SONARJAVA-5368 Remove useless build during mend scan

[leonardo-pilastri-sonarsource]

SONARJAVA-5368

[dorian-burihabwa-sonarsource]

Do we see any difference in the results on Mend?

[leonardo-pilastri-sonarsource]

Do we see any difference in the results on Mend?

I ran the ws_scan on master and right after on this branch, I could see the two different build numbers on mend with the same results. Sadly there is no direct way to compare two different scans/builds.

By comparing the logs I can see that the only relevant difference is that on master we perform the build of the project before running mend. But on this branch we are anyway able to pick up the latest build that was produced by the build_task and use that. What happens on master is an extra build with the same buildNumber used in the previous task, which is pointless.

This is the final output of the ws_scan on master:

------------------------------------------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------- WhiteSource Scan Summary: --------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------------------------------------------
======================================================================================================================================================
Scan Origin: Local File System
======================================================================================================================================================
Step                                              Completion Status               Elapsed                  Comments
======================================================================================================================================================
Fetch Configuration                                  COMPLETED                  00:00:00.085               --------
Pre-Step And Resolve Dependencies                    COMPLETED                  00:00:09.058               175 total dependencies (54 unique)
   MAVEN                                             COMPLETED                  00:00:08.748               175 total dependencies (54 unique)
Scan Files Matching Includes Pattern                 COMPLETED                  00:00:00.414               0 source/binary files
Check Policies                                       COMPLETED                  00:00:12.481               --------
Update Inventory                                     COMPLETED                  00:00:00.786               1 updated projects

======================================================================================================================================================
Elapsed running time:                                                           00:00:22.824
======================================================================================================================================================
Process finished with exit code SUCCESS (0)

and this is the corresponding output for this branch:

------------------------------------------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------- WhiteSource Scan Summary: --------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------------------------------------------
======================================================================================================================================================
Scan Origin: Local File System
======================================================================================================================================================
Step                                              Completion Status               Elapsed                  Comments
======================================================================================================================================================
Fetch Configuration                                  COMPLETED                  00:00:00.086               --------
Pre-Step And Resolve Dependencies                    COMPLETED                  00:00:09.388               175 total dependencies (54 unique)
   MAVEN                                             COMPLETED                  00:00:09.106               175 total dependencies (54 unique)
Scan Files Matching Includes Pattern                 COMPLETED                  00:00:00.366               0 source/binary files
Check Policies                                       COMPLETED                  00:00:12.499               --------
Update Inventory                                     COMPLETED                  00:00:00.766               1 updated projects

======================================================================================================================================================
Elapsed running time:                                                           00:00:23.105
======================================================================================================================================================
Process finished with exit code SUCCESS (0)

[erwan-serandour]

Tasks are run in parallel that is why all the test task explicitly depends on the build. I don't why it working and how mend is getting the build. But it would be safer to explicitly depend on the build task. With

depends_on:
- build

[leonardo-pilastri-sonarsource]

I will still run some more validation, as I am not confident with our understanding of mend

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[github-actions]

This PR is stale because it has been open 7 days with no activity. If there is no activity in the next 7 days it will be closed automatically

[leonardo-pilastri-sonarsource]

I'm closing the PR as I am not 100% confident that changes will not create FNs, and also we might move away from mend soon enough.