Nexus IQ for Bamboo

On this page

Overview

Sonatype CLM for Bamboo has been rebranded to Nexus IQ for Bamboo from version 1.0.7 onwards. When upgrading to 1.0.7, uninstall Sonatype CLM for Bamboo.

Nexus IQ for Bamboo available for download here integrates with Atlassian Bamboo to run policy evaluations in the build workspace. It provides instant analysis of open-source components used in every Bamboo build and generates alerts for policy violations related to quality, license, or security. This allows development teams to address open-source policy violations earlier in the development cycle and avoid unplanned rework.

Prerequisites for using Nexus IQ for Bamboo:

Main Features

  1. Perform a Nexus IQ Server policy evaluation on files in the build workspace.
  2. Display scan results within Bamboo build workspace.
  3. Provide a link to a comprehensive Nexus Lifecycle policy evaluation report indicating violation details and remediation recommendations.

Installation

  1. Login as administrator in Bamboo and click on the gear icon in the top right toolbar.
  2. Select Add-ons from the drop-down list.
  3. In the Manage Add-ons section, click Upload Add-on/app link. A dialog opens, enabling you to specify a file, or a URL location.
  4. Choose the location of the Nexus IQ for Bamboo file, downloaded previously.
  5. Click Open, and then Upload button. 
  6. You will see a message confirming upload of Nexus IQ for Bamboo.

Nexus IQ for Bamboo will now appear as listed under User-installed add-ons

In most cases, pausing your Bamboo server is a good idea. 

Configure Nexus IQ for Bamboo

Navigate to Bamboo administration.

  1. In the left-hand navigation area / menu, locate  Nexus IQ. Click on the Configuration link to open the Nexus IQ Server Configuration window:
  2. Enter the IQ Server URL - the URL for your IQ Server.
  3. Select an Authentication Method:
    1. PKI Authentication: Delegate to the JVM for authentication.
    2. User Authentication: Enter a username and password for authentication.

      We recommend creating a unique machine account that has access to the application(s) to be linked to your Bamboo Build(s)/Plans.

  4. Click the Save button. Your configuration is saved, displaying the application(s) the user has access to.
  5. Add the Nexus IQ task to Bamboo, per steps in the following section.

Add Nexus IQ analysis task 

  1. Navigate to a Bamboo Project > Plan > Stage > and then Job, select the Tasks tab and then click on the Add task button.
  2. A modal displays a list of available Task types. IQ Policy Evaluation is listed in the Tests type, or you can use search to locate.
  3. Enter the following information:
    1. Task Description: to indicate what the task does.
    2. Fail build when IQ Server is unable to evaluate: check this option if you want to fail the build when an IQ evaluation cannot be performed. This could occur if IQ Server is inaccessible. If left unchecked, the build will continue normally even if no policy evaluation is performed.

      Details of the application evaluation are provided in the job/build-specific log.

    3. Organization (optional): the list of Organizations retrieved from the Nexus IQ Server. An organization ID can also be specified directly. If an organization is selected and automatic application creation is enabled, a new application will automatically be created under the selected organization, if it does not already exist on the IQ Server.
    4. Application: the list of Applications corresponds to the account used during Nexus IQ for Bamboo configuration. Remember, this is the Application containing the policies that components in the build will be evaluated against. An application can also be specified that is not in the list. If automatic application creation is enabled, an application with the specified ID will automatically be created if it does not already exist on the IQ Server.
    5. Stage: this corresponds to the stage you wish the policy evaluation of the application/project to be run against. Additionally, this will correspond to the stage location when viewing report information via the IQ Server. For example, if you chose the Build stage, summary and dashboard violation results will be displayed accordingly.
    6. Scan Targets: the scan targets setting allows you to control which files should be examined with an Apache Ant styled pattern. The pattern is relative to the project workspace root directory and inherits the global configuration.
    7. Module Excludes: if you are using the Sonatype CLM for Maven plugin, module files are created, and can contribute to results found during an evaluation. For information on how to exclude these files, please see Sonatype CLM for Maven.
  4. Click the Save button. IQ Policy Evaluation task now appears in the list as Final tasks.

Optional: Use Bamboo Specs to configure Nexus IQ analysis task 

You can configure/add Nexus IQ Analysis task as code, using Bamboo Specs. This way you can automate your build plans by fetching its configuration from a file inside the repository. 

