Introduction
When integrating Frogbot into your CI/CD pipeline to scan pull requests / scan repositories, you may occasionally encounter errors that prevent the scan from completing or reporting results. These issues can range from configuration mismatches and permission deficits to environment-specific dependency build failures.
This article addresses the most frequent errors reported by customers and explains how to gather the necessary debug information to resolve them effectively.
This article will guide you through the process of debugging Frogbot execution issues. It covers how to enable verbose logging to capture the root cause of failures and provides step-by-step resolutions for the four most common errors customers face:
- Python dependency tree build failures
- SSL/Certificate verification failures (Exit Status 51)
- Permission errors (403 Forbidden) during SCA scans
- Git provider authentication issues
Common Issues & Solutions
Prerequisite: Enable Debug Logging
Before troubleshooting specific errors, it is critical to gather all logs printed by Frogbot.
The default log level often hides the specific error message needed to identify the root cause.
To enable full debug logging, set the following environment variables in your CI pipeline before the Frogbot command is executed:
JFROG_CLI_LOG_LEVEL: DEBUG
CI: true
Once these are set, re-run the pipeline and inspect the logs for the specific error messages detailed below.
1. Failed to Build Dependency Tree (Python/Pip)
The Issue: You may see the following error message in your logs:
failed to build dependency tree: failed while building 'pip' dependency tree: "python -m pip install ." command failed: exit status 1 - ERROR: Directory '.' is not installable. Neither 'setup.py' nor 'pyproject.toml' found.
The Cause: This error occurs because the Frogbot client attempts to run an install command on the project to build the dependency tree, but it fails because the project root lacks a setup.py or pyproject.toml file. This typically happens in projects that rely solely on requirements.txt.
Resolution: To mitigate this, you must explicitly tell Frogbot where your requirements file is located.
Locate the path to your requirements.txt file relative to the repository root.
Add the JF_REQUIREMENTS_FILE environment variable to your pipeline configuration.
Set the value to the relative path of your requirements file.
Example Configuration:
Bash
# If the file is in a subdirectory named "pythonProject/src"
export JF_REQUIREMENTS_FILE="pythonProject/src/requirements.txt"
2. SSL/Certificate Verification Failed (Exit Status 51)
The Issue: In the general Frogbot log, you see an error indicating the applicability scan failed with exit code 51:
failed to run Applicability scan: [Thread 0] failed to run Applicability scan. Exit code received: exit status 51
Upon inspecting the internal Analyzer Manager log, you might find specific SSL errors:
CA bundle not found at /root/.jfrog/security/certs because folder does not exist. urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate
The Cause: This indicates that Frogbot is failing to authenticate against the JFrog Artifactory server because it cannot verify the server's SSL certificate. This is common when the JFrog Platform is hosted behind a self-signed certificate or an internal Certificate Authority (CA) that is not trusted by the CI runner's default trust store.
Resolution: You must ensure the runner executing Frogbot has the correct certificate available in the standard JFrog CLI security path.
Locate the Certificate: Obtain the self-signed certificate (or the root CA certificate).
Configure the Runner: In your CI pipeline, before Frogbot runs, copy the certificate file to $HOME/.jfrog/security/certs.
Note: If the directory does not exist, create it.
Handle Certificate Chains: If you are using a certificate chain, ensure the whole certificate chain is placed in that directory.
Example Step:
Bash
mkdir -p /root/.jfrog/security/certs
cp ./my-custom-ca.crt /root/.jfrog/security/certs/
3. SCA Scan Failed (403 Forbidden)
The Issue: The scan fails during the dependency analysis phase with a 403 error:
Failed to execute SCA scan: [Thread 0] Xray dependency tree scan request on '<tech>' failed: scanning <tech> dependencies failed with error: server response: 403 Forbidden
(Note: <tech> will be replaced by your package manager, e.g., npm, maven, go).
The Cause: This error is strictly related to permissions. The user credentials (username/password or Access Token) provided to Frogbot do not have sufficient privileges to perform the scan in Xray. Specifically, the user lacks the "Manage Xray Metadata" permission.
Resolution:
Identify the user or Access Token being used by the JF_ACCESS_TOKEN (or JF_USER/JF_PASSWORD) environment variables.
Log in to the JFrog Platform as an Admin.
Navigate to User Management and locate the user/token.
Ensure the user has the Manage Xray Metadata permission enabled.
Save the changes and re-run the pipeline.
4. Git Provider Authentication Failed
The Issue: You may see errors related to Git actions preventing Frogbot from commenting on PRs or cloning code:
Error: Bad credentials OR 401 Unauthorized OR remote: Invalid username or password
The Cause: Frogbot requires a valid Git token to interact with your VCS (GitHub, GitLab, Bitbucket, etc.). This error indicates that the JF_GIT_TOKEN provided is invalid, expired, or lacks the necessary scopes.
Resolution:
Verify that the environment variable JF_GIT_TOKEN is set in your CI pipeline.
Regenerate the token in your Git provider.
Ensure the token has the correct permissions:
GitHub: repo (Full control of private repositories) or at least public_repo (for public) and write:discussion / read:discussion.
GitLab: api scope.
Bitbucket: Repository: Write and Pull Request: Write.
Update the secret in your CI environment with the new token.