How do you solve this error/warning in my SAST scan? My YAML has these lines:
image: maven:3.8.3-openjdk-17
stages:
- test
sast:
stage: test
include:
- template: Security/SAST.gitlab-ci.yml
There is Java 17 maven project there.
gemnasium-maven-dependency_scanning job shows:
Running with gitlab-runner 17.7.0~pre.103.g896916a8 (896916a8)
on green-1.saas-linux-small-amd64.runners-manager.gitlab.com/default JLgUopmM, system ID: s_deaa2ca09de7
Resolving secrets
Preparing the "docker+machine" executor
00:39
Using Docker executor with image registry.gitlab.com/security-products/gemnasium-maven:5 ...
Authenticating with credentials from job payload (GitLab Registry)
Pulling docker image registry.gitlab.com/security-products/gemnasium-maven:5 ...
Using docker image sha256:f93153d3e024f084ab6191960617f49d3dcb1459e9ca819d5d204ca5af081652 for registry.gitlab.com/security-products/gemnasium-maven:5 with digest registry.gitlab.com/security-products/gemnasium-maven@sha256:0bb4ba857e6b52d042fd439060af095d8c84bfeb31c254454b710c48bd662845 ...
Preparing environment
00:05
Running on runner-jlguopmm-project-67471144-concurrent-0 via runner-jlguopmm-s-l-s-amd64-1740676480-d9847c3f...
Getting source from Git repository
00:02
Fetching changes with git depth set to 20...
Initialized empty Git repository in /builds/srs/POC/appfoliokafka/.git/
Created fresh repository.
Checking out a4f11b86 as detached HEAD (ref is develop)...
Skipping Git submodules setup
$ git remote set-url origin "${CI_REPOSITORY_URL}"
Executing "step_script" stage of the job script
00:00
Using docker image sha256:f93153d3e024f084ab6191960617f49d3dcb1459e9ca819d5d204ca5af081652 for registry.gitlab.com/security-products/gemnasium-maven:5 with digest registry.gitlab.com/security-products/gemnasium-maven@sha256:0bb4ba857e6b52d042fd439060af095d8c84bfeb31c254454b710c48bd662845 ...
$ chmod +x gradlew
chmod: cannot access 'gradlew': No such file or directory
Uploading artifacts for failed job
00:01
Uploading artifacts...
WARNING: **/gl-sbom-*.cdx.json: no matching files. Ensure that the artifact path is relative to the working directory (/builds/srs/POC/appfoliokafka)
ERROR: No files to upload
Uploading artifacts...
WARNING: gl-dependency-scanning-report.json: no matching files. Ensure that the artifact path is relative to the working directory (/builds/srs/POC/appfoliokafka)
ERROR: No files to upload
Cleaning up project directory and file based variables
00:01
ERROR: Job failed: exit code 1
Why does it try to do something with gradle? I dont use it. The image says maven, not gradle. I use POM.xml maven file in my project.