I want to create a VSTS build with npm package auditing capabilities using npm audit. I added a few tasks to run npm audit. The command runs and I can see the details in the console/logs for all the packages. However, the task fails complaining about not finding a logs file. Any idea on how I can get the builds to stop working if I find a high vulnerability package?
EDIT
This is the final line in the result when I run npm audit locally
Notice how it displays vulnerabilities in categories. I want the build to not proceed if there is a non-zero value for High vulnerability.
I got the same error, but then realize that I am using incorrect custom command for npm task:
it was "npm install gulp -g", but should be "install gulp -g" (without npm).
For me it helps.
There isn’t the way to stop/fail build directly if there is a non-zero value for High vulnerability.
The workaround is that you can do it through PowerShell with Build log REST api to analysis whether there is related information in the log, then fail the build (Write-error …) (Run the powershell through PowerShell task)
Related
Having a weird issue in TeamCity npm steps where we update our internal npm packages. When the build is run it does not run the npm update command even though the log says it executes the command. But running the exact same build again triggers the command correctly (image 2).
Tried having the update command together with the following npm install and build commands in a single step and also as in the example images having them in separate steps but all scenarios give the same result; the update commands don't run every other time but all other npm commands runs correctly and trigger the build again makes the update commands execute. Why?!?!
I am using NPM audit on my Azure Pipeline build using the following custom command
npm audit --registry=https://registry.npmjs.org/ | Select-String -Pattern ( "Critical") -Context 0,10
The idea here is that I only want to fail this step if there are any critical issues picked up by the audit.
Using this command locally within the command line works fine. But running it as a custom npm command in the pipeline still results in the full npm audit running and returning some moderate errors which cause the step to fail.
I feel I'm missing some formatting on the command but I'm not sure what it is.
Does any one else have experience of using NPM audit in a pipeline while successfully supressing certain error severities?
The reason the task is failing is not because of what the task is logging, but because npm audit is exiting with a non-zero code, which means a failure.
I suggest that instead, you add the --audit-level parameter to the npm audit command, to change whether it will finish with failure code or not:
By default, the audit command will exit with a non-zero code if any vulnerability is found. It may be useful in CI environments to include the --audit-level parameter to specify the minimum vulnerability level that will cause the command to fail. This option does not filter the report output, it simply changes the command's failure threshold.
The build is failing with:
"Error: Npm failed with return code: 9009"
When we look at, here's what we noticed:
Till date (where there were no issues), build used to run on nmp 6.9.0 and node v10.16.3
Since the build started failing, we noticed the versions got auto-upgraded to npm/6.12.0 node/v12.13.0.
Please advise how to revert back to older versions, or do if we need to see this issue in a different dimension?
You can use Nojd.js tool installer task to specify the version you want. Then set the Version Spec as below.
You will get the node/v10.16.3 and npm/6.9.0.
You should add this task before the npm task. If not, the default version of node.js and npm would be below.
If your project can build successfully in local, you can use self-hosted agent to build.
Hope this helps.
While attempting to get the Forge Responsive Connected Database to build. I am unable to build this application on my Windows 10 machine. I am unable to succesffuly run “npm install”. I get the following errors as listed below. I ended up trying to use a pre-configured “canvas” and it still didn’t let the node app run.
https://github.com/Autodesk-Forge/forge-rcdb.nodejs
I have tried these solutions to no success:
https://github.com/npm/npm/issues/14543
https://github.com/nodejs/node-gyp#on-windows
https://github.com/Automattic/node-canvas/wiki/Installation---Windows
https://github.com/substack/dnode/issues/181
https://github.com/nodejs/node-gyp/issues/629#issuecomment-153196245
https://www.npmjs.com/package/canvas-prebuilt
> canvas#1.6.10 install D:\DEVELOPMENT\Autodesk\forge-rcdb.nodejs3\node_modules\canvas
> node-gyp rebuild
D:\DEVELOPMENT\Autodesk\forge-rcdb.nodejs3\node_modules\canvas>if not defined npm_config_node_gyp (node "C:\Users\steck\AppData\Roaming\nvm\v7.7.1\node_modules\npm\bin\node-gyp-bin\\..\..\node_modules\node-gyp\bin\node-gyp.js" rebuild ) else (node "node C:\Users\me\AppData\Roaming\npm\node_modules\node-gyp\bin\node-gyp.js" rebuild )
module.js:472
throw err;
^
Error: Cannot find module 'D:\DEVELOPMENT\Autodesk\forge-rcdb.nodejs3\node_modules\canvas\node C:\Users\me\AppData\Roaming\npm\node_modules\node-gyp\bin\node-gyp.js'
at Function.Module._resolveFilename (module.js:470:15)
at Function.Module._load (module.js:418:25)
at Module.runMain (module.js:605:10)
at run (bootstrap_node.js:425:7)
at startup (bootstrap_node.js:146:9)
at bootstrap_node.js:540:3
Here are the full installation and setup steps I tested on two different 2 different computers with Windows10 installed.
Pre-Installations:
Node.js - used v.6.x and v8.x
Node.js global packages:
npm-windows-upgrade(link):
This tool will move and install npm into Windows' spectial folder %appdata%.
Installation steps:
Open Powershell as Administrator and execute Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force.
