Sonatype Scan Gradle Plugin (#851)

* Sonatype Scan Gradle Plugin https://github.com/sonatype-nexus-community/scan-gradle-plugin
micronaut-projects · Jan 9, 2025 · c9ab360 · c9ab360
1 parent 9be0db7
commit c9ab360
Show file tree

Hide file tree

Showing 4 changed files with 25 additions and 2 deletions.
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
@@ -30,6 +30,8 @@ jobs:
       PREDICTIVE_TEST_SELECTION: "${{ github.event_name == 'pull_request' && 'true' || 'false' }}"
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      OSS_INDEX_USERNAME: ${{ secrets.OSS_INDEX_USERNAME }}
+      OSS_INDEX_PASSWORD: ${{ secrets.OSS_INDEX_PASSWORD }}      
     steps:
        # https://github.com/actions/virtual-environments/issues/709
       - name: "🗑 Free disk space"
@@ -58,6 +60,12 @@ jobs:
         run: |
           [ -f ./setup.sh ] && ./setup.sh || [ ! -f ./setup.sh ]
 
+      - name: "🚔 Sonatype Scan"
+        if: matrix.java == '17'
+        id: sonatypescan
+        run: |
+          ./gradlew ossIndexAudit --no-parallel
+
       - name: "🛠 Build with Gradle"
         id: gradle
         run: |

diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle
@@ -10,4 +10,5 @@ repositories {
 dependencies {
     implementation libs.gradle.micronaut
     implementation libs.gradle.kotlin
+    implementation(libs.sonatype.scan)
 }
diff --git a/buildSrc/src/main/groovy/io.micronaut.build.internal.servlet.module.gradle b/buildSrc/src/main/groovy/io.micronaut.build.internal.servlet.module.gradle
@@ -1,4 +1,17 @@
 plugins {
     id 'io.micronaut.build.internal.servlet.base'
     id 'io.micronaut.build.internal.module'
+    id("org.sonatype.gradle.plugins.scan")
+}
+String ossIndexUsername = System.getenv("OSS_INDEX_USERNAME") ?: project.properties["ossIndexUsername"]
+String ossIndexPassword = System.getenv("OSS_INDEX_PASSWORD") ?: project.properties["ossIndexPassword"]
+boolean sonatypePluginConfigured = ossIndexUsername != null && ossIndexPassword != null
+if (sonatypePluginConfigured) {
+ossIndexAudit {
+    username = ossIndexUsername
+    password = ossIndexPassword
+    excludeCoordinates = [
+            "io.undertow:undertow-core:2.3.18.Final" // no patched version https://ossindex.sonatype.org/component/pkg:maven/io.undertow/undertow-core
+    ]
+}
 }
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
@@ -21,7 +21,7 @@ micronaut-session = "4.5.0"
 micronaut-validation = "4.8.0"
 google-cloud-functions = '1.1.0'
 micronaut-logging = "1.5.0"
-
+sonatype-scan = "2.8.3"
 # Micronaut
 micronaut-gradle-plugin = "4.4.4"
 kotlin = "1.9.25"
@@ -55,8 +55,9 @@ jetty-alpn-server = { module = 'org.eclipse.jetty:jetty-alpn-server', version.re
 jetty-alpn-conscrypt-server = { module = 'org.eclipse.jetty:jetty-alpn-conscrypt-server', version.ref = 'managed-jetty' }
 kotest-runner = { module = 'io.kotest:kotest-runner-junit5', version.ref = 'kotest-runner' }
 bcpkix = { module = "org.bouncycastle:bcpkix-jdk15on", version.ref = "bcpkix" }
-
 google-cloud-functions = { module = 'com.google.cloud.functions:functions-framework-api', version.ref = 'google-cloud-functions' }
+sonatype-scan = { module = "org.sonatype.gradle.plugins:scan-gradle-plugin", version.ref = "sonatype-scan" }
+
 # Gradle
 gradle-micronaut = { module = "io.micronaut.gradle:micronaut-gradle-plugin", version.ref = "micronaut-gradle-plugin" }
 gradle-kotlin = { module = "org.jetbrains.kotlin:kotlin-gradle-plugin", version.ref = "kotlin" }