v2.19.9 Frogbot unable to pull snapshot dependencies

[wilsonjean]

Describe the bug

With the latest version (v2.19.9) of frogbot when scanning maven repositories using github actions, frogbot does not differentiate between snapshot and release repos. When using an older version (v2.19.1), that behavior is still there.
This results in snapshots not being resolvable with the latest version of frogbot.

Current behavior

Output from v2.19.1

 19:17:13 [Info] Running SCA scan for maven vulnerable dependencies in /tmp/jfrog.cli.temp.-1707333432-3372566281/comp-operations-bus directory...
  19:17:13 [Info] Calculating Maven dependencies...
  19:17:13 [Info] The build-info-extractor jar is not cached locally. Downloading it now...
  You can set the repository from which this jar is downloaded.
  Read more about it at https://jfrog.com/help/r/jfrog-cli/downloading-the-maven-and-gradle-extractor-jars
  19:17:13 [Info] Downloading JFrog's Dependency from https://releases.jfrog.io/artifactory/oss-release-local/org/jfrog/buildinfo/build-info-extractor-maven3/2.41.7/build-info-extractor-maven3-2.41.7-uber.jar
  19:17:14 [Info] Running Mvn...
  19:17:14 [Info] Running mvn command: /opt/java/openjdk/bin/java -classpath /opt/maven/apache-maven-3.6.3/boot/plexus-classworlds-2.6.0.jar -Dmaven.home=/opt/maven/apache-maven-3.6.3 -DbuildInfoConfig.propertiesFile=/tmp/jfrog/properties/extractorProperties2838557318 -Dm3plugin.lib=/tmp/jfrog.cli.temp.-1707333432-2793619834/dependencies/maven/2.41.7 -Dclassworlds.conf=/tmp/jfrog.cli.temp.-1707333432-2793619834/dependencies/maven/2.41.7/classworlds.conf -Dmaven.multiModuleProjectDirectory=/tmp/jfrog.cli.temp.-1707333432-3372566281/comp-operations-bus -DbuildInfoConfig.artifactoryResolutionEnabled=true org.codehaus.plexus.classworlds.launcher.Launcher -B compile test-compile -Dcheckstyle.skip -Denforcer.skip
  [main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Scanning for projects...
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloading from artifactory-release: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-starter-parent/2.2.5.RELEASE/spring-boot-starter-parent-2.2.5.RELEASE.pom
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloaded from artifactory-release: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-starter-parent/2.2.5.RELEASE/spring-boot-starter-parent-2.2.5.RELEASE.pom (8.1 kB at 18 kB/s)
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloading from artifactory-release: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.2.5.RELEASE/spring-boot-dependencies-2.2.5.RELEASE.pom
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloaded from artifactory-release: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.2.5.RELEASE/spring-boot-dependencies-2.2.5.RELEASE.pom (127 kB at 1.3 MB/s)
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloading from artifactory-snapshot: https://artifactory/artifactory/comp-maven/ca/company/comp-core-bus-bom/2024.06-SNAPSHOT/maven-metadata.xml
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloaded from artifactory-snapshot: https://artifactory/artifactory/comp-maven/ca/company/comp-core-bus-bom/2024.06-SNAPSHOT/maven-metadata.xml (611 B at 2.2 kB/s)
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloading from artifactory-snapshot: https://artifactory/artifactory/comp-maven/ca/company/comp-core-bus-bom/2024.06-SNAPSHOT/comp-core-bus-bom-2024.06-20240207.181752-8.pom
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloaded from artifactory-snapshot: https://artifactory/artifactory/comp-maven/ca/company/comp-core-bus-bom/2024.06-SNAPSHOT/comp-core-bus-bom-2024.06-20240207.181752-8.pom (1.3 kB at 9.9 kB/s)

