jfrog / jfrog/frogbot

Frogbot not showing as a tool in Security -> Code Scanning

Open
#777 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
372
Forks
107
Avg merge
2d 20h
Merged PRs (30d)
5

Description

Describe the bug

The "Frogbot Scan Pull Request" code scanning tool does not show up in the UI after being added.

Current behavior

The action is scanning as expected without failures. Python project is being installed with poetry and scanned.

Snip from the PR which deployed the tool:
Image

Reproduction steps

Workflow being used.

name: "Frogbot Scan Pull Request"
on:
  pull_request:
    branches:
      - master
permissions:
  pull-requests: write
  contents: read
  id-token: write
  security-events: write
jobs:
  scan-pull-request:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install poetry
        run: pip install poetry

      - uses: jfrog/frogbot@5d9c42c30f1169d8be4ba5510b40e75ffcbbc2a9 # v2.21.2
        env:
          JF_URL: "https://redacted.jfrog.io/"
          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JF_DEPS_REPO: "pypi-virtual"
        with:
          oidc-provider-name: github-provider
          oidc-audience: github-audience
Expected behavior

The tool to show up in the Security -> Code Scanning tab.

JFrog Frogbot version

2.23.1

Package manager info

poetry 1.8.4, pyproject.toml

Git provider

GitHub

JFrog Frogbot configuration yaml file

No response

Operating system type and version

Ubuntu 22.04.5

JFrog Xray version

3.106.5

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the provided GitHub Actions workflow and reproduce the Python 3.11, Poetry, and Frogbot 2.23.1 setup on Ubuntu. Check the repository's Security → Code Scanning page and trace how this workflow's scan is represented there; the issue is done when the Frogbot Scan Pull Request tool appears in that tab.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, python
Domain
ci-cd, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.