jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.43k stars 1.28k forks source link

Jenkins Plugin cant publish report that is on ephermeral worker node #2391

Open kyrogue opened 4 years ago

kyrogue commented 4 years ago

Describe the bug When using the Kubernetes Plugin, which runs builds on pods in a kubernetes cluster, as the pod is dead the workspace that is on the pod will also be gone.

When we use the

dependencyCheckPublisher

on the pipeline, it does not detect that it is running on a worker node and wont transfer the file back to the master before publishing it.

This will cause the pipeline step to report

[DependencyCheck] Unable to find Dependency-Check reports to parse

Example of the Pipelinescript:

podTemplate(yaml: """
apiVersion: v1
kind: Pod
metadata:
spec:
  containers:
  - name: gradle
    image:<private-registry>gradle:5.6.2
    command:
    - cat
    tty: true
  - name: depcheck
    image: <private-registry>/depcheck:5.2.4-alpine
    imagePullPolicy: Always
    command:
    - cat
    tty: true
"""
) {
  node(POD_LABEL) {
     stage('Checkout') {
        checkout scm
     }
    stage('Unit Test') {
      container('gradle') {
        sh './gradlew test'
      }
    }
    stage('OWASP dep check') {
      container('depcheck') {
        sh 'depcheck --enableExperimental --scan ./'
      }
    }
    stage('Publish OWASP') {
      container('depcheck') {
          sh 'ls -lah'
         dependencyCheckPublisher pattern: './dependency-check-report.html'
      }
    }
  }
}

Version of dependency-check used 5.2.4

Log file

To Reproduce Steps to reproduce the behavior:

Expected behavior The publish step should be able to find the report file on the ephermeral node , instead of trying to find it in the workspace in the master jenkins.

Additional context If we use the HTML Publish plugin publishHTML([allowMissing: false, alwaysLinkToLastBuild: false, keepAll: false, reportDir: './results', reportFiles: 'dependency-check-report.html', reportName: 'OWASP Report', reportTitles: ''])

it will detect that the report is on a ephemeral node and will move the report to the jenkins master reporting something like this

[htmlpublisher] Archiving HTML reports...
[htmlpublisher] Archiving at PROJECT level /home/jenkins/agent/workspace/slaveworkspace/results to /var/jenkins_home/jobs/masterworkspace/htmlreports/OWASP_20Report
stevespringett commented 4 years ago

Pull requests are highly recommended.

Also, Jenkins plugin issues are here: https://issues.jenkins-ci.org/