Output from v2.19.9

   20:19:17 [Info] Extracted repository successfully
  20:19:17 [Info] Scanning source branch...
  20:19:17 [Info] Preforming 1 SCA scans:
  [
    {
      "Technology": "maven",
      "WorkingDirectory": "/tmp/jfrog.cli.temp.-1706905156-2898861125/comp-operations-bus",
      "Descriptors": [
        "/tmp/jfrog.cli.temp.-1706905156-2898861125/comp-operations-bus/pom.xml"
      ]
    }
  ]
  20:19:17 [Info] Running SCA scan for maven vulnerable dependencies in /tmp/jfrog.cli.temp.-1706905156-2898861125/comp-operations-bus directory...
  20:19:17 [Info] Calculating Maven dependencies...
  20:19:21 [Info] [INFO] Scanning for projects...
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-starter-parent/2.2.5.RELEASE/spring-boot-starter-parent-2.2.5.RELEASE.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-starter-parent/2.2.5.RELEASE/spring-boot-starter-parent-2.2.5.RELEASE.pom (8.1 kB at 27 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.2.5.RELEASE/spring-boot-dependencies-2.2.5.RELEASE.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.2.5.RELEASE/spring-boot-dependencies-2.2.5.RELEASE.pom (127 kB at 2.7 MB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/jackson/jackson-bom/2.13.5/jackson-bom-2.13.5.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/jackson/jackson-bom/2.13.5/jackson-bom-2.13.5.pom (17 kB at 671 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/jackson/jackson-parent/2.13/jackson-parent-2.13.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/jackson/jackson-parent/2.13/jackson-parent-2.13.pom (7.3 kB at 330 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/oss-parent/43/oss-parent-43.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/oss-parent/43/oss-parent-43.pom (24 kB at 1.1 MB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/rest-assured/rest-assured-bom/5.3.2/rest-assured-bom-5.3.2.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/rest-assured/rest-assured-bom/5.3.2/rest-assured-bom-5.3.2.pom (4.3 kB at 203 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/apache/logging/log4j/log4j-bom/2.17.2/log4j-bom-2.17.2.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/apache/logging/log4j/log4j-bom/2.17.2/log4j-bom-2.17.2.pom (8.1 kB at 386 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/apache/logging/logging-parent/5/logging-parent-5.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/apache/logging/logging-parent/5/logging-parent-5.pom (3.3 kB at 126 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/apache/apache/24/apache-24.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/apache/apache/24/apache-24.pom (20 kB at 933 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/spring-framework-bom/5.3.29/spring-framework-bom-5.3.29.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/spring-framework-bom/5.3.29/spring-framework-bom-5.3.29.pom (5.7 kB at 269 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.7.15/spring-boot-dependencies-2.7.15.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.7.15/spring-boot-dependencies-2.7.15.pom (110 kB at 3.9 MB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/datastax/oss/java-driver-bom/4.14.1/java-driver-bom-4.14.1.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/datastax/oss/java-driver-bom/4.14.1/java-driver-bom-4.14.1.pom (4.1 kB at 180 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/dropwizard/metrics/metrics-bom/4.2.19/metrics-bom-4.2.19.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/dropwizard/metrics/metrics-bom/4.2.19/metrics-bom-4.2.19.pom (7.5 kB at 343 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/dropwizard/metrics/metrics-parent/4.2.19/metrics-parent-4.2.19.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/dropwizard/metrics/metrics-parent/4.2.19/metrics-parent-4.2.19.pom (20 kB at 964 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/codehaus/groovy/groovy-bom/3.0.19/groovy-bom-3.0.19.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/codehaus/groovy/groovy-bom/3.0.19/groovy-bom-3.0.19.pom (26 kB at 1.3 MB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/infinispan/infinispan-bom/13.0.18.Final/infinispan-bom-13.0.18.Final.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/infinispan/infinispan-bom/13.0.18.Final/infinispan-bom-13.0.18.Final.pom (18 kB at 869 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/infinispan/infinispan-build-configuration-parent/13.0.18.Final/infinispan-build-configuration-parent-13.0.18.Final.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/infinispan/infinispan-build-configuration-parent/13.0.18.Final/infinispan-build-configuration-parent-13.0.18.Final.pom (16 kB at 753 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/jboss/jboss-parent/36/jboss-parent-36.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/jboss/jboss-parent/36/jboss-parent-36.pom (67 kB at 3.2 MB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/glassfish/jersey/jersey-bom/2.35/jersey-bom-2.35.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/glassfish/jersey/jersey-bom/2.35/jersey-bom-2.35.pom (19 kB at 878 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/eclipse/ee4j/project/1.0.6/project-1.0.6.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/eclipse/ee4j/project/1.0.6/project-1.0.6.pom (13 kB at 741 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/eclipse/jetty/jetty-bom/9.4.51.v20230217/jetty-bom-9.4.51.v20230217.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/eclipse/jetty/jetty-bom/9.4.51.v20230217/jetty-bom-9.4.51.v20230217.pom (18 kB at 883 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/junit/junit-bom/5.8.2/junit-bom-5.8.2.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/junit/junit-bom/5.8.2/junit-bom-5.8.2.pom (5.6 kB at 313 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/jetbrains/kotlin/kotlin-bom/1.6.21/kotlin-bom-1.6.21.