Re-running a security scan job will increase the amount of vulnerabilities shown in the security tab of the pipeline
Summary
We have a customer that reported the following behavior:
When they re-run the dependency scanning job in a pipeline, it will increase the amount of vulnerabilities shown in the Security tab.
Steps to reproduce
- Run a pipeline with a dependency scanning job (should also be the same for other scan).
- Check the number of vulnerability detected in the Security tab.
- Re-run the dependency scanning job.
- Check the number of vulnerabulity detected in the Security tab.
Example Project
-
https://gitlab.com/jdasmarinas_ultimate_group/dependency-scanning/-/pipelines/1608549071/security
- This is a private project, but I can add developers for troubleshooting purposes.
What is the current bug behavior?
The number of vulnerability increases whenever re-running the job.
What is the expected correct behavior?
The number of vulnerability should be the same when we re-run the job.
Relevant logs and/or screenshots
This is the screenshot of the security tab prior to re-running a job:
This is the screenshot after re-running the job:
As you noticed the number of vulnerabilities increased from 420 to 631.
Output of checks
This bug happens on GitLab.com
Results of GitLab environment info
Expand for output related to GitLab environment info
(For installations with omnibus-gitlab package run and paste the output of: `sudo gitlab-rake gitlab:env:info`) (For installations from source run and paste the output of: `sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)
Results of GitLab application Check
Expand for output related to the GitLab application check
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)(we will only investigate if the tests are passing)