[DO NOT MERGE] - Added config to scan sub directories for Gemfile.lock #3466

nikhil2611 · 2025-12-04T17:05:11Z

Description

Added config to scan sub directories for Gemfile.lock

Related Issue

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

I have read the CONTRIBUTING document.
I have run the pre-merge tests locally and they pass.
I have updated the documentation accordingly.
I have added tests to cover my changes.
If Gemfile.lock has changed, I have used --conservative to do it and included the full output in the Description above.
All new and existing tests passed.
All commits have been signed-off for the Developer Certificate of Origin.

Signed-off-by: nikhil2611 <[email protected]>

…HEF-28158-NOTICE-generation

Signed-off-by: nikhil2611 <[email protected]>

netlify · 2025-12-04T17:05:18Z

👷 Deploy Preview for chef-workstation processing.

Name	Link
🔨 Latest commit	`70740f7`
🔍 Latest deploy log	https://app.netlify.com/projects/chef-workstation/deploys/6931cb3469b6300008958eea

Copilot

Pull request overview

This PR modifies the CI/CD workflow configuration to enable scanning of subdirectories for Gemfile.lock files during BlackDuck SCA scans. The changes temporarily redirect the workflow to a development branch for testing the new subdirectory scanning capability.

Key changes:

Adds configuration to scan specific subdirectories (., omnibus, components/gems) for Gemfile.lock files
Temporarily modifies branch triggers and workflow reference to use a development branch

Copilot · 2025-12-04T17:06:03Z

.github/workflows/ci-main-pull-request-stub.yml

 on: 
  pull_request:
-    branches: [ main, develop, release/** ]
+    branches: [ nikhil/CHEF-28158-NOTICE-generation, develop, release/** ]


The branch name 'nikhil/CHEF-28158-NOTICE-generation' doesn't match the PR's purpose of scanning subdirectories for Gemfile.lock files. The Jira ID references 'NOTICE-generation', but this PR is about configuring BlackDuck to scan subdirectories. Consider using a branch name that reflects the actual changes, such as 'nikhil/CHEF-XXXXX-blackduck-subdirectory-scan'.

Copilot · 2025-12-04T17:06:03Z

.github/workflows/ci-main-pull-request-stub.yml


  call-ci-main-pr-check-pipeline:
-    uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@main
+    uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@nikhil/detect-lockfile-in-subfolders-chef-workstation


Hardcoding a personal development branch reference in the workflow creates a temporary dependency that must be reverted before merging. This should be changed back to '@main' before the PR is merged to avoid breaking the workflow for other developers. Since this is marked '[DO NOT MERGE]', ensure this is addressed when creating the final version.

Suggested change

uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@nikhil/detect-lockfile-in-subfolders-chef-workstation

uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@main

Copilot · 2025-12-04T17:06:03Z

.github/workflows/ci-main-pull-request-stub.yml

      perform-blackduck-sca-scan: true # combined with generate sbom & generate github-sbom, also needs version above
      blackduck-project-group-name: 'Chef-Agents' # typically one of (Chef), Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Non-Product'
      blackduck-project-name: ${{ github.event.repository.name }} # BlackDuck project name, typically the repository name
+      blackduck-detect-source-paths: '.;omnibus;components/gems' # Semicolon-separated paths to scan for Gemfile.lock files in subdirectories


[nitpick] The comment could be more specific about what happens with these paths. Consider clarifying whether these paths are scanned recursively for Gemfile.lock files or if they represent specific locations where Gemfile.lock is expected to exist. For example: 'Semicolon-separated root paths where BlackDuck will recursively scan for Gemfile.lock files'.

Suggested change

blackduck-detect-source-paths: '.;omnibus;components/gems' # Semicolon-separated paths to scan for Gemfile.lock files in subdirectories

blackduck-detect-source-paths: '.;omnibus;components/gems' # Semicolon-separated root paths where BlackDuck will recursively scan for Gemfile.lock files

Signed-off-by: nikhil2611 <[email protected]>

- Added blackduck-detect-source-paths parameter to target components/gems - This focuses Black Duck SCA scan on the primary Ruby dependencies - Excludes omnibus/Gemfile.lock from scanning Signed-off-by: nikhil2611 <[email protected]>

sonarqubecloud · 2025-12-04T17:56:37Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

Copilot · 2025-12-04T17:56:44Z

.github/workflows/ci-main-pull-request-stub.yml

 on: 
  pull_request:
-    branches: [ main, develop, release/** ]
+    branches: [ nikhil/CHEF-28158-NOTICE-generation, develop, release/** ]


Branch reference 'nikhil/CHEF-28158-NOTICE-generation' appears to be a personal development branch. This should be reverted to 'main' before merging to ensure the workflow triggers on the correct branches.

