### Deprecation Summary The SpotBugs [SAST analyzer](https://docs.gitlab.com/ee/user/application_security/sast/index.html#supported-languages-and-frameworks) can perform a build when the artifacts to be scanned aren't present. While this usually works well for simple projects, it can fail on more complex builds. From GitLab 18.0, to resolve SpotBugs analyzer build failures, you should: 1. [Pre-compile](https://docs.gitlab.com/ee/user/application_security/sast/#pre-compilation) the project. 1. Pass the artifacts you want to scan to the analyzer. _Note:_ This is not a change to any currently-provided functionality. #### Documentation - Deprecation notice: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/178678+ - Migration guidelines: n/a #### Product Usage Fully supporting builds creates the following challenges: - Support burden. Build failures can happen for a multitude of reasons. Each support request needs to be investigated in detail, typically with several cycles of messages between users, support, and engineering. - JDK versions. We can only support a limited number of JDK versions. If a user build requires a version that we don't support, they are already not covered. - Increased CI minutes usage. Users typically run their own build to produce the artifacts that are released. Additional CI minutes are utilized when the Spotbugs analyzer needs to repeat the build process as part of the scan. - Non-deterministic results. The artifacts produced by separate build jobs may be different, and so can the report from Spotbugs. This means that the report could contain results that don't correspond to the artifacts used in production. ### Breaking Change? No. Building the artifacts as part of scanning still happens when necessary. What is changing is the recommendation on how to address failures in this build. ### Affected Customers - [x] GitLab.com - [x] Self-managed - [x] Dedicated ### Deprecation Milestone %"17.9" ### Planned Removal Milestone %"18.0" ### Links ### Checklists #### Timeline ##### Rollout Plan **DRIs:** - Engineers: `@engineer(s)` - Engineering Manager: @thiagocsf - [ ] Determine how to migrate users still using the existing functionality - [ ] Document ways to migrate with the tooling available - [ ] Automate any users who have not yet migrated, but ensure it's a two-way door decision ##### Communication Plan **DRIs:** - Product Manager: @connorgilbert _Add links to the relevant merge requests._ - As soon as possible, but no later than the third milestone preceding the major release (for example, given the following release schedule: `17.8, 17.9, 17.10, 17.11, 18.0` – `17.9` is the third milestone preceding the major release): - [x] A [deprecation announcement entry](https://about.gitlab.com/handbook/marketing/blog/release-posts/#creating-the-announcement) has been created so the deprecation will appear in release posts and on the [general deprecation page](https://docs.gitlab.com/ee/update/deprecations). - [ ] Documentation has been updated to mark the feature as [deprecated](https://docs.gitlab.com/ee/development/documentation/versions.html#deprecations-and-removals). - On the major milestone: - [ ] The deprecated item has been removed. - [ ] If the removal of the deprecated item is a [breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change), the merge request is labeled ~"breaking change". - [x] Document the migration plan for users, clearly outlining the actions they need to take to mitigate the impact of the breaking change. - [x] [Add link](https://docs.gitlab.com/ee/user/application_security/sast/troubleshooting.html#project-couldnt-be-built) #### Development **DRIs:** - Engineers: `@engineer(s)` - Engineering Manager: `@EM` #### Approvals - [x] Product Manager @connorgilbert - [x] Engineering Manager @thiagocsf - [ ] Senior Engineering Manager / Director @twoodham - [ ] Group / Director of Product Management @sarahwaldner #### Mentions (as applicable) - [x] Product Designer: None - [x] Tech Writer @rdickenson / @phillipwells - [ ] Software Engineering in Test @willmeek - [ ] Any other stable counterparts based on the [product categories](https://handbook.gitlab.com/handbook/product/categories/): - [ ] Add Sales/CS counterpart or mention `@timtams` - [ ] Add Support counterpart or mention `@gitlab-com/support/managers` - [ ] Add Marketing counterpart or mention `@cfoster3` #### Labels <!-- Populate the Section, Group, and Category --> - [x] This issue is labeled ~deprecation, and with the relevant `~devops::`, `~group::`, and `~Category:` labels. - [x] This issue is labeled ~"breaking change" if the removal of the deprecated item will be a [breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change). - _It's not a breaking change._ <!-- Label reminders - you should have one of each of the following labels. Use the following resources to find the appropriate labels: - https://gitlab.com/gitlab-org/gitlab/-/labels - https://about.gitlab.com/handbook/product/categories/features/ --> <!-- Identifies that this Issue is related to deprecating a feature --> ### References - [Deprecations, removals, and breaking changes](https://handbook.gitlab.com/handbook/marketing/blog/release-posts/#deprecations-removals-and-breaking-changes) - [Deprecation guidelines](https://docs.gitlab.com/ee/development/deprecation_guidelines/) - [Deprecations and removals doc styleguide](https://docs.gitlab.com/ee/development/documentation/styleguide/deprecations_and_removals) - [REST API Deprecations](https://docs.gitlab.com/ee/development/documentation/restful_api_styleguide.html#deprecations) and [REST API breaking changes](https://docs.gitlab.com/ee/development/api_styleguide.html#breaking-changes). - [GraphQL Deprecations](https://docs.gitlab.com/ee/development/api_graphql_styleguide.html#deprecating-schema-items) and [GraphQL API breaking changes](https://docs.gitlab.com/ee/development/api_graphql_styleguide.html#breaking-changes). - [GitLab release and maintenance policy](https://docs.gitlab.com/ee/policy/maintenance.html) - Videos 📺 - [How to deprecate and remove features in GitLab releases](https://youtu.be/9gy7tg94j7s) - [Review of GitLab deprecations and removals policy & Runner team deprecations and removals process](https://youtu.be/ehT1xBajCRI)