从 pom.xml 外的命令行运行 maven 插件

Question

Below is the snyk plugin setup for maven. I have setup the plugin in pom.xml. I configured the maven set up in a pipeline. The below configuration has a secret API_TOKEN. Setting API_TOKEN as a variable in any file except the default pipeline file does not work. So I am exploring some way to setup and run the plugin in pipeline file ie to access and run plugin in mvn commandline for example mvn my-plugin:my-goal -Dplugin.property=ABC.

But I am not sure, how to call snyk plugin and run during build/install/deploy command.

<plugin>
                <groupId>io.snyk</groupId>
                <artifactId>snyk-maven-plugin</artifactId>
                <version>1.2.5</version>
                <executions>
                    <execution>
                        <id>snyk-test</id>
                        <phase>test</phase>
                        <goals>
                            <goal>test</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>snyk-monitor</id>
                        <phase>install</phase>
                        <goals>
                            <goal>monitor</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <apiToken>${SNYK_TOKEN}</apiToken>
                    <failOnSeverity>high</failOnSeverity>
                    <org>MDA</org>
                </configuration>
            </plugin>

Answer 1

The team just released a new version of the plugin. This is the github repo .

Example

<build>
  <plugins>
    <plugin>
      <groupId>io.snyk</groupId>
      <artifactId>snyk-maven-plugin</artifactId>
      <version>2.0.0</version>
      <inherited>false</inherited>
      <executions>
        <execution>
          <id>snyk-test</id>
          <goals>
            <goal>test</goal>
          </goals>
        </execution>
        <execution>
          <id>snyk-monitor</id>
          <goals>
            <goal>monitor</goal>
          </goals>
        </execution>
      </executions>
      <configuration>
        <apiToken>${env.SNYK_TOKEN}</apiToken>
        <args>
          <arg>--all-projects</arg>
        </args>
      </configuration>
    </plugin>
  </plugins>
</build>

By default now the snyk-test is linked to the mvn test . The monitor is connected to the mvn install phase by default. Obviously, you can change this like below.

<executions>
   <execution>
       <phase>verify</phase>
       <id>snyk-test</id>
       <goals>
           <goal>test</goal>
       </goals>
   </execution>
   <execution>
       <phase>none</phase>
       <id>snyk-monitor</id>
       <goals>
           <goal>monitor</goal>
       </goals>
   </execution>
</executions>

The API token in the first example is referring to an environment variable.

For more information maybe this blog post gives a more complete overview.