Enhancements
- If a SonarQube Enterprise license is detected, DevOps Portal will automatically set-up a Portfolio in SonarQube for each project, which aggregates the scan results of all git repositories in the project. You may need to rerun the build pipelines of your repositories to get the Portfolios populated with data. The following screenshot shows the Portfolios page in SonarQube with two examples:
You can click on any of the listed porfolios to get the full break down of included scan results for all git repositories which are part of the corresponding DevOps Portal project. See the next screenshot for an example:
- Since Bitbucket v9 and later allows to use HTTP Access Tokens with simple auth, it was now possible to replace the technical users in Bitbucket which were used by Jenkins to retrieve the git repositories by HTTP Access Tokens. This frees a Bitbucket license for each project which uses Bitbucket and Jenkins. See Create HTTP Access Token for project or repository access for more details.
Improvements
- Audit log messages now only list changes of global roles, but don't list unchanged roles. This gives a better overview about changes.
- The accessibility and usability of the pages for login and password change have been improved.
- The accessibility and usability of tables has been improved. This includes a switch to the most recommended sorting indicator icons.
- Stream lined status messages shown when using the Terms & Conditions management page.
- Localized some date formats in automatically sent emails.
Bugfixes
- Multiple invocations of role removals could lead to a negative member count being displayed for the affected project. It could be healed at any time by reloading the page, but now the counter will always correctly stop at 0.
- When a table is sorted on a column, it can happen that due to an action triggered by the user the sort order is violated since the value of the current row was changed. In this case, the sorting indicator is now reset. You can still at any time sort again by clicking on the column header.
Security
- When a user was locked in the Portal, it was still possible to use personal access tokens of that user in Jira, if any were created. This is now prevented by setting the user to deactivated in Jira. This was just a minor issue, since all project roles are removed from a user when it's locked. That means the tokens could only be used for user-specific API calls, not for project-specific calls. To allow the deactivation in Jira to work, project lead assignments of the user are removed. When the user is unlocked, its reactivated in Jira, therefore the tokens are working again. The drawback is, that project lead assignments cannot be restored. Project lead is a special role in a Jira project usually only relevant for notifications. It's not the same like a Project Admin role.
- When a technical user in Jenkins was deleted in the DevOps Portal, its personal access tokens in Jenkins were still working, if any were created. This has been solved now. This was just a minor issue, since all project roles are removed from a user when it's locked. That means the tokens could only be used for user-specific API calls, not for project-specific calls.