jfrog / jfrog/jfrog-cli-security
JFrog plugin not marking build/stage/step as unstable based on jfrog CLI Scan result
@yahavi is already working on this.
Since Mar 7, 2023.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
I have a Jenkins pipeline building a maven project and then executing the following stage:
stage('Apply JFrog X-Ray Scanning') {
tools { jfrog 'jfrog-cli' }
steps {
script {
// Show the installed version of JFrog CLI.
jf '-v'
// Show the configured JFrog Platform instances.
jf 'c show'
// Ping Artifactory.
jf 'rt ping'
// Start local X-Ray scan
jf "s ${WORKSPACE}/**/my-artifact.tar.gz"
}
}
Despite the fact that the scan summary displays every level of severities (from unknown to critical) in my case, the step and the stage are still marked as successful by Jenkins. (I have also tried using the --fail=true option into the command).
See attachments...



Current behavior
jf "s ${WORKSPACE}/**/my-artifact.tar.gz" does not mark the build/stage/step as unstable.
Reproduction steps
No response
Expected behavior
jf "s ${WORKSPACE}/**/my-artifact.tar.gz" to mark the build/stage/step as unstable (at least if an occurence of a medium or higher severity).
JFrog plugin version
1.0.5
JFrog CLI version
2.32.0
Operating system type and version
RHEL 7.7
JFrog Artifactory version
No response
JFrog Xray version
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.