Answers: <p>All you need to do is to configure the mvn dependency plugin to fail on found vulnerabilities.</p>
  <p>You can do that with the <code>failBuildOnCVSS</code> config flag. E.g. with severity 8 from <a href="https://jeremylong.github.io/DependencyCheck/dependency-check-maven/index.html" rel="nofollow noreferrer">docs</a></p>
  <pre><code>&lt;project&gt;
      ...
      &lt;build&gt;
          ...
          &lt;plugins&gt;
              ...
              &lt;plugin&gt;
                &lt;groupId&gt;org.owasp&lt;/groupId&gt;
                &lt;artifactId&gt;dependency-check-maven&lt;/artifactId&gt;
                &lt;version&gt;6.2.2&lt;/version&gt;
                &lt;configuration&gt;
                    &lt;failBuildOnCVSS&gt;8&lt;/failBuildOnCVSS&gt;
                &lt;/configuration&gt;
                &lt;executions&gt;
                    &lt;execution&gt;
                        &lt;goals&gt;
                            &lt;goal&gt;check&lt;/goal&gt;
                        &lt;/goals&gt;
                    &lt;/execution&gt;
                &lt;/executions&gt;
              &lt;/plugin&gt;
              ...
          &lt;/plugins&gt;
          ...
      &lt;/build&gt;
      ...
  &lt;/project&gt;
  </code></pre>
  <p>By that the mvn job will fail if vulnerabilities with severity of 8 or higher are found and by that the pipeline will fail too.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-08-22T16:00:28.430Z
Answers: 2021-08-22T16:23:31.893Z
Answers: 2021-08-22T16:23:31.893Z
Answers: Chris
Body: <p>I am currently using dependency checker to scan my applications via gitlab</p>
  <p>This is how my pipeline looks like.</p>
  <pre><code>dependency_scanning:
    stage: security_scan
    script:
      # Run dependency check on all modules
      - mvn dependency-check:aggregate -B &quot;-DdbUser=$NVD_DB_USER&quot; &quot;-DdbPassword=$NVD_DB_PASSWORD&quot; &quot;-DconnectionString=$NVD_DB_CONSTRING&quot;
    artifacts:
      paths:
        - ./target/dependency-check-report.html
    only:
      - master
  </code></pre>
  <p>And this is my output.</p>
  <pre><code>Executing &quot;step_script&quot; stage of the job script
  00:32
  $ mvn dependency-check:aggregate -B &quot;-DdbUser=$NVD_DB_USER&quot; &quot;-DdbPassword=$NVD_DB_PASSWORD&quot; &quot;-DconnectionString=$NVD_DB_CONSTRING&quot;
  3304 [INFO] Scanning for projects...
  4813 [INFO] 
  4813 [INFO] --------------------&lt; com.example:pipeline-tester &gt;---------------------
  4814 [INFO] Building demo 0.0.1-SNAPSHOT
  4814 [INFO] --------------------------------[ jar ]---------------------------------
  6018 [INFO] 
  6019 [INFO] --- dependency-check-maven:6.2.2:aggregate (default-cli) @ pipeline-tester ---
  12434 [INFO] Checking for updates
  12494 [INFO] Skipping NVD check since last check was within 4 hours.
  12497 [INFO] Skipping RetireJS update since last update was within 24 hours.
  12499 [INFO] Check for updates complete (64 ms)
  12577 [INFO] 
  Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
     About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
     False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
   Sponsor: https://github.com/sponsors/jeremylong
  12579 [INFO] Analysis Started
  14108 [INFO] Finished Archive Analyzer (1 seconds)
  14113 [INFO] Finished File Name Analyzer (0 seconds)
  16312 [INFO] Finished Jar Analyzer (2 seconds)
  16401 [INFO] Finished Dependency Merging Analyzer (0 seconds)
  16405 [INFO] Finished Version Filter Analyzer (0 seconds)
  16811 [INFO] Finished Hint Analyzer (0 seconds)
  22504 [INFO] Created CPE Index (5 seconds)
  28005 [INFO] Finished CPE Analyzer (11 seconds)
  28010 [INFO] Finished False Positive Analyzer (0 seconds)
  28609 [INFO] Finished NVD CVE Analyzer (0 seconds)
  29109 [INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
  29522 [INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
  29606 [INFO] Finished Dependency Bundling Analyzer (0 seconds)
  29908 [INFO] Analysis Complete (17 seconds)
  30206 [INFO] Writing report to: /builds/cdit/pipeline-tester/target/dependency-check-report.html
  31205 [WARNING] 
  One or more dependencies were identified with known vulnerabilities in demo:
  tomcat-embed-core-9.0.46.jar (pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46, cpe:2.3:a:apache:tomcat:9.0.46:*:*:*:*:*:*:*, cpe:2.3:a:apache_software_foundation:tomcat:9.0.46:*:*:*:*:*:*:*, cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.46:*:*:*:*:*:*:*) : CVE-2021-33037
  See the dependency-check report for more details.
  31513 [INFO] ------------------------------------------------------------------------
  31514 [INFO] BUILD SUCCESS
  31514 [INFO] ------------------------------------------------------------------------
  31514 [INFO] Total time:  28.305 s
  31514 [INFO] Finished at: 2021-08-12T07:20:28Z
  31514 [INFO] ------------------------------------------------------------------------
  Saving cache for successful job
  00:01
  Creating cache master...
  .m2/repository: found 3366 matching files and directories 
  Archive is up to date!                             
  Created cache
  Uploading artifacts for successful job
  00:00
  Uploading artifacts...
  ./target/dependency-check-report.html: found 1 matching files and directories 
  Uploading artifacts as &quot;archive&quot; to coordinator... ok  id=335682 responseStatus=201 Created token=Bf8rx3gp
  Cleaning up file based variables
  00:00
  Job succeeded
  </code></pre>
  <p>Is it possible to make my pipeline fail even though it is success, in this case when vulnerabilities are present?</p>
  
