Hey everyone, been lurking for a bit as my company is starting to look at Black Duck for our migration to Azure. We're moving a bunch of older .NET services and some newer containerized stuff.
I've been going through the evaluation, and I keep hitting a wall with the policy engine. It feels... incredibly strict? Like, it seems built for a waterfall model where you stop everything for a policy violation. But we're trying to do CI/CD, with multiple commits a day per team. If a dev pulls in a new npm package with a low-severity license issue, the scan can fail the whole build. Our current process just flags it for review.
This creates so much friction. Do you all just accept that and gate everything? Or am I missing a configuration trick? I've set up overrides, but managing them at scale seems like a new full-time job.
We want to be compliant, but we also need to keep moving. Is there a way to make it more of a guardrail and less of a brick wall? Maybe integrating it differently? I'm nervous about rolling this out and grinding development to a halt 😅. Any real-world advice from teams that made it work?
One step at a time