Gemnasium-maven-dependency_scanning

DevSecOps
1

Hello,

I use GitLab to build my Java app. I included “Security/Dependency-Scanning.gitlab-ci.yml” template to my pipeline for dependency scanning. Then I found, that this scanning does another build by Maven from scratch for its purpose. To avoid the dependencies downloading again, I specified a variable:

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=.m2/repository"

Also I set:

cache:
    paths:
      - .m2/repository/

in the build stage in hope that next stage (“dependencies scanning”) will use this directory with already downloaded dependencies. But it doesn’t help, dependencies download again.

Does anyone can help with this?

Thanks.

2

Sadly the maven.repo.local argument needs to be an absolute. So you need to either append ${PWD} to your argument, or as I did simply add a before_script to cp -r .m2/repository /root/.m2/