Maven Error: Plugin not found when only activated in <reporting>

[Stefan Wegener]

Hi,

I hope this is the correct place, because I am not sure if this is an error (for which you have Github), or if just I do something wrong.

I am using Maven 3.0.5 and OpenJDK 1.7.0_75.

In my projects POM.xml I entered (following by Example 2 in the reporting-section):

<plugin>
                <plugin>
                    <groupId>org.owasp</groupId>
                    <artifactId>dependency-check-maven</artifactId>
                    <version>1.2.8</version>
                    <reportSets>
                        <reportSet>
                            <reports>
                                <report>aggregate</report>
                            </reports>
                        </reportSet>
                    </reportSets>
                </plugin>
</plugin>

When I now try to run mvn dependency-check:check or mvn dependency-check:aggregate, I get the following error:
No plugin found for prefix 'dependency-check' in the current project and in the plugin groups [org.apache.maven.plugins, org.codehaus.mojo] available from the repositories [local (/home/<username>/.m2/repository), central (http://repo.maven.apache.org/maven2)]

But when I run mvn site, the reports are generated.
Also, when I append my POM.xml by the code of Example 1 and run mvn dependency-check:check it works.
My problem is, that I only want to execute dependency-check manually (or when using mvn site) and not during every build. It feels that I did something wrong and this is not a real bug and that someone of you can help me.

Kind regards,
Stefan

[Jeremy Long]

There are a few ways to solve the problem. In your situation the best is likely to add dependency-check to the pluginManagement section of the pom:

    <build>
        <pluginManagement>
            <plugins>

                <plugin>
                    <groupId>org.owasp</groupId>
                    <artifactId>dependency-check-maven</artifactId>
                    <version>1.2.8</version>

                </plugin>
            </plugins>
        </pluginManagement>
        ...
    </build>

Then `mvn dependency-check:check` will work. Alternatively, you could use the fully qualified plugin name by calling `mvn org.owasp:dependency-check-maven:1.2.8:check`. The last option would be to place dependency-check into a profile that is activated via a command line property (see 'allTests' in dependency-check-core's pom.xml line 576 for an example).

Let me know if this solves your problem.

Best Regards,

Jeremy