Initialize Job - ComponentGovernanceComponentDetection - Unable to locate dotnet on build agent, tool failed to execute

[carlossanlop]

Build

https://dev.azure.com/dnceng-public/public/_build/results?buildId=279134

Build leg reported

CoreCLR Product Build Linux_musl x64 checked

Pull Request

#86453

Known issue core information

If this is an issue that could be causing build breaks across multiple respositories:

1. Edit this issue and add an error string in the JSON. Use the Known Issues documentation

{
   "ErrorMessage" : "Unable to locate dotnet on build agent",
   "BuildRetry": false,
   "ErrorPattern": "",
   "ExcludeConsoleLog": false
}

@dotnet/dnceng

Release Note Category

• Feature changes/additions
• Bug fixes
• Internal Infrastructure Improvements

Release Note Description

Additional information about the issue reported

Failing step = Initialize Job: https://dev.azure.com/dnceng-public/public/_build/results?buildId=279134&view=logs&j=0e64859c-a870-5a74-6b6e-333fc1003298&t=4c458f92-744f-5e74-2571-d566306d59f0&l=18

Full output:

Starting: ComponentGovernanceComponentDetection
==============================================================================
Task         : Component Governance Detection
Description  : Include with your build to enable automatic Component Governance detection.
Version      : 0.2320510.1
Author       : Microsoft Corporation
Help         : Please try our [support bot](http://aka.ms/1esbot?service=cg) for questions and troubleshooting. See http://aka.ms/cgdocs for more information or contact OpenSourceEngSupport@microsoft.com if you run into problems with this task.
==============================================================================
Loading task manifest...
Component Detection starting up...
##[info]Telemetry ID: d71eafea-ef6f-43ff-97a8-6403a0e2af5f
##[info]Result: Will Scan. Reason: Component Detection was manually injected
Starting scan for open source vulnerabilities
OS Platform: linux
OS Architecture: x64
OS Version:  5.4.0-1107-azure
/__w/_tasks/ComponentGovernanceComponentDetection_f2f0881f-4b99-4a1c-80ea-f5b13fd6cec4/0.2320510.1/dotnet-6.0.0.tar.gz
##[error]Unable to locate dotnet on build agent.
##[error]Tool failed to execute.
Finishing: ComponentGovernanceComponentDetection

Report

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	0	0

Known issue validation

Build: 🔎
Result validation: ⚠️ Provided build not found. Provide a valid build in the "Build: 🔎" line.
Validation performed at: 8/17/2023 6:13:06 AM UTC

[hoyosjs]

This is a long known issue and as far I know - it just generates a warning. It's been the sad reality for musl for a long time. ASP disables explicitly because of this using dotnet/arcade@092ad72

[carlossanlop]

Should we move this back to runtime, or create a linked issue? When moved here, Known Build Error does not detect the failure instances in runtime.

[missymessa]

@carlossanlop and @hoyosjs Are the Runtime builds still experiencing this? The referenced builds have fallen out of AzDO's retention.

[hoyosjs]

Long standing issue - it's component governance on Linux musl (alpine)

[missymessa]

Is this something y'all want to keep in dotnet/arcade? Is it impacting more than just dotnet/runtime?

[dougbu]

Seems the right thing to do here is disable the task in MUSL jobs. Arcade's templates support disabling the CG task using the disableComponentGovernance parameter. For example, dotnet/aspnetcore uses this at https://github.com/dotnet/aspnetcore/blob/62c1334c8d33ca669a6eef6c0e38a806e043f7c2/.azure/pipelines/ci.yml#L546

/fyi the default-build.yml template parameter is forwarded along to /eng/common/templates/job/job.yml

[melotic]

This is because the CG task will not download a .NET runtime if there isn't one on the agent. Installing any dotnet in the job should fix this.

We used to require a specific .NET version, but this was recently fixed in December, and we never got around to switching the order of operations.

[dougbu]

Is this something y'all want to keep in dotnet/arcade

at this point, I suggest moving the issue to runtime. there are at least two ways forward for that team w/o taking any action in arcade

1. arcade supports the disableComponentGovernance as a parameter in our YAML templates
2. the runtime YAML could also ensure a .NET runtime is installed before the CG scanner runs

[dougbu]

@carlossanlop should this be moved to dotnet/runtime or closed❔ you've got options 😀