Hey everyone, hoping to tap the collective wisdom here. We've just completed an upgrade to Black Duck Detect 9.0 in our CI/CD pipeline, and we've hit a real head-scratcher. After the upgrade runs, the scan report comes back successfully, but it consistently shows **0 components** identified. Our project is a fairly standard Java Maven application, and this was working perfectly under Detect 8.x.
I've been digging through the logs and comparing our old and new configurations. The upgrade process itself was smooth, and the Detect script completes with an exit code 0 (SUCCESS). No obvious errors are thrown, which makes the zero components result so puzzling. It feels like Detect is just not engaging with the package manager or signature scanner.
Here's a simplified version of our current invocation, which mirrors our previous working setup but uses the new 9.0 script:
```bash
bash <(curl -s -L https://detect.synopsys.com/detect9.sh)
--blackduck.url=" https://our.blackduck.instance"
--blackduck.api.token="***"
--detect.project.name="Our-Project"
--detect.project.version.name="main"
--detect.maven.build.command="clean package -DskipTests"
--detect.tools="SIGNATURE_SCAN"
--detect.source.path="."
```
Things I've already checked or tried:
* Verified the API token and connectivity to Black Duck are fine (the project/version gets created).
* Confirmed the source path is correct and contains the `pom.xml`.
* Ran with `--detect.log.level=DEBUG` and reviewed the output. The logs show the signature scanner running, but it seems to finish almost instantly.
* Added `--detect.tools="DETECTOR"` explicitly, but no change.
* Ensured we have the latest version of the 9.0 script.
My leading theory is that there might be a new, required property in 9.0 that isn't clearly flagged, or perhaps a default behavior change around which directories are scanned for signatures. The documentation mentions improvements to the detector, but I'm wondering if there's an implicit shift we've missed.
Has anyone else navigated this "0 components" cliff with Detect 9.0? Any suggestions on which diagnostic step I should try next? I'm particularly interested if there's a known issue with the Maven detector or if we need to adjust the source path scanning depth.
api first
api first
Yeah, that zero components on a clean exit is a classic post-upgrade gotcha. I've seen this happen when a key tool gets silently excluded. Your sample command cuts off, but you mentioned `--detect.tools="`. Could you check if the full argument is populating correctly? In 9.0, if that list is empty or malformed, it might just run the "detectors" phase and skip signature scan and package manager analysis, resulting in zero components.
Double-check the `detect.tools` value in your actual CI logs against the 9.0 docs. It's easy for a line break or a hidden character to truncate that property. Also, run with `--detect.logging.level=DEBUG` and grep for "Tool will be executed" - that'll show you what it's actually trying to run.
Sleep is for the weak