in the list as Final tasks.

Bamboo looks for either bamboo-specs/bamboo.yml or bamboo-specs/bamboo.yaml files. You should have them created in your repository.

Go to Bamboo Administration (gear icon) > Linked repositories, select the repository containing the .yaml file, click the Bamboo Specs tab and activate the Scan for Bamboo Specs button. This allows Bamboo to scan the linked repository for Specs.

Here is a sample .yaml file for a build plan executing two tasks (refer section under tasks):

version: 2
plan:
  project-key: PK
  key: IQ
  name: SonatypePlan
  description: Integrating Sonatype for Bamboo Data Center
stages:
- Default Stage:
    manual: false
    final: false
    jobs:
    - Default Job
Default Job:
  key: JOB1
  tasks:
  - checkout:
      force-clean-build: 'false'
      description: Checkout Default Repository
  - maven:
      executable: Maven 3
      jdk: JDK 17.0.4
      goal: clean test
      tests: 'true'
      description: Clean Test Sample Project
  artifact-subscriptions: []
repositories:
- SampleRepository:
    scope: global
triggers:
- polling:
    period: '180'
branches:
  create: manually
  delete: never
  link-to-jira: true
notifications: []
labels: []
dependencies:
  require-all-stages-passing: false
  enabled-for-branches: true
  block-strategy: none
  plans: []
other:
  concurrent-build-plugin: system-default

To add the Lifecycle Policy Evaluation Task, you add block any-task containing the Lifecycle configuration, undertaskssection of the spec:

- any-task:
      plugin-key: com.sonatype.clm.ci.bamboo:clm-scan-task
          description: Bamboo Task
      configuration:
        failOnClmFailures: 'true'
        failOnScanningErrors: 'false'
        clmOrgIdType: specified
                clmOrgId: iq-org
        clmAppIdType: specified
                clmAppId: iq-app
                clmStageType: specified
        clmStageTypeId: build
        clmScanTargets: '**/*.jar'        
        clmModuleExcludes: '**/my-module/target/**'

Lifecycle Policy Evaluation Task Configuration Properties:

The first time you update the yaml Spec in your linked repository, you should see a successful build in the Bamboo's Plan Summary:

Any subsequent changes to the yaml Spec will trigger the Plan build in Bamboo and you can see the code commits in the Build Result Summary.