jfrog / jfrog/frogbot

Dependent project file was not found

Open
#516 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
372
Forks
107
Avg merge
2d 20h
Merged PRs (30d)
5

Description

Describe the bug

When frogbot runs dotnet restore against a .sln file that has dependent project(s) with relative path references, the command fails because the dependent project cannot be located at /tmp

I do have default set for JF_WORKING_DIR: .
and also frogbot-config.yml wiht working dirs defined

The way I have been able to workaround this issue is the first run checkout and copy everything to /tmp

Current behavior

from the project .sln file:

Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FOOCommon", "..\common\FOO.Common.csproj", "{86BACE5E-A591-499E-90D7-7AB8EDEA533B}"
EndProject

Run jfrog/frogbot@v2
::group::Frogbot
Frogbot
##[debug]Downloading Frogbot from https://releases.jfrog.io/artifactory/frogbot/v2/[RELEASE]/frogbot-linux-amd64/frogbot
##[debug]Downloading https://releases.jfrog.io/artifactory/frogbot/v2/[RELEASE]/frogbot-linux-amd64/frogbot
##[debug]Destination /runner/_work/_temp/b385ff9c-4c6b-49da-a306-028b5e8e56f5
##[debug]download complete
##[debug]Caching tool frogbot [RELEASE] x64
##[debug]source file: /runner/_work/_temp/b385ff9c-4c6b-49da-a306-028b5e8e56f5
##[debug]destination /opt/hostedtoolcache/frogbot/[RELEASE]/x64
##[debug]destination file /opt/hostedtoolcache/frogbot/[RELEASE]/x64/frogbot
##[debug]finished caching tool
/opt/hostedtoolcache/frogbot/[RELEASE]/x64/frogbot scan-pull-request
19:56:53 [Info] Frogbot version: 2.15.1
19:56:53 [Info] Running Frogbot "scan-pull-request" command
19:56:54 [Info] Scanning Pull Request #21
19:56:54 [Info] -----------------------------------------------------------
19:56:54 [Info] ssnc-cloud repository downloaded successfully. Starting with repository extraction...
19:56:54 [Info] Extracted repository successfully
19:56:55 [Info] Running SCA scan for vulnerable dependencies scan in /tmp/jfrog.cli.temp.-1695326214-[36]/common directory...
19:56:55 [Info] Detected: nuget, dotnet.
19:56:55 [Info] Calculating NuGet dependencies
19:56:55 [Info] Dependencies sources were not detected. Running 'dotnet restore' command
19:56:57 [Info] Scanning 25 nuget dependencies...
19:56:57 [Info] Waiting for scan to complete on JFrog Xray...
19:56:58 [Info] Running SCA scan for vulnerable dependencies scan in /tmp/jfrog.cli.temp.-1695326214-3637989317/file.indexer directory...
19:56:58 [Info] Detected: nuget, dotnet.
19:56:58 [Info] Calculating NuGet dependencies
19:56:58 [Info] Dependencies sources were not detected. Running 'dotnet restore' command
Error: 8 [Error] audit command in '/tmp/jfrog.cli.temp.-1695326214-3637989317/file.indexer' failed:
failed while building 'nuget' dependency tree:
'dotnet restore' command failed: exit status 1 - /home/runner/.dotnet/sdk/6.0.414/NuGet.targets(369,5): error MSB3202: The project file "/tmp/common/FOO.Common.csproj" was not found.

Error: The process '/opt/hostedtoolcache/frogbot/[RELEASE]/x64/frogbot' failed with exit code 1

Reproduction steps

No response

Expected behavior

dotnet restore would run successfully

JFrog Frogbot version

2.15.1

Package manager info

nuget, dotnet

Git provider

GitHub

JFrog Frogbot configuration yaml file
  • params:
    git:
    repoName: blah
    branches:
    - "blah-branch"
    aggregateFixes: false
    scan:
    includeAllVulnerabilities: true
    fixableOnly: true
    projects:
    - workingDirs:
    - "common"
    - "file.indexer"
Operating system type and version

linux ubuntu 20.04

JFrog Xray version

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the scan-pull-request flow and the repository extraction and working-directory handling used before dotnet restore. Reproduce the relative project reference from the .sln with the configured common and file.indexer working directories, then verify that restore resolves the dependent project without copying the repository to /tmp.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, github-actions
Domain
devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.