jfrog / jfrog/frogbot

When Frogbot Scan fails for any reason, no comment is added to PR

Open
#720 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
372
Forks
107
Avg merge
2d 20h
Merged PRs (30d)
5

Description

Describe the bug

When Frogbot Scan fails for any reason, no comment is added to PR.

Current behavior

11:28:55 11:28:55 [Info] Running Frogbot "scan-pull-request" command
11:28:55 11:28:55 [Info] Scanning Pull Request #4 (from source branch: to target branch: )
11:28:55 11:28:55 [Info] -----------------------------------------------------------
11:28:55 11:28:55 [Info] xxxxxxxxxxxxxxxx repository downloaded successfully. Starting with repository extraction...
11:28:55 11:28:55 [Info] Extracted repository successfully
11:28:55 11:28:55 [Info] Scanning source branch...
11:28:55 11:28:55 [Info] Preforming 1 SCA scans:
11:28:55 [
11:28:55 {
11:28:55 "Technology": "poetry",
11:28:55 "WorkingDirectory": "/tmp/jfrog.cli.temp.-1719588535-3386079605",
11:28:55 "Descriptors": [
11:28:55 "/tmp/jfrog.cli.temp.-1719588535-3386079605/pyproject.toml"
11:28:55 ]
11:28:55 }
11:28:55 ]
11:28:55 11:28:55 [Info] Running SCA scan for poetry vulnerable dependencies in /tmp/jfrog.cli.temp.-1719588535-3386079605 directory...
11:28:55 11:28:55 [Info] Calculating Poetry dependencies...
11:29:08 11:29:06 [Info] Scanning 57 poetry dependencies...
11:29:08 11:29:06 [Info] Waiting for scan to complete on JFrog Xray...
11:29:13 11:29:12 [Info] xxxxxxxxxxxxxxxx repository downloaded successfully. Starting with repository extraction...
11:29:13 11:29:12 [Info] Extracted repository successfully
11:29:13 11:29:12 [Info] Scanning target branch...
11:29:13 11:29:12 [Info] Preforming 1 SCA scans:
11:29:13 [
11:29:13 {
11:29:13 "Technology": "poetry",
11:29:13 "WorkingDirectory": "/tmp/jfrog.cli.temp.-1719588552-491394444",
11:29:13 "Descriptors": [
11:29:13 "/tmp/jfrog.cli.temp.-1719588552-491394444/pyproject.toml"
11:29:13 ]
11:29:13 }
11:29:13 ]
11:29:13 11:29:12 [Info] Running SCA scan for poetry vulnerable dependencies in /tmp/jfrog.cli.temp.-1719588552-491394444 directory...
11:29:13 11:29:12 [Info] Calculating Poetry dependencies...
11:29:14 11:29:14 [Error] audit command in '/tmp/jfrog.cli.temp.-1719588552-491394444' failed:
11:29:14 failed while building 'poetry' dependency tree:
11:29:14 "poetry install" command failed: exit status 1 - Creating virtualenv docs-loader-iPgwi-HJ-py3.11 in /opt/jenkins/.cache/pypoetry/virtualenvs
11:29:14 Installing dependencies from lock file
11:29:14
11:29:14 pyproject.toml changed significantly since poetry.lock was last generated. Run poetry lock [--no-update] to fix the lock file.
11:29:14
11:29:14 [Pipeline] }
11:29:14 [Pipeline] // stage
11:29:14 [Pipeline] stage
11:29:14 [Pipeline] { (Declarative: Post Actions)
11:29:14 [Pipeline] cleanWs
11:29:14 [WS-CLEANUP] Deleting project workspace...
11:29:14 [WS-CLEANUP] Deferred wipeout is used...
11:29:15 [WS-CLEANUP] done
11:29:15 [Pipeline] }
11:29:15 [Pipeline] // stage
11:29:15 [Pipeline] }
11:29:15 [Pipeline] // withEnv
11:29:15 [Pipeline] }
11:29:15 [Pipeline] // withCredentials
11:29:15 [Pipeline] }
11:29:15 [Pipeline] // withEnv
11:29:15 [Pipeline] }
11:29:15 [Pipeline] // node
11:29:15 [Pipeline] End of Pipeline
11:29:15 ERROR: script returned exit code 1
11:29:16 Posting build status of com.atlassian.bitbucket.jenkins.internal.model.BitbucketBuildStatus@86456856 to XXXXXXXXXX for commit id [xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx] and ref 'refs/heads/master'
11:29:16 Finished: FAILURE

Reproduction steps

(Pull Request Scan) Env:**

  • Jenkins Pipeline
  • BitBucket Server
  • Project Technologies: Poetry (with a lock file that differs from toml file)
Expected behavior

If pull request is created, Jfrogbot SCAN results should be added as a comment to PR whether its Successful and/or Fails

  • If scan is successfull, PR is updated with results as comment -- Working
  • If the scan fails, PR should be updated stating Frogbot cannot scan with a error message -- Desired Behaviour
JFrog Frogbot version

Latest

Package manager info

pyproject.toml, poetry.lock

Git provider

Bitbucket Server

JFrog Frogbot configuration yaml file

No response

Operating system type and version

Linux

JFrog Xray version

Latest

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the Pull Request Scan failure path for the Jenkins and Bitbucket Server integration, reproducing the Poetry lock-file mismatch described in the logs. Trace how scan errors are handled after the failure and verify that the pull request receives a comment explaining that Frogbot could not complete the scan.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, python
Domain
ci-cd, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.