Comments: CC BY-SA 4.0
Comments: 2021-08-20T12:50:36.637Z
Comments: A a very general tip, `exit 1` (or any non 0 rc) anywhere in you pipeline should fail it. So you could detect what comes back from your previous command and exit with error when need be. Meanwhile, I'm not very familiar with the maven dependency-check plugin, but I'm quite sure you have a configuration option or a specific way to call it that will let it exit with an error code itself if a vulnerability is found.
Comments: Zeitounator
Tags: <gitlab><cicd><pipeline>
Title: How do I fail a gitlab pipeline job?
UserDisplayName: shadow
ThreadText: # How do I fail a gitlab pipeline job?
  
  (Asked by: username_0 on 2021-08-12)
  
  I am currently using dependency checker to scan my applications via gitlab
  
  This is how my pipeline looks like.
  
  ```
  dependency_scanning:
    stage: security_scan
    script:
      # Run dependency check on all modules
      - mvn dependency-check:aggregate -B "-DdbUser=$NVD_DB_USER" "-DdbPassword=$NVD_DB_PASSWORD" "-DconnectionString=$NVD_DB_CONSTRING"
    artifacts:
      paths:
        - ./target/dependency-check-report.html
    only:
      - master
  
  ```
  
  And this is my output.
  
  ```
  Executing "step_script" stage of the job script
  00:32
  $ mvn dependency-check:aggregate -B "-DdbUser=$NVD_DB_USER" "-DdbPassword=$NVD_DB_PASSWORD" "-DconnectionString=$NVD_DB_CONSTRING"
  3304 [INFO] Scanning for projects...
  4813 [INFO] 
  4813 [INFO] --------------------< com.example:pipeline-tester >---------------------
  4814 [INFO] Building demo 0.0.1-SNAPSHOT
  4814 [INFO] --------------------------------[ jar ]---------------------------------
  6018 [INFO] 
  6019 [INFO] --- dependency-check-maven:6.2.2:aggregate (default-cli) @ pipeline-tester ---
  12434 [INFO] Checking for updates
  12494 [INFO] Skipping NVD check since last check was within 4 hours.
  12497 [INFO] Skipping RetireJS update since last update was within 24 hours.
  12499 [INFO] Check for updates complete (64 ms)
  12577 [INFO] 
  Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
     About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
     False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
   Sponsor: https://github.com/sponsors/jeremylong
  12579 [INFO] Analysis Started
  14108 [INFO] Finished Archive Analyzer (1 seconds)
  14113 [INFO] Finished File Name Analyzer (0 seconds)
  16312 [INFO] Finished Jar Analyzer (2 seconds)
  16401 [INFO] Finished Dependency Merging Analyzer (0 seconds)
  16405 [INFO] Finished Version Filter Analyzer (0 seconds)
  16811 [INFO] Finished Hint Analyzer (0 seconds)
  22504 [INFO] Created CPE Index (5 seconds)
  28005 [INFO] Finished CPE Analyzer (11 seconds)
  28010 [INFO] Finished False Positive Analyzer (0 seconds)
  28609 [INFO] Finished NVD CVE Analyzer (0 seconds)
  29109 [INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
  29522 [INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
  29606 [INFO] Finished Dependency Bundling Analyzer (0 seconds)
