From 45e9b76e3147d07b1cef8c5d95883bc553afad70 Mon Sep 17 00:00:00 2001 From: attiasas Date: Wed, 29 Jul 2026 12:21:06 +0300 Subject: [PATCH 1/4] Update deps to prepare for changes --- go.mod | 30 +++++++++--------- go.sum | 66 ++++++++++++++++++++------------------- utils/getconfiguration.go | 12 +++---- 3 files changed, 56 insertions(+), 52 deletions(-) diff --git a/go.mod b/go.mod index 8e96a749b..2fc30598a 100644 --- a/go.mod +++ b/go.mod @@ -9,12 +9,12 @@ require ( github.com/go-git/go-git/v5 v5.19.1 github.com/golang/mock v1.6.0 github.com/google/go-github/v45 v45.2.0 - github.com/jfrog/build-info-go v1.13.1-0.20260713073853-4f3044bf0940 + github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d github.com/jfrog/froggit-go v1.23.1 github.com/jfrog/gofrog v1.7.6 - github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260624085155-5ba797de2616 + github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e github.com/jfrog/jfrog-cli-security v1.31.3 - github.com/jfrog/jfrog-client-go v1.55.1-0.20260624085832-de0c68a23c43 + github.com/jfrog/jfrog-client-go v1.55.1-0.20260728135425-4a7f34efb305 github.com/owenrumney/go-sarif/v3 v3.2.3 github.com/stretchr/testify v1.11.1 github.com/urfave/cli/v2 v2.27.7 @@ -27,8 +27,8 @@ require ( github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.4.1 // indirect github.com/andybalholm/brotli v1.2.1 // indirect - github.com/beevik/etree v1.6.0 // indirect - github.com/buger/jsonparser v1.2.0 // indirect + github.com/beevik/etree v1.7.0 // indirect + github.com/buger/jsonparser v1.3.0 // indirect github.com/c-bata/go-prompt v0.2.6 // indirect github.com/chzyer/readline v1.5.1 // indirect github.com/clipperhouse/uax29/v2 v2.7.0 // indirect @@ -61,10 +61,10 @@ require ( github.com/hashicorp/go-retryablehttp v0.7.8 // indirect github.com/hashicorp/yamux v0.1.1 // indirect github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect - github.com/jedib0t/go-pretty/v6 v6.7.10 // indirect + github.com/jedib0t/go-pretty/v6 v6.8.3 // indirect github.com/jfrog/archiver/v3 v3.6.3 // indirect github.com/jfrog/jfrog-apps-config v1.0.1 // indirect - github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260721044519-d4e49af4db2c // indirect + github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260728121041-2227ac7420a0 // indirect github.com/kevinburke/ssh_config v1.6.0 // indirect github.com/klauspost/compress v1.18.6 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect @@ -73,7 +73,7 @@ require ( github.com/manifoldco/promptui v0.9.0 // indirect github.com/mattn/go-colorable v0.1.14 // indirect github.com/mattn/go-isatty v0.0.22 // indirect - github.com/mattn/go-runewidth v0.0.23 // indirect + github.com/mattn/go-runewidth v0.0.27 // indirect github.com/mattn/go-tty v0.0.8 // indirect github.com/microsoft/azure-devops-go-api/azuredevops/v7 v7.1.0 // indirect github.com/minio/sha256-simd v1.0.1 // indirect @@ -114,13 +114,13 @@ require ( github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/crypto v0.52.0 // indirect - golang.org/x/mod v0.36.0 // indirect + golang.org/x/mod v0.37.0 // indirect golang.org/x/net v0.55.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect - golang.org/x/sys v0.45.0 // indirect - golang.org/x/term v0.43.0 // indirect - golang.org/x/text v0.37.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/term v0.45.0 // indirect + golang.org/x/text v0.40.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect google.golang.org/grpc v1.79.3 // indirect @@ -130,7 +130,8 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security dev +// attiasas:services-sub-scan-source-code +replace github.com/jfrog/jfrog-cli-security => github.com/attiasas/jfrog-cli-security v0.0.0-20260729091050-19a015b12436 // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev @@ -138,6 +139,7 @@ require ( // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go dev -// replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go master +// orto17:missconfiguration-service +replace github.com/jfrog/jfrog-client-go => github.com/orto17/jfrog-client-go v0.0.0-20260728142826-c098e2d936bf // replace github.com/jfrog/froggit-go => github.com/jfrog/froggit-go master diff --git a/go.sum b/go.sum index 03ff643da..284160432 100644 --- a/go.sum +++ b/go.sum @@ -21,14 +21,16 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFI github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/beevik/etree v1.6.0 h1:u8Kwy8pp9D9XeITj2Z0XtA5qqZEmtJtuXZRQi+j03eE= -github.com/beevik/etree v1.6.