Scan of local .m2 folder

I use OWASP Dependency Checker to scan code in pipelines. I do it after building of it.

I found that some project use local maven repository e.g.: /jenkins/workspace/MyProject/.m2/

Should I scan this folder or better to exclude it? I think the second option is better cause .m2 could contains plugins, test libraries etc

[jeremylong]

The .m2 folder should be skipped in this scenario.

[jeremylong]

In cases of supporting a ton of different projects - have you considered something like:

if test -f "pom.xml"; then
   mvn org.owasp:dependency-check-maven:aggregate
   publish ./target/dependency-check.xml
elif  test -f "build.gradle"; then
   gradle --init-script /path/to/customDependencyCheckConfig.gradle dependencyCheckAggregate
   publish ./build/reports/dependency-check.xml
else
   dependency-check.sh -s . -o . -f XML
   publish ./dependency-check.xml
fi

Of course the above is psuedo-code and would need the correct publish mechanism added. For gradle see the documentation on init-scripts - I haven’t done this myself yet, but basically you could more correctly cover gradle and maven builds out of the box with just a little scripting to detect the build system used.