  1. Bamboo looks for either bamboo-specs/bamboo.yml or bamboo-specs/bamboo.yaml files. You should have them created in your repository.
  2. Go to Bamboo Administration (gear icon) > Linked repositories, select the repository containing the .yaml file, click the Bamboo Specs tab and activate the Scan for Bamboo Specs button. This allows Bamboo to scan the linked repository for Specs.
  3. Here is a sample .yaml file for a build plan executing two tasks (refer section under tasks):

    version: 2
    plan:
      project-key: PK
      key: IQ
      name: NexusIQPlan
      description: Integrating Nexus IQ Bamboo Plugin
    stages:
    - Default Stage:
        manual: false
        final: false
        jobs:
        - Default Job
    Default Job:
      key: JOB1
      tasks:
      - checkout:
          force-clean-build: 'false'
          description: Checkout Default Repository
      - maven:
          executable: Maven 3
          jdk: JDK 17.0.4
          goal: clean test
          tests: 'true'
          description: Clean Test Sample Project
      artifact-subscriptions: []
    repositories:
    - SampleRepository:
        scope: global
    triggers:
    - polling:
        period: '180'
    branches:
      create: manually
      delete: never
      link-to-jira: true
    notifications: []
    labels: []
    dependencies:
      require-all-stages-passing: false
      enabled-for-branches: true
      block-strategy: none
      plans: []
    other:
      concurrent-build-plugin: system-default
  4. To add the IQ Policy Evaluation Task, you add block any-task containing the Nexus IQ configuration, under tasks section of the spec:

    - any-task:
          plugin-key: com.sonatype.clm.ci.bamboo:clm-scan-task
    	  description: Bamboo Task
          configuration:  		
            failOnClmFailures: 'true'      
            clmOrgIdType: specified
    	  	clmOrgId: iq-org
            clmAppIdType: specified
    	  	clmAppId: iq-app
    		clmStageType: specified
            clmStageTypeId: build
            clmScanTargets: '**/*.jar'        
            clmModuleExcludes: '**/my-module/target/**'

    IQ Policy Evaluation Task Configuration Properties:

    KeyDescriptionRequiredAccepted values
    plugin-keyThe plugin identifier within Bamboo: The plugin's module used in the task. You can find the Nexus IQ plugin information in the Add-ons/apps administration section in Bamboo.truecom.sonatype.clm.ci.bamboo:clm-scan-task
    descriptionThe task description to remember what the task does.falseDefault: empty
    failOnClmFailuresIf set to true the build will fail when an IQ evaluation can’t be performed or if for any reason the evaluation is not generated.
    false
    • true
    • false (default)
    clmOrgIdTypeWhether the Nexus IQ Organization ID is specified or selected from a list. In the Bamboo Specs scope any of the accepted values is valid.false
    • specified (default)
    • selected
    clmOrgIdThe Organization ID assigned in Nexus IQ Server. falseDefault: none
    clmAppIdTypeWhether the Nexus IQ Application ID is specified or selected from a list. In the Bamboo Specs scope any of the accepted values is valid.true
    • specified
    • selected
    clmAppIdThe Application ID assigned in Nexus IQ Server. If automatic application creation is enabled, an application with the specified ID will automatically be created if it does not exist in Nexus IQ Server.true
    clmStageTypeWhether the Stage the policy evaluation runs is specified or selected from a list. In the Bamboo Specs scope any of the accepted values is valid.true
    • specified
    • selected
    clmStageTypeIdThe Stage ID for which the policy evaluation of the application/project runs.true
    • develop
    • source
    • build
    • stage-release
    • release
    • operate
    clmScanTargetsA comma-separated list of Ant-style patterns relative to the workspace root that denote the files/archives to be scanned.falseDefault: **/*.jar, **/*.war, **/*.ear, **/*.zip, **/*.tar.gz
    clmModuleExcludesA comma-separated list of Ant-style patterns relative to the workspace root that denote the module information files (**/nexus-iq/module.xml) to be ignored.falseDefault: none
  5. The first time you update the yaml Spec in your linked repository, you should see a successful build in the Bamboo's Plan Summary:
  6. Any subsequent changes to the yaml Spec will trigger the Plan build in Bamboo and you can see the code commits in the Build Result Summary.

Evaluate Policies and View Results

Your application will be evaluated as a task during Bamboo job execution. The Job Summary page shows the results of the evaluation.

The summary results give a breakdown and count of violations for each of the 3 threat level categories: 

  • Critical (threat level 8-10)
  • Severe (threat level 4-7)
  • Moderate (threat level 2-3)

The overall evaluation status is indicated by Passed, Failed, Passed with Warnings.

Click on Full Report to view a detailed report in Nexus IQ Server.