-
Notifications
You must be signed in to change notification settings - Fork 86
Open
Labels
questionFurther information is requestedFurther information is requested
Description
Hello!
Currently when we scan a maven repo using the same setup across 2 repos we are unable to get the SCA to generate the package list for this app, but the other repo can do it,
The only difference i can think of is that this repo has a multi pom setup.
Additionally in other scans i see this message:
13:29:40 [Debug] Diff scan - calculated dependencies tree for target /tmp/jfrog.cli.temp.-1750858059-1051314127, skipping scan part
That shows up where the dependency list shows up at.
here is the step template we are using in AZDO:
parameters:
- name: jfDepsRepo
type: string
default: ''
steps:
- task: CmdLine@2
displayName: 'Download and Run Frogbot PR Scan'
timeoutInMinutes: 20
continueOnError: true
env:
# Required
JF_URL: ${{ variables.JF_URL }}
JF_USER: ${{ variables.JF_USER }}
JF_PASSWORD: ${{ variables.JF_PASSWORD }}
JF_GIT_TOKEN: $(System.AccessToken)
JF_GIT_OWNER: $(System.TeamProject)
JF_GIT_PULL_REQUEST_ID: $(System.PullRequest.PullRequestId)
JF_GIT_PROJECT: $(System.TeamProject)
JF_GIT_REPO: $(Build.Repository.Name)
JF_GIT_API_ENDPOINT: $(System.CollectionUri)
JF_GIT_BASE_BRANCH: $(System.PullRequest.TargetBranchName)
JF_GIT_PROVIDER: azureRepos
JF_GIT_AGGREGATE_FIXES: "TRUE"
# Optional
# JF_RELEASES_REPO: "my-remote-repo"
# JF_WORKING_DIR: path/to/project/dir
JF_PATH_EXCLUSIONS: "*.git*;*node_modules*;*target*;*venv*;*test*;mock*;*mocks*;*mockserver*;*__pycache__*;*.log;*.md;*.txt;*.yml;*.yaml"
# JF_WATCHES: "watch-1,watch-2"
JF_PROJECT: ${{ variables.artifactoryProjectKey }}
# JF_INCLUDE_ALL_VULNERABILITIES: "TRUE"
# JF_FAIL: "FALSE"
${{ if ne(parameters.jfDepsRepo, '') }}:
JF_DEPS_REPO: ${{ parameters.jfDepsRepo }}
JF_FIXABLE_ONLY: "TRUE"
# JF_MIN_SEVERITY: "High"
# JF_EMAIL_RECEIVERS: "[email protected]"
# JF_ALLOWED_LICENSES: "MIT,Apache-2.0"
# JF_AVOID_EXTRA_MESSAGES: "TRUE"
# JF_PR_COMMENT_TITLE: "Frogbot Scan Results"
JFROG_CLI_LOG_LEVEL: "DEBUG"
# SMTP settings (only if using email notifications)
# JF_SMTP_SERVER: "smtp.server.com:587"
# JF_SMTP_USER: "$(SMTP_USER)"
# JF_SMTP_PASSWORD: "$(SMTP_PASSWORD)"
inputs:
script: |
set +e # Don't exit on error
echo "Using JFrog: $JF_URL"
echo "Using JFrog User: $JF_USER"
echo "Using JFrog Git Token for: $JF_GIT_TOKEN"
echo "Using JFrog Git Owner: $JF_GIT_OWNER"
echo "Using JFrog Git Pull Request ID: $JF_GIT_PULL_REQUEST_ID"
echo "Using JFrog Git Project: $JF_GIT_PROJECT"
echo "Using JFrog Git Repo: $JF_GIT_REPO"
echo "Using JFrog Git API Endpoint: $JF_GIT_API_ENDPOINT"
echo "Using JFrog Git Base Branch: $JF_GIT_BASE_BRANCH"
echo "Using JFrog Dependencies Repo: $JF_DEPS_REPO"
FROGBOT_SCRIPT_URL=$(if [ -z "$JF_RELEASES_REPO" ]; then echo "https://releases.jfrog.io"; else echo "${JF_URL}/artifactory/${JF_RELEASES_REPO}"; fi)
curl -fLg "$FROGBOT_SCRIPT_URL/artifactory/frogbot/v2/[RELEASE]/getFrogbot.sh" | sh
./frogbot spr
EXIT_CODE=$?
if [ $EXIT_CODE -ne 0 ]; then
echo "##vso[task.logissue type=warning]Frogbot scan failed with exit code $EXIT_CODE"
else
echo "Frogbot scan succeeded."
fi
exit 0 # Always succeed the task so it doesn't fail the pipeline
Metadata
Metadata
Assignees
Labels
questionFurther information is requestedFurther information is requested