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc= +github.com/attiasas/jfrog-cli-security v0.0.0-20260729091050-19a015b12436 h1:uY1A8FdAf+lB0sWZyoJp+c9tUVSKVDE/4zcvLsNQQvY= +github.com/attiasas/jfrog-cli-security v0.0.0-20260729091050-19a015b12436/go.mod h1:wFFpDWGr2dXFz4lE9ChAn+VVWIqzrWjBkOCKP+hY0Wk= +github.com/beevik/etree v1.7.0 h1:xjBk9O4p4x7D1YajePjfLzdaFC4/uYUENA7P0pv6gXA= +github.com/beevik/etree v1.7.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc= github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M= github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0= github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA= github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8= -github.com/buger/jsonparser v1.2.0 h1:4EFcvK1kD4jyj6YqNK6skK6w+y7FHHBR+XBCtxwu/6g= -github.com/buger/jsonparser v1.2.0/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0= +github.com/buger/jsonparser v1.3.0 h1:2RJHo4G3vFBQSYwwEAOfHNRlKIameh/HdbhPJ/zY/0A= +github.com/buger/jsonparser v1.3.0/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0= github.com/c-bata/go-prompt v0.2.6 h1:POP+nrHE+DfLYx370bedwNhsqmpCUynWPxuHi0C5vZI= github.com/c-bata/go-prompt v0.2.6/go.mod h1:/LMAke8wD2FsNu9EXNdHxNLbd9MedkPnCdfpU9wwHfY= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= @@ -138,26 +140,22 @@ github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ= github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A= github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo= -github.com/jedib0t/go-pretty/v6 v6.7.10 h1:B/2qW2Bkv2L6n14PP8o1kx75kWzHOQ3YTluWzg9icac= -github.com/jedib0t/go-pretty/v6 v6.7.10/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU= +github.com/jedib0t/go-pretty/v6 v6.8.3 h1:yVSk5aemoYHCvcrtqyXklwqcgHQIQzmy/oUzFlmffSQ= +github.com/jedib0t/go-pretty/v6 v6.8.3/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU= github.com/jfrog/archiver/v3 v3.6.3 h1:hkAmPjBw393tPmQ07JknLNWFNZjXdy2xFEnOW9wwOxI= github.com/jfrog/archiver/v3 v3.6.3/go.mod h1:5V9l+Fte30Y4qe9dUOAd3yNTf8lmtVNuhKNrvI8PMhg= -github.com/jfrog/build-info-go v1.13.1-0.20260713073853-4f3044bf0940 h1:LthrPDN8YjDKrDNzOWS/w9NLFyeebdnWkmp8vhma0qo= -github.com/jfrog/build-info-go v1.13.1-0.20260713073853-4f3044bf0940/go.mod h1:CYRUCvLKfyARjoJXLWAxce1qNUxTEtbRKAARkV42vpE= +github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d h1:Yqbx+/9cIiZJmpyIkWDyC9Qjh4OaVeGWutADFaUzHr0= +github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d/go.mod h1:CYRUCvLKfyARjoJXLWAxce1qNUxTEtbRKAARkV42vpE= github.com/jfrog/froggit-go v1.23.1 h1:4wmaHeuptxVINbovMaeITzVhi3+VQoc/FFIjF4axzu0= github.com/jfrog/froggit-go v1.23.1/go.mod h1:wRDryqyp3oe+eHgME2mpnEQmO8XBECIPagFwj0nHmdI= github.com/jfrog/gofrog v1.7.6 h1:QmfAiRzVyaI7JYGsB7cxfAJePAZTzFz0gRWZSE27c6s= github.com/jfrog/gofrog v1.7.6/go.mod h1:ntr1txqNOZtHplmaNd7rS4f8jpA5Apx8em70oYEe7+4= github.com/jfrog/jfrog-apps-config v1.0.1 h1:mtv6k7g8A8BVhlHGlSveapqf4mJfonwvXYLipdsOFMY= github.com/jfrog/jfrog-apps-config v1.0.1/go.mod h1:8AIIr1oY9JuH5dylz2S6f8Ym2MaadPLR6noCBO4C22w= -github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260721044519-d4e49af4db2c h1:sQoW+Wwkk3Vp6bA1MS/RObrqY2Jt2qy0SxIiBhpLgz4= -github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260721044519-d4e49af4db2c/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260624085155-5ba797de2616 h1:bioFXGzf3pF2qnC3LZD1S1saWiHSekL4vdsDSWksj/4= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260624085155-5ba797de2616/go.mod h1:9R90mhbczGXwW5EGlDs7F08ejQU/xdoDhYHMvzBiqgE= -github.com/jfrog/jfrog-cli-security v1.31.3 h1:WVkonz9/0zuNKKz/350uguXmK771NymMu7QihQibop4= -github.com/jfrog/jfrog-cli-security v1.31.3/go.mod h1:C9DINxsrKdF5ciebWDMtt5/qfriNcKPPh1HJ5HXnotg= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260624085832-de0c68a23c43 h1:akoiWauP27YxVXcRkCC8ahgDLxqiARUAVEB+KUPO2OE= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260624085832-de0c68a23c43/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= +github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260728121041-2227ac7420a0 h1:DVEYAyGJDn9ywGyBSa/MC3oWZsGC2DmPihv++/EDsJs= +github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260728121041-2227ac7420a0/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e h1:K0IK3w5a5h6SIi9yoOJ6a7DL+kuFjs5acypOxKyT2OM= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo= github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY= @@ -179,8 +177,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/ktrysmt/go-bitbucket v0.9.88 