Thread | Android StackOverflow

How can I make Sonatype Nexus IQ Jenkins plugin evaluate all Gradle dependencies in an Android project?

I am using the Sonatype Nexus IQ in a Jenkins pipeline for an Android Gradle project.

I want Nexus IQ to perform a Policy Evaluation on all dependencies of my Android application, including direct and transitive Gradle dependencies.

Currently, I use nexusPolicyEvaluation with scan patterns,
However, Nexus IQ reports only 5 evaluated components, which appear to be JAR files physically present in the Jenkins workspace. It does not seem to evaluate the complete dependency tree shown by:


./gradlew :app:dependencies --configuration androidReleaseRuntimeClasspath

How can I configure nexusPolicyEvaluation so that Nexus IQ evaluates the complete Gradle dependency tree, including transitive dependencies, instead of only scanning JAR/AAR files found in the workspace?

Is there a recommended Sonatype integration or Gradle configuration for this use case?

stage(&#39;4.Nexus IQ Policy&#39;) {    
      steps {            
        script {        
          try {    
              def iqAppId = &#39;*****&#39;            
              nexusPolicyEvaluation(                    
              iqStage: &#39;release&#39;,               
              iqApplication: iqAppId,       
              failBuildOnNetworkError: true,                               failBuildOnPolicyViolation: true,                 
     iqScanPatterns: [                         
 [scanPattern: &#39;**/*.jar&#39;],                       
   [scanPattern: &#39;**/*.aar&#39;],                     
     [scanPattern: &#39;**/*.apk&#39;],                    
      [scanPattern: &#39;**/*.aab&#39;]                
      ],                    
  applicationVersion: &#39;1.0.0&#39;,            
  iqOrganization:&#39;****&#39;,        
  verbose: true                  )       
        } catch (exc) {            
      error(&quot;Nexus IQ Policy failed: ${exc.message}&quot;)        
      }        
  }  }  }

Aug 20 at 3:52 PM

Nadin Martini

#android #jenkins #nexus #sonatype

No answer found for this question yet.

stage('4.Nexus IQ Policy') { steps { script { try { def iqAppId = '*****' nexusPolicyEvaluation( iqStage: 'release', iqApplication: iqAppId, failBuildOnNetworkError: true, failBuildOnPolicyViolation: true, iqScanPatterns: [ [scanPattern: '**/*.jar'], [scanPattern: '**/*.aar'], [scanPattern: '**/*.apk'], [scanPattern: '**/*.aab'] ], applicationVersion: '1.0.0', iqOrganization:'****', verbose: true ) } catch (exc) { error("Nexus IQ Policy failed: ${exc.message}") } } } }