Fixed aggregation of multiple odc-report files.

[mum-viadee]

This fix will resolve multiple issues reported for the dependency check publisher. The aggregation of multiple files had a serious mistake in the way it processed multiple files. It created a ResultAction for every single report file found, aggregated the severity of all files, but only kept the findings of the last found report file.

This shout fix the following open issues:

• https://issues.jenkins.io/browse/JENKINS-62402
• https://issues.jenkins.io/browse/JENKINS-60108
• https://issues.jenkins.io/browse/JENKINS-59200
• https://issues.jenkins.io/browse/JENKINS-59076
• https://issues.jenkins.io/browse/JENKINS-58610
• https://issues.jenkins.io/browse/JENKINS-58523

[markiewiczart]

Thanks for the fix! Any chances to merge it in the near future? With this bug it's impossible to create reasonable reports for mono-repos (Maven/Gradle with OWASP plugin + OWASP CLI for npm packages).

[mum-viadee]

I refactored the aggregation of the findings into a separate class and corrected the inconsistent identations.

[mum-viadee]

Hi @markiewiczart any further remarks?

[nfalco79]

@mum-viadee could you fix conflict and squash to a single commit referring to "[JENKINS-58610] Running dependencyCheckPublisher doesn't aggregate reports correctly" ?

[mum-viadee]

@mum-viadee could you fix conflict and squash to a single commit referring to "[JENKINS-58610] Running dependencyCheckPublisher doesn't aggregate reports correctly" ?

That seems to have been resolved. :-)