Skip to content

Fail for gradle dependencies that failed to be resolved

Craig Andrews requested to merge candrews/gemnasium:grail-fail-on-resolvable-failed into master
  • Please check this box if this contribution uses AI-generated content (including content generated by GitLab Duo features) as outlined in the GitLab DCO & CLA

What does this MR do?

In earlier versions of Gemnasium, the analyzer would return a non-zero exit status whenever it encountered a dependency that could not be resolved. This behavior was crucial for ensuring that any unresolved dependencies were immediately flagged, preventing potential issues from slipping through the cracks.

However, with the transition to Gemnasium 5 and the adoption of the htmlDependencyReport format, this behavior was unintentionally changed. As a result, unresolved dependencies were no longer causing the analyzer to fail, which could lead to undetected issues in the dependency management process.

This merge request aims to reintroduce the original behavior. By interpreting the resolvable status in the JSON of the htmlDependencyReport, the analyzer will now output any dependencies that failed to resolve to the job log. Consequently, the analyzer will again return a non-zero exit status if it encounters any unresolved dependencies.

What are the relevant issue numbers?

Dependency Scanning's gemnasium-maven 5 regress... (gitlab-org/gitlab#467050) • Philip Cunningham • 17.2

Does this MR meet the acceptance criteria?

Edited by Philip Cunningham

Merge request reports