Reason of JSON-Analysis aborted should be provided

[slawekjaranowski]

Is your feature request related to a problem? Please describe.
When any problem occurs during parsing json report check is silently skip

There is code:

try {
            JsonReportFile report = JsonReportFile.getJsonReport(context.config(), fileSystem, pathResolver);
            return Optional.of(JsonReportParserHelper.parse(report.getInputStream()));
        } catch (FileNotFoundException e) {
            LOGGER.info("JSON-Analysis skipped/aborted due to missing report file");
            LOGGER.debug(e.getMessage(), e);
        } catch (ReportParserException e) {
            LOGGER.warn("JSON-Analysis aborted");
            LOGGER.debug(e.getMessage(), e);
        } catch (IOException e) {
            LOGGER.warn("JSON-Analysis aborted due to: IO Errors", e);
        }

Describe the solution you'd like

should be at least like for IOException:

            LOGGER.warn("JSON-Analysis aborted", e);

Describe alternatives you've considered
I would like to consider to break analize due to ReportParserException or IOException.

Eventually I would like to consider to add an option to require analize with success in strict mode.

[slawekjaranowski]

By the way how I can log level for plugin in sonar analizer, I used a Maven plugin sonar:sonar

[Tezra]

I would like this to also create a Sonar issue on abort, that way you can tell if the analysis was aborted without needing to look at the logs. Right now it just silently aborts so it looks like there where no vulnerabilities unless you know what to look for in the logs, and actually check them.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days.

[slawekjaranowski]

still actual

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days.

[Tezra]

Still an issue. I consider this enhanced logging a fairly critical first step feature, as reporting "no vulnerabilities found" because check was skipped because of a json parse error is effectively suppressing vulnerability reports. Which is a non-starter issue in a production environment.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days.

[slawekjaranowski]

actual