jfrog / jfrog/jfrog-cli-security
jf docker scan command exit code is always 0
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
scanning a tar file always gives and 0 error code even if vulnerbailities are present, even if i use --fail flag
jf s image.tar --format=table
Current behavior
1_container-scan-pipeline (xray).txt
I tried multiple flags, but exit code is always 0
Reproduction steps
running docker image with jfrog-cli
bash - c "jf c add OSS-CHECK2 --url $JF_URL --user $USER --password $PASS --interactive=false;jf rt ping; jf s image.tar --format=table | tee jfrog_scan.txt; jf s image.tar --format=sarif > jfrog_scan.sarif"
Expected behavior
expected non-zero exit code from executing "jf s image.tar " command
JFrog CLI version
2.46.2
Operating system type and version
linux, ubuntu
JFrog Artifactory version
No response
JFrog Xray version
3.79.11
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the jf s image.tar --format=table --fail command described in the issue and inspect the security scan command's exit-code handling. Done means the command returns a non-zero exit code when vulnerabilities are present, while preserving the reported scan output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100