Copilot · 2025-12-04T17:56:44Z

.github/workflows/ci-main-pull-request-stub.yml

+    branches: [ nikhil/CHEF-28158-NOTICE-generation, develop, release/** ]
  push:
-    branches: [ main, develop, release/** ]
+    branches: [ nikhil/CHEF-28158-NOTICE-generation, develop, release/** ]


Branch reference 'nikhil/CHEF-28158-NOTICE-generation' appears to be a personal development branch. This should be reverted to 'main' before merging to ensure the workflow triggers on the correct branches.

Copilot · 2025-12-04T17:56:44Z

.github/workflows/ci-main-pull-request-stub.yml


  call-ci-main-pr-check-pipeline:
-    uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@main
+    uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@nikhil/detect-lockfile-in-subfolders-chef-workstation


The workflow reference uses a personal feature branch 'nikhil/detect-lockfile-in-subfolders-chef-workstation'. This should be changed to a stable reference (e.g., '@main' or a version tag) before merging.

Suggested change

uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@nikhil/detect-lockfile-in-subfolders-chef-workstation

uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@main

Copilot · 2025-12-04T17:56:45Z

.github/workflows/ci-main-pull-request-stub.yml

      blackduck-project-name: ${{ github.event.repository.name }} # BlackDuck project name, typically the repository name
-      generate-blackduck-sbom: false # obsolete, use perform-blackduck-sca-scan instead
+      blackduck-detect-source-paths: 'components/gems' # Scan only the components/gems directory for Gemfile.lock
+      generate-blackduck-sbom: true # obsolete, use perform-blackduck-sca-scan instead


The comment indicates this parameter is obsolete and 'perform-blackduck-sca-scan' should be used instead. Setting this to 'true' while it's marked obsolete creates confusion. Either remove this parameter or clarify why it's being enabled despite being obsolete.

Suggested change

generate-blackduck-sbom: true # obsolete, use perform-blackduck-sca-scan instead

nikhil2611 added 4 commits December 4, 2025 20:32

added config to detect gemfile.lock in sub directories

8443a17

Signed-off-by: nikhil2611 <[email protected]>

added config to detect gemfile.lock in sub directories

120cc3d

Signed-off-by: nikhil2611 <[email protected]>

Merge branch 'main' of github.com:chef/chef-workstation into nikhil/C…

56674c1

…HEF-28158-NOTICE-generation

added config to scan sub directories for Gemfile.lock

9394fa7

Signed-off-by: nikhil2611 <[email protected]>

Copilot AI review requested due to automatic review settings December 4, 2025 17:05

nikhil2611 requested review from a team as code owners December 4, 2025 17:05

Copilot AI reviewed Dec 4, 2025

View reviewed changes

nikhil2611 added 2 commits December 4, 2025 23:00

updated version

d0ad0c1

Signed-off-by: nikhil2611 <[email protected]>

Copilot AI review requested due to automatic review settings December 4, 2025 17:56

Copilot AI reviewed Dec 4, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[DO NOT MERGE] - Added config to scan sub directories for Gemfile.lock #3466

[DO NOT MERGE] - Added config to scan sub directories for Gemfile.lock #3466

Uh oh!

nikhil2611 commented Dec 4, 2025

Uh oh!

netlify bot commented Dec 4, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 4, 2025

Uh oh!

Copilot AI Dec 4, 2025

Uh oh!

Copilot AI Dec 4, 2025

Uh oh!

sonarqubecloud bot commented Dec 4, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 4, 2025

Uh oh!

Copilot AI Dec 4, 2025

Uh oh!

Copilot AI Dec 4, 2025

Uh oh!

Copilot AI Dec 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@nikhil/detect-lockfile-in-subfolders-chef-workstation
	uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@main

	blackduck-detect-source-paths: '.;omnibus;components/gems' # Semicolon-separated paths to scan for Gemfile.lock files in subdirectories
	blackduck-detect-source-paths: '.;omnibus;components/gems' # Semicolon-separated root paths where BlackDuck will recursively scan for Gemfile.lock files

[DO NOT MERGE] - Added config to scan sub directories for Gemfile.lock #3466

Are you sure you want to change the base?

[DO NOT MERGE] - Added config to scan sub directories for Gemfile.lock #3466

Uh oh!

Conversation

nikhil2611 commented Dec 4, 2025

Description

Related Issue

Types of changes

Checklist:

Uh oh!

netlify bot commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👷 Deploy Preview for chef-workstation processing.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Dec 4, 2025

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify bot commented Dec 4, 2025 •

edited

Loading