Skip to content

Create Static Reachability failure metrics

Goals

The goal of this issue to capture errors in the Static Reachability Analysis taking place in the DS analyzer. When an error occurs we don't fail the dependency_scanning job. Instead we catch the error, print a warning and continue. We would like to capture those errors in order to understand:

  • How often static reachability fails
  • What is the error that it fails with
  • Is an SBOM enrichment ignored

Non Goals

  • to identify the exact line that it failed. We can actually do that through the error message but the main idea is to have an idea of common patterns

Proposal

{
  "event":"collect_ds_analyzer_scan_sr_failure_metrics_from_pipeline",
  "property: "<SCAN_UUID>",
  "label": "<error_message>",
}
{
"event":"collect_ds_analyzer_scan_sr_sbom_failure_metrics_from_pipeline",
  "property: "<SCAN_UUID>",
  "label": "<warning_message>",
  "language": "<language">,
  "input_file_path": "<input_file_path>" 
}

Implementation plan

  • Add event in registry event
  • Add event in GitLab
  • Capture event in DS analyzer
  • Fix coverage java metrics
  • Verify that the event appears in SnowFlake

/cc @onaaman

Edited by Nick Ilieskou