jfrog / jfrog/frogbot

Scans not showing any results.

Open
#878 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
Go
Stars
372
Forks
107
Avg merge
2d 20h
Merged PRs (30d)
5

Description

Hello!
Currently when we scan a maven repo using the same setup across 2 repos we are unable to get the SCA to generate the package list for this app, but the other repo can do it,
The only difference i can think of is that this repo has a multi pom setup.

scan-logs.txt

Additionally in other scans i see this message:

13:29:40 [Debug] Diff scan - calculated dependencies tree for target /tmp/jfrog.cli.temp.-1750858059-1051314127, skipping scan part

That shows up where the dependency list shows up at.

here is the step template we are using in AZDO:

parameters:
  - name: jfDepsRepo
    type: string
    default: '' 
steps:
  - task: CmdLine@2
    displayName: 'Download and Run Frogbot PR Scan'
    timeoutInMinutes: 20
    continueOnError: true
    env:
      # Required
      JF_URL: ${{ variables.JF_URL }}
      JF_USER: ${{ variables.JF_USER }}
      JF_PASSWORD: ${{ variables.JF_PASSWORD }}
      JF_GIT_TOKEN: $(System.AccessToken)
      JF_GIT_OWNER: $(System.TeamProject)
      JF_GIT_PULL_REQUEST_ID: $(System.PullRequest.PullRequestId)
      JF_GIT_PROJECT: $(System.TeamProject)
      JF_GIT_REPO: $(Build.Repository.Name)
      JF_GIT_API_ENDPOINT: $(System.CollectionUri)
      JF_GIT_BASE_BRANCH: $(System.PullRequest.TargetBranchName)
      JF_GIT_PROVIDER: azureRepos
      JF_GIT_AGGREGATE_FIXES: "TRUE"
      # Optional
      # JF_RELEASES_REPO: "my-remote-repo"
      # JF_WORKING_DIR: path/to/project/dir
      JF_PATH_EXCLUSIONS: "*.git*;*node_modules*;*target*;*venv*;*test*;mock*;*mocks*;*mockserver*;*__pycache__*;*.log;*.md;*.txt;*.yml;*.yaml"
      # JF_WATCHES: "watch-1,watch-2"
      JF_PROJECT: ${{ variables.artifactoryProjectKey }}
      # JF_INCLUDE_ALL_VULNERABILITIES: "TRUE"
      # JF_FAIL: "FALSE"
      ${{ if ne(parameters.jfDepsRepo, '') }}:
        JF_DEPS_REPO: ${{ parameters.jfDepsRepo }}
      JF_FIXABLE_ONLY: "TRUE"
      # JF_MIN_SEVERITY: "High"
      # JF_EMAIL_RECEIVERS: "sec-team@example.com"
      # JF_ALLOWED_LICENSES: "MIT,Apache-2.0"
      # JF_AVOID_EXTRA_MESSAGES: "TRUE"
      # JF_PR_COMMENT_TITLE: "Frogbot Scan Results"
      JFROG_CLI_LOG_LEVEL: "DEBUG"
      # SMTP settings (only if using email notifications)
      # JF_SMTP_SERVER: "smtp.server.com:587"
      # JF_SMTP_USER: "$(SMTP_USER)"
      # JF_SMTP_PASSWORD: "$(SMTP_PASSWORD)"

    inputs:
      script: |
        set +e  # Don't exit on error
        echo "Using JFrog: $JF_URL"
        echo "Using JFrog User: $JF_USER"
        echo "Using JFrog Git Token for: $JF_GIT_TOKEN"
        echo "Using JFrog Git Owner: $JF_GIT_OWNER"
        echo "Using JFrog Git Pull Request ID: $JF_GIT_PULL_REQUEST_ID"
        echo "Using JFrog Git Project: $JF_GIT_PROJECT"
        echo "Using JFrog Git Repo: $JF_GIT_REPO"
        echo "Using JFrog Git API Endpoint: $JF_GIT_API_ENDPOINT"
        echo "Using JFrog Git Base Branch: $JF_GIT_BASE_BRANCH"
        echo "Using JFrog Dependencies Repo: $JF_DEPS_REPO"
        FROGBOT_SCRIPT_URL=$(if [ -z "$JF_RELEASES_REPO" ]; then echo "https://releases.jfrog.io"; else echo "${JF_URL}/artifactory/${JF_RELEASES_REPO}"; fi)
        curl -fLg "$FROGBOT_SCRIPT_URL/artifactory/frogbot/v2/[RELEASE]/getFrogbot.sh" | sh
        ./frogbot spr
        EXIT_CODE=$?
  
        if [ $EXIT_CODE -ne 0 ]; then
          echo "##vso[task.logissue type=warning]Frogbot scan failed with exit code $EXIT_CODE"
        else
          echo "Frogbot scan succeeded."
        fi
  
        exit 0  # Always succeed the task so it doesn't fail the pipeline

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the attached scan-logs.txt and the Azure DevOps step template, then trace the ./frogbot spr entry point for Maven dependency discovery. Compare behavior between the single-POM and multi-POM repositories, including the “Diff scan” message, and verify completion by confirming that the scan produces the expected package list.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go, java, shell
Domain
devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.