The Atlassian Community Forums are currently in read-only mode. We will be relaunching on a new platform on September 22 (read more here). We apologize for the extended downtime. For concerns or questions, please email communitymanagers@atlassian.com. See you on the other side, on the new Atlassian Community Forums! :)

×

Forums

Articles
Create
cancel
Showing results for 
Search instead for 
Did you mean: 

atlassian/bitbucket-dependency-scanner does not generate CodeInsights report when it fails

Roberto Schiavone
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
February 10, 2025

I've recently migrated from Snyk Scan pipe to Bitbucket Dependency Scanner, but I'm running into an issue.

I'm using

script:
  - pipe: atlassian/bitbucket-dependency-scanner:0.5.0
    variables:
      NVD_API_KEY: $NVD_API_KEY
      EXTRA_ARGS:
        - "--failOnCVSS=7"

and I expect for it to generate a CodeInsights report when it fails, just like Snyk Scan does, but Bitbucket Dependency Scanner doesn't.

It generates a report only if it succeeds, but I want the pipeline to fail in case a vulnerability needs to be addressed.

Can the code for the pipe be changed to something like

...

try
:
process = subprocess.run(
scan_command,
check=True,
text=True,
encoding='utf-8',
capture_output=True
)
except subprocess.CalledProcessError as e:
if e.returncode != 0:
if self.should_create_report:
self.log_info('Generating CodeInsights reports...')
self.create_code_insights_report()

self.fail(message=f'Dependency scan failed. The result status code: {e.returncode}, {e.output} {e.stderr}')

self.log_warning(f' detect result status code: {e.returncode}, {e.output} {e.stderr}')
else:
self.log_info(process.stdout)

if self.should_create_report:
self.log_info('Generating CodeInsights reports...')
self.create_code_insights_report()

...

instead of the current version below?

...

try
:
process = subprocess.run(
scan_command,
check=True,
text=True,
encoding='utf-8',
capture_output=True
)
except subprocess.CalledProcessError as e:
if e.returncode != 0:
self.fail(message=f'Dependency scan failed. The result status code: {e.returncode}, {e.output} {e.stderr}')

self.log_warning(f' detect result status code: {e.returncode}, {e.output} {e.stderr}')
else:
self.log_info(process.stdout)

if self.should_create_report:
self.log_info('Generating CodeInsights reports...')
self.create_code_insights_report()

...

 
I'd open a PR myself to discuss it if it were possible.

2 answers

1 accepted

Comments for this post are closed

Community moderators have prevented the ability to post new answers.

2 votes
Answer accepted
Patrik S
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
February 12, 2025

Hello @Roberto Schiavone ,

and welcome to the Community!

Thank you very much for the feedback.

I've shared this with the pipe's development team and they have created an internal feature request to implement this functionality.

While this is not available in the official pipe, you have the option to fork the pipe and make your own adjustments/modifications for your use case.

Thank you, @Roberto Schiavone !

Patrik S 

 

1 vote
Oleksandr Kyrdan
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 25, 2025

Hi @Roberto Schiavone 

Thank you for your feedback!

The new pipe's version with support levels of cvss is released:

  - pipe: atlassian/bitbucket-dependency-scanner:0.7.0
    variables:
      NVD_API_KEY: $NVD_API_KEY
      EXTRA_ARGS:
        - "--failOnCVSS=7"


Best regards,
Oleksandr Kyrdan

Roberto Schiavone
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
March 25, 2025

Awesome, thanks!

DEPLOYMENT TYPE
CLOUD
PRODUCT PLAN
STANDARD
TAGS
AUG Leaders

Atlassian Community Events