Install tool by npm install --global --production npm-windows-upgrade
npm-windows-upgrade
Execute cmd npm-windows-upgrade --npm-version 5.6.0 in the Powershell (note. you can choose any version what you want, e.g. 6.0.1)
windows-build-tools(link):
This tool will install build tools required by the package node-gyp.
The installation will take some time to wait for the build tools to be downloaded and installed. If you might see a message Successfully installed Python 2.7 firstly, but you have to wait for the message Successfully installed Visual Studio Build Tools. shows up.
Open Powershell as Administrator and install tool by npm install --global --production windows-build-tools
node-gyp(link):
This tool is required by the package node-canvas while running npm install.
Open Powershell normally(say current user) and install tool by npm install -g node-gyp
Visual Studio 2017 (link):
This might be optional, I just installed it with VS C++ features in my cases.
Chocolatey (link):
This tool will make your life easier to install dependencies for package node-canvas on Windows.
Open Powershell as Administrator and execute Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')).
After installing Chocolatey, install node-canvas dependencies by choco install -y python2 gtk-runtime microsoft-build-tools libjpeg-turbo (You might see a warning message visuallstudiotool-vs2017 installation failed and you can ignore it. In my cases, it didn't affect the result)
GTK with cairo library (link):
This tool the required dependency for package node-canvas.
Installation steps:
Download precompiled X64 GTK package here.
Unzip all contents into C:\GTK.
Mongochef (link):
This tool will make your life easier to restore dummy database of the forge-rcdb.
MongoDB:
You can follow the instructions here to install MongoDB on your compture , or use MongoDB PaaS mlab instead.
Main Installations:
Download source codes of the forge-rcdb and unzip into somewhere you like. In my cases, I put it into my desktop.
Open Powershell normally(say current user) and change directory into the unzipped folder of the source code. For instance, execute cd Desktop\forge-rcdb-nodejs-master in the Powershell.
Run cmd npm install in the root of the source code folder. (You may see some error message while compiling the package node-canvas, but can see 'copied xxx.c', 'copied xxx.cpp', and so on in the same time, then you can ignore the errors. In my cases, it didn't be a problem to run forge-rcdb.)
Configurations:
Open config\development.config.js with your editor and change values of viewer section into:
viewer: {
viewer3D: 'https://developer.api.autodesk.com/derivativeservice/v2/viewers/viewer3D.js?v=4.0.1',
threeJS: 'https://developer.api.autodesk.com/derivativeservice/v2/viewers/three.js?v=4.0.1',
style: 'https://developer.api.autodesk.com/derivativeservice/v2/viewers/style.css?v=4.0.1'
}
Change the database section in the config\development.config.js with you MongoDB connection settings.
Restore dummy database data in the resources/db/dev or resources/db/prod via Mongochef's Import function.
Open Powershell normally(say current user) and set following environment variables:
$env:NODE_ENV="development"
$env:HOT_RELOADING="true"
$env:FORGE_DEV_CLIENT_ID="YOUR_CLINET_ID"
$env:FORGE_DEV_CLIENT_SECRET="YOUR_CLINET_SECRET"
Run the project
Change current directory of the Powershell into the source code folder of the forge-rcdb and type npm start
open http://localhost:3000 in your favorite browser.
Trouble Shooting
You might be not able to load any models in the browser. If you to test the functionality, please copy resources\models\prod\robot into resources\models\dev\robot. Afterward, navigate to http://localhost:3000/configurator in the web browser and mouse-click on Kinematics project, then you will see the model loaded on your screen.
If you see the response of http://localhost:3000/api/forge/user showing HTTP EORROR CODE 404 from the browser dev console, then you must have to check whether the CallBack URL of your Forge App used to host forge-rcdb in Forge Dev Protal is http://localhost:3000/api/forge/callback/oauth. (note. This config can be changed in config\development.config.js)
Afterward, you or your users must have to log into the website with Autodesk account to obtain 3 legged token from the Forge OAuth service to upload models in the gallery page.
If you get an empty array from the response of http://localhost:3000/api/models/configurator?limit=100&offset=0&search=, it means there is nothing in your MongoDB collection configurator.models. To fix this issue, you can import db content resources\db\dev\configurator.models.json into your MongoDB via Mongochef. (note. Please refer the step 3 of the configuration section)
If you cannot load any listed models from the web pages, it means there is not downloaded viewable bubbles in your resources\models\prod or resources\models\dev as well as your Forge OSS bucket. So, please check the urn value in your database whether you have those models in these positions previously mentioned.
If you found the main reason for item 3 of Trouble Shooting is that you didn't own models listed in the forge-rcdb, that's because these models are Autodesk's private models or uploaded by other users themselves before, that might not be shared to the public, unfortunately. To fix this issue, you have to change the example data of MongoDB Collections mentioned in step 3 of the configuration section to your own models.
Hope it helps.
I'm trying to configure team city to run angular 5 application build.
I have powershell step with this script (it's in the build step definition not separate file). npm run build runs ng build
npm install
npm run build
For some reason even if ng build fails team city build won't fail. Status code from npm run is not propagated back to powershell.
See below screen:
TeamCity Fails the build if got a status code != 0 or when got stderr.
You should add Failure Conditions for verifying that the log has an error.
Edit Configuration Settings -> Failure Conditions -> Add failure condition
Select Fail build on specific text in build log
Secelt options Contains and exact text. Set "npm ERR"
in Failure message write "Error was found in build log"
save
Now your build will be FAILED if build log contains this text.
Also, check an error message is logged by build runner