jfrog / jfrog/jfrog-cli-security

JFrog plugin not marking build/stage/step as unstable based on jfrog CLI Scan result

Open
#446 1 comment 0 reactions 1 assignee View on GitHub

@yahavi is already working on this.

Since Mar 7, 2023.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

I have a Jenkins pipeline building a maven project and then executing the following stage:

stage('Apply JFrog X-Ray Scanning') {
tools { jfrog 'jfrog-cli' }
steps {
	script {					
		// Show the installed version of JFrog CLI.
		jf '-v'
		
		// Show the configured JFrog Platform instances.
		jf 'c show'
		
		// Ping Artifactory.
		jf 'rt ping'

		// Start local X-Ray scan
		jf "s ${WORKSPACE}/**/my-artifact.tar.gz"
	}
}

Despite the fact that the scan summary displays every level of severities (from unknown to critical) in my case, the step and the stage are still marked as successful by Jenkins. (I have also tried using the --fail=true option into the command).
See attachments...

jenkins-pipeline-jfrog-cli-xray-scan
jfrog-cli-xray-scan-1
jfrog-cli-xray-scan-2

Current behavior

jf "s ${WORKSPACE}/**/my-artifact.tar.gz" does not mark the build/stage/step as unstable.

Reproduction steps

No response

Expected behavior

jf "s ${WORKSPACE}/**/my-artifact.tar.gz" to mark the build/stage/step as unstable (at least if an occurence of a medium or higher severity).

JFrog plugin version

1.0.5

JFrog CLI version

2.32.0

Operating system type and version

RHEL 7.7

JFrog Artifactory version

No response

JFrog Xray version

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.