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/jetbrains/kotlin/kotlin-bom/1.6.21/kotlin-bom-1.6.21.pom (9.3 kB at 389 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/jetbrains/kotlinx/kotlinx-coroutines-bom/1.6.4/kotlinx-coroutines-bom-1.6.4.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/jetbrains/kotlinx/kotlinx-coroutines-bom/1.6.4/kotlinx-coroutines-bom-1.6.4.pom (4.3 kB at 195 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/micrometer/micrometer-bom/1.9.14/micrometer-bom-1.9.14.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/micrometer/micrometer-bom/1.9.14/micrometer-bom-1.9.14.pom (7.1 kB at 173 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/mockito/mockito-bom/4.5.1/mockito-bom-4.5.1.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/mockito/mockito-bom/4.5.1/mockito-bom-4.5.1.pom (3.0 kB at 142 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/netty/netty-bom/4.1.97.Final/netty-bom-4.1.97.Final.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/netty/netty-bom/4.1.97.Final/netty-bom-4.1.97.Final.pom (13 kB at 510 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/sonatype/oss/oss-parent/7/oss-parent-7.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/sonatype/oss/oss-parent/7/oss-parent-7.pom (4.6 kB at 272 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/squareup/okhttp3/okhttp-bom/4.9.3/okhttp-bom-4.9.3.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/squareup/okhttp3/okhttp-bom/4.9.3/okhttp-bom-4.9.3.pom (3.0 kB at 160 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/oracle/database/jdbc/ojdbc-bom/21.5.0.0/ojdbc-bom-21.5.0.0.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/oracle/database/jdbc/ojdbc-bom/21.5.0.0/ojdbc-bom-21.5.0.0.pom (13 kB at 632 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/prometheus/simpleclient_bom/0.15.0/simpleclient_bom-0.15.0.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/prometheus/simpleclient_bom/0.15.0/simpleclient_bom-0.15.0.pom (5.8 kB at 263 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/prometheus/parent/0.15.0/parent-0.15.0.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/prometheus/parent/0.15.0/parent-0.15.0.pom (12 kB at 638 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/querydsl/querydsl-bom/5.0.0/querydsl-bom-5.0.0.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/querydsl/querydsl-bom/5.0.0/querydsl-bom-5.0.0.pom (7.2 kB at 398 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/r2dbc/r2dbc-bom/Borca-SR2/r2dbc-bom-Borca-SR2.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/r2dbc/r2dbc-bom/Borca-SR2/r2dbc-bom-Borca-SR2.pom (3.8 kB at 167 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/projectreactor/reactor-bom/2020.0.35/reactor-bom-2020.0.35.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/projectreactor/reactor-bom/2020.0.35/reactor-bom-2020.0.35.pom (4.6 kB at 209 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/rest-assured/rest-assured-bom/4.5.1/rest-assured-bom-4.5.1.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/rest-assured/rest-assured-bom/4.5.1/rest-assured-bom-4.5.1.pom (5.8 kB at 291 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/rsocket/rsocket-bom/1.1.3/rsocket-bom-1.1.3.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/rsocket/rsocket-bom/1.1.3/rsocket-bom-1.1.3.pom (2.6 kB at 132 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/data/spring-data-bom/2021.2.15/spring-data-bom-2021.2.15.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/data/spring-data-bom/2021.2.15/spring-data-bom-2021.2.15.pom (5.7 kB at 317 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/integration/spring-integration-bom/5.5.18/spring-integration-bom-5.5.18.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/integration/spring-integration-bom/5.5.18/spring-integration-bom-5.5.18.pom (9.2 kB at 459 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/security/spring-security-bom/5.7.10/spring-security-bom-5.7.10.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/security/spring-security-bom/5.7.10/spring-security-bom-5.7.10.pom (5.7 kB at 272 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/session/spring-session-bom/2021.2.2/spring-session-bom-2021.2.2.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/session/spring-session-bom/2021.2.2/spring-session-bom-2021.2.2.pom (3.1 kB at 119 kB/s)
  Error: ] Some problems were encountered while processing the POMs:
  Error:  Non-resolvable import POM: The following artifacts could not be resolved: ca.company:comp-core-bus-bom:pom:2024.06-SNAPSHOT (absent): Could not find artifact ca.company:comp-core-bus-bom:pom:2024.06-SNAPSHOT @ line 170, column 16
   @ 
  Error:  The build could not read 1 project -> [Help 1]
  Error:    
  Error:    The project ca.company:comp-operations-bus:2024.06-SNAPSHOT (/tmp/jfrog.cli.temp.-1706905156-2898861125/comp-operations-bus/pom.xml) has 1 error
  Error:      Non-resolvable import POM: The following artifacts could not be resolved: ca.company:comp-core-bus-bom:pom:2024.06-SNAPSHOT (absent): Could not find artifact ca.company:comp-core-bus-bom:pom:2024.06-SNAPSHOT @ line 170, column 16 -> [Help 2]

Reproduction steps

No response

Expected behavior

No response

JFrog Frogbot version

v2.19.9

Package manager info

maven pom.xml

Git provider

GitHub

JFrog Frogbot configuration yaml file

No response

Operating system type and version

ubuntu-latest

JFrog Xray version

No response

[eranturgeman]

Hello @wilsonjean and thank you for using Frogbot!
Can you please provide more details about the issue? in the title you described one problem and in the description it seems like another issue. Can you elaborate what exactly is not working and what do you expect to happen?

[wilsonjean]

In v2.19.1, you can see that there is a distinction between the snapshot and releases repos from which frogbot pulls dependencies from. In this case the virtual repo "comp-maven" contains both snapshots and releases.
In v2.19.9 you can see that jfrog does not differentiate between snapshots or releases and cannot pull snapshots from "comp-maven". It is only able to resolve releases.