chocolatey / Chocolatey.Cake.Recipe

A set of convention based Cake scripts for building Chocolatey projects
Apache License 2.0
5 stars 9 forks source link

(#145) Enable skipping of Yarn analysis #146

Closed Windos closed 5 months ago

Windos commented 5 months ago

Description Of Changes

This PR enables disabling the Dependency-Check Yarn Audit analysis as part of the Dependency-Check task. Due to the Dependency-Check Cake addin being out of date, this is achieved by injecting the required switch into the dependency-check.bat when a new tool setting, dependencyCheckDisableYarnAudit, is set to true.

Motivation and Context

Dependency-Check occasionally triggers Yarn analysis when it isn't needed and results in the Dependency-Check failing. By disabling this analysis, it allows the Dependency-Check, and build in general, to complete successfully.

Testing

  1. Clone a project that triggers Yarn Analysis
  2. Set the SonarQube environment variables:
    • SONARQUBE_URL
    • SONARQUBE_ID
    • SONARQUBE_TOKEN
  3. Patch the recipe tool with the changes from this PR
  4. Run the build: .\build.bat --verbosity=diagnostic --target=CI --testExecutionType=none --shouldRunAnalyze=false --shouldRunIlMerge=false --shouldObfuscateOutputAssemblies=false --shouldRunChocolatey=false --shouldRunNuGet=false --shouldRunSonarQube=true --shouldRunDependencyCheck=true
  5. See that build runs and that Yarn Analysis was triggered.
  6. Re-run the build adding --dependencyCheckDisableYarnAudit=true
  7. See that the build runs and that Yarn Analysis was skipped (n.b. there is no output saying it was skipped, but it will be missing from the list of audits executed as they are executed.)

Operating Systems Testing

Windows Server 2019

Change Types Made

Change Checklist

Related Issue

Windos commented 5 months ago

@gep13 - Thanks for your input on this PR, I swapped over to Tool Settings for my change. I also got this change tested today, it highlighted that the path to the batch file needed an explicit ToString().

gep13 commented 5 months ago

@Windos this looks great! Happy to get this merged in, and get a new release out the door!