atlassian/bitbucket-dependency-scanner does not generate CodeInsights report when it fails

[Roberto Schiavone]

I've recently migrated from Snyk Scan pipe to Bitbucket Dependency Scanner, but I'm running into an issue.

I'm using

script:
  - pipe: atlassian/bitbucket-dependency-scanner:0.5.0
    variables:
      NVD_API_KEY: $NVD_API_KEY
      EXTRA_ARGS:
        - "--failOnCVSS=7"

and I expect for it to generate a CodeInsights report when it fails, just like Snyk Scan does, but Bitbucket Dependency Scanner doesn't.

It generates a report only if it succeeds, but I want the pipeline to fail in case a vulnerability needs to be addressed.

Can the code for the pipe be changed to something like

...

try:
    process = subprocess.run(
        scan_command,
        check=True,
        text=True,
        encoding='utf-8',
        capture_output=True
)
except subprocess.CalledProcessError as e:
    if e.returncode != 0:
        if self.should_create_report:
            self.log_info('Generating CodeInsights reports...')
            self.create_code_insights_report()

            self.fail(message=f'Dependency scan failed. The result status code: {e.returncode}, {e.output} {e.stderr}')

        self.log_warning(f' detect result status code: {e.returncode}, {e.output} {e.stderr}')
    else:
        self.log_info(process.stdout)
    
    if self.should_create_report:
        self.log_info('Generating CodeInsights reports...')
        self.create_code_insights_report()

...

instead of the current version below?

...

try:
    process = subprocess.run(
        scan_command,
        check=True,
        text=True,
        encoding='utf-8',
        capture_output=True
)
except subprocess.CalledProcessError as e:
    if e.returncode != 0:
        self.fail(message=f'Dependency scan failed. The result status code: {e.returncode}, {e.output} {e.stderr}')

    self.log_warning(f' detect result status code: {e.returncode}, {e.output} {e.stderr}')
    else:
        self.log_info(process.stdout)
    
    if self.should_create_report:
        self.log_info('Generating CodeInsights reports...')
        self.create_code_insights_report()

...

 
I'd open a PR myself to discuss it if it were possible.

[Patrik S · Accepted solution]

Hello @Roberto Schiavone ,

and welcome to the Community!

Thank you very much for the feedback.

I've shared this with the pipe's development team and they have created an internal feature request to implement this functionality.

While this is not available in the official pipe, you have the option to fork the pipe and make your own adjustments/modifications for your use case.

Thank you, @Roberto Schiavone !

Patrik S 

[Oleksandr Kyrdan]

Hi @Roberto Schiavone 

Thank you for your feedback!

The new pipe's version with support levels of cvss is released:

  - pipe: atlassian/bitbucket-dependency-scanner:0.7.0
    variables:
      NVD_API_KEY: $NVD_API_KEY
      EXTRA_ARGS:
        - "--failOnCVSS=7"

Best regards,
Oleksandr Kyrdan

[Roberto Schiavone]

Awesome, thanks!