Sonatype Platform Plugin for Jenkins - Lifecycle

Download the most recent version of the plugin.

Sign in to Jenkins as an administrator.

Navigate to the Manage Jenkins > Plugins page.

Click on the Advanced tab.

Choose the .hpi file you previously downloaded.

Optionally you may enter the URL to the archive file under the Deploy Plugin section.

Deploy the plugin.

Sign in to Jenkins as an administrator.

Navigate to Manage Jenkins.

In the System Configuration section, click on Plugins.

In available plugins, search and install the UpdateSites Manager plugin.

Once installed, navigate to Manage Jenkins.

In the Uncategorized section, click on Manage UpdateSites.

Click on Add → Update Site, and enter the required information:

1. ID: sonatype-update-site.

   Note

   'sonatype-update-site' must be used as stated. This ID is essential for system functionality and must not be altered or renamed.

2. URL: https://download.sonatype.com/integrations/jenkins-uc/update-center.json

3. Mark the checkbox "Need CA Certificate" and paste the following certificate:

   -----BEGIN CERTIFICATE-----
   MIIDHzCCAgegAwIBAgIJAP+lqAK85t4HMA0GCSqGSIb3DQEBCwUAMCYxCzAJBgNVBAYTAlVTMRcwFQYDVQQKDA5Tb25hdHlwZSwgSW5jLjAeFw0yNDA0MTYyMDI3MzNaFw0yNzA0MTYyMDI3MzNaMCYxCzAJBgNVBAYTAlVTMRcwFQYDVQQKDA5Tb25hdHlwZSwgSW5jLjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOSSYo277GaxCRlk9/waQ+ytNU/suCqb8SlGeAWHpleZFwvFVxxG0MU1nEI7tgKCXoyXMdbM/bXFgTzjthAOcgNQaAFDY4aUO6DPjPxMv3FTHn4FqdCfL+zEBSzmMD9R3wwblRjcnhc0c5pq+2+jopu0no0nmvEo/KczPnDfmCS90v87ACkNMcVEaIe+AYDgBGMLcY3QeouEsLnKE6FNnovzyW8h8kBRHWiolgDlA6J0KRpqOKfpdtYrA22YzhsSw7WX4Tj2rZDhHmlZ6tT3zkXHM5evXR7H9aMalF+LVhg2ShUhCIfxVpKgvLd80N39+iBOvT02/7DsB2WaYvr6TxECAwEAAaNQME4wHQYDVR0OBBYEFIzUBWpQAwcpuPr94D7k9SMTGEV2MB8GA1UdIwQYMBaAFIzUBWpQAwcpuPr94D7k9SMTGEV2MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFkrkGZ+PoZ5JGM0rin7pCk/1e2dCeeh3/uMaQQ0QYyC4jMbsYfid/V8io2AQLujOUt9TLhNvRDIaFanUBfBdw9deHTrJf4Zm45FQGbytDOgOcF4hZ58yBjJv+Fs9ARFmF3rkWjWDcnIE9eNeXv82UD+lDyTEVH88Sb6qddkOHnAMT7dwCVDpxycWYWpPmwPM7Yf6a+shshPJqveD65RyJbolk4u49owJ3hYpLwmPvDfN9sxaqRVrdKg3RnYWf+faU1bMGXQEj/0tIipHvYuDzOCTGC587zByu589SHYjEPg2i7ud1EYXkeb7nEjfsYUzum3jGx7u1MDQ5RaxPyNxyA=
   -----END CERTIFICATE-----

4. Click Apply and Save.

Navigate to Manage Jenkins → Plugins page.

In the Plugin Manager window, select the Available plugins tab and enter "Nexus Platform Plugin" in the search box.

Mark the Install checkbox to select the Nexus Platform Plugin and click the Install button at the top right corner.

Success messages will appear as the plugin and its extensions are installed.

On the Pipeline project page, click Pipeline Syntax in the left menu to open the Snippet Generator.

In Snippet Generator > Steps, under Sample Step, select nexusPolicyEvaluation: Invoke Lifecycle Policy Evaluation.

Fill in the values for the policy evaluation.

Click the Generate Pipeline Script button.

Copy the generated script and paste it into the desired stage of your pipeline script.

