Multiple Maven Dependency Scanning Jobs Running (-2, -3) in GitLab Pipeline

DevSecOps
, ,
1

Problem to solve

I am experiencing an issue where GitLab is running multiple jobs for Maven dependency scanning (gemnasium-maven-dependency_scanning, gemnasium-maven-dependency-scanning-2, and gemnasium-maven-dependency-scanning-3).

Expected Behavior:

  • The dependency scanning jobs should run once per pipeline execution as defined in .gitlab-ci.yml.
  • The script mvn-create-settings.bash should execute before the analyzer run without issues.

Actual Behavior:

  • Multiple instances of the Maven dependency scanning job (-2, -3, etc.) appear unexpectedly.
  • The gemnasium-maven-dependency-scanning-2 job fails, while gemnasium-maven-dependency_scanning executes successfully.
  • The error log is attached in the file gemnasium-maven-dependency-scanning-2.

Additional Context:

  • The script mvn-create-settings.bash is used to generate an settings.xml file with secrets from GitLab variables for accessing the local Artifactory.
  • Scanning policies are enabled for all branches, triggering scans:
    • On every merge request
    • On merge to main
    • On a scheduled Sunday scan

Question:

  1. Why are multiple jobs being created (-2, -3, etc.)?
  2. How can I ensure only one job executes?
  3. What is the best practice for providing custom setups for handling policy-based security scanning tools?

Steps to reproduce

  1. Enable dependency scanning policies on all branches.

  2. Add the following .gitlab-ci.yml configuration or one that creates local settings dependent to run the job:

    gemnasium-dependency_scanning:
  before_script:
    - source <(curl -s https://gitlab-script.utv.atlas.vegvesen.no/download/mvn-create-settings.bash)

gemnasium-maven-dependency-scanning-2:
  before_script:
    - source <(curl -s https://gitlab-script.utv.atlas.vegvesen.no/download/mvn-create-settings.bash)

gemnasium-maven-dependency_scanning:
  before_script:
    - source <(curl -s https://gitlab-script.utv.atlas.vegvesen.no/download/mvn-create-settings.bash)

  3. Run a pipeline and observe multiple executions of the Maven dependency scanning job.

  4. Check the screensjot for failures in

    Screenshot 2025-02-19 at 17.31.36
    Screenshot 2025-02-19 at 17.31.361920×1181 227 KB

    Screenshot 2025-02-19 at 17.31.43
    Screenshot 2025-02-19 at 17.31.433332×1072 447 KB

Configuration

  • GitLab security feature: Dependency Scanning
  • Custom Script Usage: mvn-create-settings.bash
  • Artifacts Repository: Internal Artifactory for Maven dependencies

Versions

  • Self-managed
  • GitLab.com SaaS
  • Dedicated
  • Self-hosted Runners

GitLab Version: 17.5.4-ee
GitLab Runner Version: 17.5.4

Helpful resources

  1. Check the FAQ for helpful documentation, issues/bugs/feature proposals, and troubleshooting tips.
  2. Before opening a new topic, make sure to search for keywords in the forum search
  3. Check the GitLab and GitLab Runner projects for existing issues. If you encounter a bug, please create a bug report issue.
  4. Review existing troubleshooting docs.

Thanks for taking the time to be thorough in your request, it really helps! :blush: