frogbot icon indicating copy to clipboard operation
frogbot copied to clipboard

does frogbot download dependencies that are required?

Open esmaila opened this issue 7 months ago • 1 comments

I am running a workflow on a self-hosted Github actions runner, which has very little installed on it (in this example it's maven which hasn't been setup, but I am scanning a mvn artifact).

The logs show as though it is trying to setup mvn:

2023-11-24T14:35:07.4679571Z 14:35:07 [Debug] Detected 1 technologies at /tmp/jfrog.cli.temp.-1700836506-1004639300: [maven]. 2023-11-24T14:35:07.4680366Z 14:35:07 [Info] Preforming 1 SCA scans: 2023-11-24T14:35:07.4680787Z [ 2023-11-24T14:35:07.4681011Z { 2023-11-24T14:35:07.4681258Z "Technology": "maven", 2023-11-24T14:35:07.4682062Z "WorkingDirectory": "/tmp/jfrog.cli.temp.-1700836506-1004639300", 2023-11-24T14:35:07.4682894Z "Descriptors": [ 2023-11-24T14:35:07.4683370Z "/tmp/jfrog.cli.temp.-1700836506-1004639300/pom.xml" 2023-11-24T14:35:07.4683750Z ] 2023-11-24T14:35:07.4683974Z } 2023-11-24T14:35:07.4684190Z ] 2023-11-24T14:35:07.4685049Z 14:35:07 [Info] Running SCA scan for maven vulnerable dependencies in /tmp/jfrog.cli.temp.-1700836506-1004639300 directory... 2023-11-24T14:35:07.4685553Z 14:35:07 [Info] Calculating Maven dependencies... 2023-11-24T14:35:07.4686156Z 14:35:07 [Debug] mvn command goals: [-B compile test-compile -Dcheckstyle.skip -Denforcer.skip] 2023-11-24T14:35:07.4687189Z 14:35:07 [Debug] Saving build general details at: /tmp/jfrog/builds/05fabcd3b9e738c6ef32f943d997abeb941e75ab826c687d87dad3e779aa3f54/partials 2023-11-24T14:35:07.4687753Z 14:35:07 [Debug] JFROG_CLI_RELEASES_REPO is not set 2023-11-24T14:35:07.4688206Z 14:35:07 [Debug] JFROG_CLI_EXTRACTORS_REMOTE is not set 2023-11-24T14:35:07.4688946Z 14:35:07 [Info] The build-info-extractor jar is not cached locally. Downloading it now... 2023-11-24T14:35:07.4689441Z You can set the repository from which this jar is downloaded. 2023-11-24T14:35:07.4690170Z Read more about it at https://jfrog.com/help/r/jfrog-cli/downloading-the-maven-and-gradle-extractor-jars 2023-11-24T14:35:07.4691132Z 14:35:07 [Debug] 'JFROG_CLI_RELEASES_REPO' environment variable is not configured. Downloading directly from releases.jfrog.io. 2023-11-24T14:35:07.4692224Z 14:35:07 [Info] Downloading JFrog's Dependency from https://releases.jfrog.io/artifactory/oss-release-local/org/jfrog/buildinfo/build-info-extractor-maven3/2.41.7/build-info-extractor-maven3-2.41.7-uber.jar 2023-11-24T14:35:07.4693554Z 14:35:07 [Debug] Sending HTTP HEAD request to: https://releases.jfrog.io/artifactory/oss-release-local/org/jfrog/buildinfo/build-info-extractor-maven3/2.41.7/build-info-extractor-maven3-2.41.7-uber.jar 2023-11-24T14:35:07.9166534Z 14:35:07 [Debug] Artifactory response: 200 2023-11-24T14:35:07.9167800Z 14:35:07 [Debug] Sending HTTP GET request to: https://releases.jfrog.io/artifactory/oss-release-local/org/jfrog/buildinfo/build-info-extractor-maven3/2.41.7/build-info-extractor-maven3-2.41.7-uber.jar 2023-11-24T14:35:09.5905476Z 14:35:09 [Debug] Searching for Maven home. 2023-11-24T14:35:09.5984276Z 14:35:09 [Error] audit command in '/tmp/jfrog.cli.temp.-1700836506-1004639300' failed: 2023-11-24T14:35:09.5985375Z failed while building 'maven' dependency tree: 2023-11-24T14:35:09.5985765Z exec: "mvn": executable file not found in $PATH 2023-11-24T14:35:09.5986485Z Hint: The mvn command may not be included in the PATH. Either add it to the path or set the M2_HOME environment variable value to the maven installation directory, which is the directory that includes the bin and lib directories. 2023-11-24T14:35:09.6065104Z ##[error]The process '/opt/hostedtoolcache/frogbot/[RELEASE]/x64/frogbot' failed with exit code 1

therefore I just wanted to confirm if frogbot is expected to do that i.e. detect the technology e.g. mvn, npm or golang and then download any dependencies that are required. Or should these dependencies be available on the runner before the scan e.g. mvn is setup.

esmaila avatar Nov 28 '23 13:11 esmaila