Example Pipeline Script

nexusPolicyEvaluation(
                iqApplication: 'SampApp',
                iqInstanceId: 'MyIQServer1',
                iqStage: 'build'
)

Example Pipeline Script with Scan Patterns to Override Defaults

nexusPolicyEvaluation(
                 iqApplication: 'SampApp',
                 iqInstanceId: 'MyIQServer1',
                 iqScanPatterns: [[scanPattern: '**/*.js'], [scanPattern: '**/*.zip']],
                 iqStage: 'build',
                 iqOrganization: '55040769ec08424e84049356a3362d07'
)

The scan patterns support exclude patterns. The exclude patterns start with a '!' character and must be specified after all other included patterns. For example, the following scan patterns will consider for evaluation all files except those under the '.git' directory: 

iqScanPatterns: [[scanPattern: '**'], [scanPattern: '!.git/**']]

Example Pipeline Script Overriding Most Advanced Options

nexusPolicyEvaluation(
                 advancedProperties: 'test=value',
                 enableDebugLogging: true,
                 failBuildOnNetworkError: true,                  
         failBuildOnScanningErrors: true, 
                 iqApplication: selectedApplication('sandbox-application'),
                 iqInstanceId: 'MyIQServer1',
                 iqModuleExcludes: [[moduleExclude: '**/module-2-exclude/module.xml'], [moduleExclude: '**/module-1-exclude/module.xml']],
                 iqScanPatterns: [[scanPattern: '**/other/*.jar'], [scanPattern: '**/special/*.jar']],
                 iqStage: 'build',
                 jobCredentialsId: 'iq-server-localhost'
)

On the project page, click Configure in the left menu.

Click Build Steps.

Click the Add Build Step button.

Select Invoke Nexus Policy Evaluation.

Fill in the values for the policy evaluation.

Click Save.

Start a new Jenkins pipeline job for a Maven build.

Add a build stage that calls Maven clean package, wrapped in a few GitHub status updates. For this example, consider sending an update pending when we start the build and have it update the status to indicate if the build succeeded:

stage('Build') {
  postGitHub commitId, 'pending', 'build', 'Build is running'

  try {
    sh  "${mvnHome}/bin/mvn clean package"
    postGitHub commitId, 'success', 'build', 'Build succeeded'
  } catch (error) {
    postGitHub commitId, 'failure', 'build', 'Build failed'
    throw error
  }
}

Add a call to the GitHub API to update the status. To do this, set and declare the gitHubApiToken and project variables and then create the following function:

def postGitHub(commitId, state, context, description, targetUrl) {
  def payload = JsonOutput.toJson(
    state: state,
    context: context,
    description: description,
    target_url: targetUrl
  )
  sh "curl -H \"Authorization: token ${gitHubApiToken}\" --request POST --data '${payload}'
  https://api.github.com/repos/${project}/statuses/${commitId} > /dev/null"
}

After the build, we need to run a Lifecycle Analysis to determine the policy evaluation results. This will let GitHub know Lifecycle Analysis is running and then do the policy evaluation.

The easiest way to do this is by using the Jenkins Pipeline Syntax helper to generate a Groovy script:

Click the Pipeline Syntax link on your build configuration screen to open the Pipeline Syntax helper. Select nexusPolicyEvaluation as the sample step, select the IQ instance, stage and application you’d like to evaluate against, and then click Generate Pipeline Script. Copy the script and paste it into your pipeline script.

To process the evaluation results, set a policyEvaluation variable to the result. Like with the build, you’ll want to look at whether the build result is a failure or not to determine how to update your GitHub pull request. You can also add a link to the Application Composition Report. Having this available in your pull request lets you go directly to the evaluation, see why it failed, and perform remediation. An example Lifecycle Analysis script is shown below:

stage('Lifecycle Analysis') {
  postGitHub commitId, 'pending', 'analysis', 'Lifecycle Analysis is running'

  try {
    def policyEvaluation = nexusPolicyEvaluation iqApplication: 'webgoat', iqInstanceId: 'MyIQServer1', iqStage: 'build'
        postGitHub commitId, 'success', 'analysis', 'Lifecycle Analysis succeeded', "${policyEvaluation.applicationCompositionReportUrl}"
  } catch (error) {
    def policyEvaluation = error.policyEvaluation
    postGitHub commitId, 'failure', 'analysis', 'Lifecycle Analysis failed', "${policyEvaluation.applicationCompositionReportUrl}"
    throw error
  }
}

Save your pipeline and then run the build. When the build has been completed, you should see successful steps for Build and Lifecycle Analysis. In your GitHub pull request, you will see the successful checks and you can click the details link to view your report and address alerts or reevaluate policy.