Closed SOFYDEVELOPER closed 7 months ago
Security audit, information and commands
The security team is auditing all the hosting requests, to ensure a better security by default.
This message informs you that a Jenkins Security Scan was triggered on your repository. It takes ~10 minutes to complete.
/audit-ok
=> the audit is complete, the hosting can continue :tada:./audit-skip
=> the audit is not necessary, the hosting can continue :tada:./audit-findings
=> the audit reveals some issues that require corrections :pencil2:./request-security-scan
=> the findings from the Jenkins Security Scan were corrected, this command will re-scan your repository :mag:./audit-review
=> the findings from the audit were corrected, this command will ping the security team to review the findings :eyes:.
It's only applicable when the previous audit required changes.(automatically generated message, version: 1.26.21)
Hello from your friendly Jenkins Hosting Checker
It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.
<jenkins.version>2.164.3</jenkins.version>
to at least 2.401.3 in your pom.xml. Take a look at the baseline recommendations.<connection>
tag in your <scm>
block in your pom.xml. You can use this sample: <connection>scm:git:https://github.com/jenkinsci/${project.artifactId}-plugin.git</connection>
sofy-app-upload
) is incorrect, it should be sofy-app-upload-jenkins
('New Repository Name' field with "-plugin" removed)You can re-trigger a check by editing your hosting request or by commenting /hosting re-check
The Jenkins Security Scan discovered 2 finding(s) :mag:. For each of them, either apply the recommended correction, suppress the warning or provide a justification.
Once you're done, either re-run the scan with /request-security-scan
or request the Security team to review your justifications with /audit-review
.
You can find detailed information about this finding here.
You can find detailed information about this finding here.
👋 Related to the scan, some additional information:
All the plugin does is uploading a file to a hard coded url. In a Jenkins pipeline this can be easily achieved with the https://plugins.jenkins.io/http_request/ plugin. Put some glue code in a pipeline library and you have an easy to use step in your pipeline. I assume you plan to provide some sort of feedback about the result of the scan.
This looks pretty much identical to the existing plugin https://plugins.jenkins.io/sofy-ai/
This looks pretty much identical to the existing plugin https://plugins.jenkins.io/sofy-ai/
@mawinter69 Unfortunately, due to unforeseen circumstances, we have lost access to our previous account. In light of this, we have setup a new account to resume our activities. Therefore, the need for a new Jenkins plugin. We won't be using our previous plugin anymore. Currently we are working on the changes mentioned above.
we have lost access to our previous account.
We can surely grant you access to the existing plugin, there's no need for an additional plugin.
@NotMyFault Can you please elaborate how? As our previous account is not to be considered but only the new account (SOFYDEVELOPERS). Your help would be appreciated.
We can grant you access to the existing plugin while you propose your changes as pull request, which we will review.
If all changes made are according to our requirements for plugins, we can grant you release access.
I've invited both users mentioned in the initial issue body to https://github.com/jenkinsci/upload-build-to-sofy-plugin.
Please file your proposed plugin as PR to the existing plugin and link it here for a review. Once reviewed, we will grant you release permission.
I'll go ahead and close the request given you have been granted access to the existing resource.
Repository URL
https://github.com/SOFYDEVELOPER/sofy-app-upload-jenkins-plugin
New Repository Name
sofy-app-upload-jenkins-plugin
Description
The plugin in question is designed for customer interaction and facilitates the seamless uploading of their builds to our platform, Sofy.ai. This customer-facing tool serves as a valuable resource, streamlining the process of submitting their software builds to enhance the overall user experience on our platform. Through this plugin, customers can efficiently contribute their builds, fostering a more collaborative and user-friendly environment on Sofy.ai.
GitHub users to have commit permission
@Ayeshasaifsofy @SOFYDEVELOPER
Jenkins project users to have release permission
sofydevelopers
Issue tracker
GitHub issues