Skip to content
This repository was archived by the owner on Apr 22, 2025. It is now read-only.

Commit 0e4098d

Browse files
Disabled scehduled security vulnerability scan (#213)
This is already covered by the scheduled security scans that run against fabric-gateway-java and having it run here just adds maintenance overhead. Signed-off-by: Mark S. Lewis <mark_lewis@uk.ibm.com>
1 parent 94a84d4 commit 0e4098d

File tree

2 files changed

+7
-20
lines changed

2 files changed

+7
-20
lines changed

azure-pipelines.yml

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -46,23 +46,3 @@ stages:
4646
jdkSourceOption: 'PreInstalled'
4747
- script: ./scripts/run-integration-tests.sh
4848
displayName: Run integration tests
49-
50-
# Only run security vulnerability scan on scheduled builds
51-
- stage: Scan
52-
dependsOn: [ ]
53-
condition: eq(variables['Build.Reason'], 'Schedule')
54-
jobs:
55-
- job: ScanDependencies
56-
pool:
57-
vmImage: ubuntu-20.04
58-
dependsOn: [ ]
59-
timeoutInMinutes: 60
60-
steps:
61-
- task: Maven@3
62-
displayName: 'Maven dependency-check'
63-
inputs:
64-
mavenPomFile: 'pom.xml'
65-
goals: '-P owasp dependency-check:check'
66-
- publish: $(System.DefaultWorkingDirectory)/target/dependency-check-report.html
67-
artifact: DependencyCheck
68-
displayName: 'Upload dependency-check report'

dependency-suppressions.xml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,11 @@
1414
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib\-common@1\.4\.0$</packageUrl>
1515
<cve>CVE-2020-15824</cve>
1616
</suppress>
17+
<suppress>
18+
<notes><![CDATA[
19+
Vulnerability is reported against an AWS hotfix, not the Apache log4j package
20+
]]></notes>
21+
<packageUrl regex="true">^pkg:maven/org\.apache\.logging\.log4j/log4j\-.*$</packageUrl>
22+
<cve>CVE-2022-33915</cve>
23+
</suppress>
1724
</suppressions>

0 commit comments

Comments
 (0)