Provide support to add parameter either to specify location of settings.xml or provide a way to share settings id when running Trivy Scans

[arkajnag23]

Description

Creating this discussion based on the below analysis:
#7807

If there is a way to provide a parameter to share the settings file location as in our case, we use the Jenkins pipeline that creates a temp settings file and a temp repository when running the builds as its ec2 instances. ( which are mostly spot instances ).

2024-12-03T10:38:20+01:00	DEBUG	[pom] Start parent	artifact="grid.installer:grid-lcm-installer:2.0.100.20210311-095808_06"
2024-12-03T10:38:20+01:00	DEBUG	[pom] Failed to fetch	url="https://repo.maven.apache.org/maven2/grid/installer/grid-lcm-installer/2.0.100.20210311-095808_06/grid-lcm-installer-2.0.100.20210311-095808_06.pom" statusCode=404

It should have been my local repository or temp repository from where the artifacts should have been fetched, but instead looking at https://repo.maven.apache.org/
This is how I am trying to use Jenkins pipeline script

    stage('Build EventAnalytics-Installer and Release to Nexus.') {
        steps {
            withCredentials([
                file(credentialsId: 'keystore', variable: 'KEYSTORE'),
                string(credentialsId: 'store', variable: 'KEYSTORE_PASSWORD')
            ]) {
                configFileProvider([configFile(fileId: 'test-support', variable: 'MAVEN_SETTINGS')]) {
                    sh """
                        mkdir -p \$HOME/.m2
                        cp \$MAVEN_SETTINGS \$HOME/.m2/settings.xml
                    """
                withMaven(
                    jdk: jdk17Version,
                    maven: mvnVersion,
                    mavenLocalRepo: '.repository',
                    mavenSettingsFilePath: "${env.HOME}/.m2/settings.xml"
                ) {
                    sh "mvn -e clean deploy"
                    sh """
                        trivy fs "${WORKSPACE}" \
                            --scanners vuln \
                            --format json \
                            --db-repository public.ecr.aws/aquasecurity/trivy-db \
                            --java-db-repository public.ecr.aws/aquasecurity/trivy-java-db \
                            --output ea-installer-snapshot-vulnerability-scan.json \
                            --severity HIGH,CRITICAL,MEDIUM \
                            --debug
                    """
                }
            }
        }

Target

Filesystem

Scanner

Vulnerability