  29908 [INFO] Analysis Complete (17 seconds)
  30206 [INFO] Writing report to: /builds/cdit/pipeline-tester/target/dependency-check-report.html
  31205 [WARNING] 
  One or more dependencies were identified with known vulnerabilities in demo:
  tomcat-embed-core-9.0.46.jar (pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46, cpe:2.3:a:apache:tomcat:9.0.46:*:*:*:*:*:*:*, cpe:2.3:a:apache_software_foundation:tomcat:9.0.46:*:*:*:*:*:*:*, cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.46:*:*:*:*:*:*:*) : CVE-2021-33037
  See the dependency-check report for more details.
  31513 [INFO] ------------------------------------------------------------------------
  31514 [INFO] BUILD SUCCESS
  31514 [INFO] ------------------------------------------------------------------------
  31514 [INFO] Total time:  28.305 s
  31514 [INFO] Finished at: 2021-08-12T07:20:28Z
  31514 [INFO] ------------------------------------------------------------------------
  Saving cache for successful job
  00:01
  Creating cache master...
  .m2/repository: found 3366 matching files and directories 
  Archive is up to date!                             
  Created cache
  Uploading artifacts for successful job
  00:00
  Uploading artifacts...
  ./target/dependency-check-report.html: found 1 matching files and directories 
  Uploading artifacts as "archive" to coordinator... ok  id=335682 responseStatus=201 Created token=Bf8rx3gp
  Cleaning up file based variables
  00:00
  Job succeeded
  
  ```
  
  Is it possible to make my pipeline fail even though it is success, in this case when vulnerabilities are present?
  
  **Tags:** gitlab, cicd, pipeline
  
  > **Comments:**
  > **username_1**: A a very general tip, `exit 1` (or any non 0 rc) anywhere in you pipeline should fail it. So you could detect what comes back from your previous command and exit with error when need be. Meanwhile, I'm not very familiar with the maven dependency-check plugin, but I'm quite sure you have a configuration option or a specific way to call it that will let it exit with an error code itself if a vulnerability is found.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2021-08-22. Score: 2 | Accepted answer
  
  All you need to do is to configure the mvn dependency plugin to fail on found vulnerabilities.
  
  You can do that with the `failBuildOnCVSS` config flag. E.g. with severity 8 from [docs](https://jeremylong.github.io/DependencyCheck/dependency-check-maven/index.html)
  
  ```
  <project>
      ...
      <build>
          ...
          <plugins>
              ...
              <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>6.2.2</version>
                <configuration>
                    <failBuildOnCVSS>8</failBuildOnCVSS>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
              </plugin>
              ...
          </plugins>
          ...
      </build>
      ...
  </project>
  
  ```
  
  By that the mvn job will fail if vulnerabilities with severity of 8 or higher are found and by that the pipeline will fail too.
  
  
  ---
  
  