search

SAP / jenkins-library

Jenkins shared library for Continuous Delivery pipelines.
https://www.project-piper.io
Apache License 2.0
769 stars 582 forks source link

whitesourceExecuteScan creates an unnecessary MEND project on the fly for buildTool: 'docker' #4963

Open phlvphlv opened 2 weeks ago

phlvphlv commented 2 weeks ago

We're using on our pipeline whitesourceExecuteScan step to scan the docker image with the following settings in the .pipeline/config.yaml:

  whitesourceExecuteScan:
    userTokenCredentialsId: <my-credentials-id>
    dockerConfigJsonCredentialsId: <my-dockerfile-cfg-id>
    productName: <my-product-name>
    dockerImage: <custom-sapjvm-docker-image>
    verbose: true

and with the following call in the Jenkinsfile:

whitesourceExecuteScan(script: this, buildTool: 'docker',
  projectName: "${commonPipelineEnvironment.configuration.general.applicationId}-docker",
  scanImageRegistryUrl: 'https://tenant-domain-service.common.repositories.cloud.sap',
  scanImage: "${env.PRODUCTION_IMAGE}")

It was working correctly always uploading the scan result to the fixed MEND project named and project version, however recently it uploads result to the mentioned project but also creates a new project each time time the pipeline is executed. It's clearly visible in the logs:

[2024-06-18T08:31:40.164Z] info  whitesourceExecuteScan - Product Version: '1'
[2024-06-18T08:31:40.164Z] info  whitesourceExecuteScan - Scanned projects:
[2024-06-18T08:31:40.164Z] info  whitesourceExecuteScan -   Name: 'yoda-docker - 1', token: fc70523fbf2147949162f980dc62b656dfb5e8659c604129814d0d8bd42d35ea
[2024-06-18T08:31:40.164Z] info  whitesourceExecuteScan -   Name: 'com_sap_cx_bouncers_yoda_1_21_0-20240618082449-888cfebf3116a6a86e734ae681bbe20c49e894c3 - 1', token: a6145f8a2a774c249b3c03a60833659d866455f7f18b4d22b9a3c57b5d51de47

I am not sure it is a bug or misconfiguration, I was not able to configure it properly though in a way that it only uploads the results to the fixed project overriding previous results.