h1:XBjYui83tW2puG7f2GvYSAMMKIPfhpeoLCVfEJx3KVM= github.com/ktrysmt/go-bitbucket v0.9.88/go.mod h1:fx6zdyKEyiNfR9VW0npWD6ugoSUsp8JLXGyqna8bHkc= -github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE= -github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= +github.com/magiconair/properties v1.18.11 h1:j5ozYZl0zCjG7ahMDH0GWIobOvvUzT0BdAguG0ViKy0= +github.com/magiconair/properties v1.18.11/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= github.com/manifoldco/promptui v0.9.0 h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA= github.com/manifoldco/promptui v0.9.0/go.mod h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg= github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= @@ -197,8 +195,8 @@ github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= github.com/mattn/go-runewidth v0.0.6/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= -github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw= -github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= +github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhVlIR0= +github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8= github.com/mattn/go-tty v0.0.3/go.mod h1:ihxohKRERHTVzN+aSVRwACLCeqIoZAWpoICkkvrWyR0= github.com/mattn/go-tty v0.0.8 h1:yxtc0Ye17/1ne/bjy993YUoyP8bJJFa9n5M9XTdwoZQ= github.com/mattn/go-tty v0.0.8/go.mod h1:f2i5ZOvXBU/tCABmLmOfzLz9azMo5wdAaElRNnJKr+k= @@ -215,6 +213,8 @@ github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw= github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA= github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A= github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k= +github.com/orto17/jfrog-client-go v0.0.0-20260728142826-c098e2d936bf h1:CPQgMBf4XsvIdi2T5ktqrsYzJwkbWPz5jxuBqakhIhc= +github.com/orto17/jfrog-client-go v0.0.0-20260728142826-c098e2d936bf/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/owenrumney/go-sarif/v3 v3.2.3 h1:n6mdX5ugKwCrZInvBsf6WumXmpAe3mbmQXgkXlIq34U= github.com/owenrumney/go-sarif/v3 v3.2.3/go.mod h1:1bV7t8SZg7pX41spaDkEUs8/yEjzk9JapztMoX1XNjg= github.com/package-url/packageurl-go v0.1.3 h1:4juMED3hHiz0set3Vq3KeQ75KD1avthoXLtmE3I0PLs= @@ -289,8 +289,10 @@ github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ= github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo= github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU= github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4= -github.com/vbauerster/mpb/v8 v8.12.1 h1:pyj3yQ2ZGQJgUXm4h17QpR+eERaNz5OQ1ftPSEE/sMM= -github.com/vbauerster/mpb/v8 v8.12.1/go.mod h1:XLXRfStkw/6i5k0aQltijDHT1Z93fD1DVwmIdcFUp6k= +github.com/vbauerster/cupwriter v0.0.4 h1:9sBPe0uXWLZuWQU5lqVbhyFlxX6c09asST/YfatFAys= +github.com/vbauerster/cupwriter v0.0.4/go.mod h1:IFyzS6Xis5dnBH/rdAhrnuzg3c+KkUqEN6yE8lhJlDw= +github.com/vbauerster/mpb/v8 v8.14.0 h1:55SR80dptMfASxIG/oCEkBXgBhxeSu4GrVsjl16oKmA= +github.com/vbauerster/mpb/v8 v8.14.0/go.mod h1:HgpQPKfcWe3kbuGGPmi+jatHreMase5C3Fp5dpdAy0Q= github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74 h1:JwtAtbp7r/7QSyGz8mKUbYJBg2+6Cd7OjM8o/GNOcVo= github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74/go.mod h1:RmMWU37GKR2s6pgrIEB4ixgpVCt/cf7dnJv3fuH1J1c= github.com/xanzy/go-gitlab v0.115.0 h1:6DmtItNcVe+At/liXSgfE/DZNZrGfalQmBRmOcJjOn8= @@ -341,8 +343,8 @@ golang.org/x/exp v0.0.0-20260527015227-08cc5374adb3/go.mod h1:d2fgXJLVs4dYDHUk5l golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4= -golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ= +golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= +golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= @@ -397,16 +399,16 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= -golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58= -golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4= -golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= @@ -414,8 +416,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= -golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -423,8 +425,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8= -golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0= +golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= +golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/utils/getconfiguration.go b/utils/getconfiguration.go index dd6e53701..1bee0e541 100644 --- a/utils/getconfiguration.go +++ b/utils/getconfiguration.go @@ -69,11 +69,11 @@ func (jp *JFrogPlatform) setJfProjectKeyIfExists() (err error) { type Git struct { GitProvider vcsutils.VcsProvider vcsclient.VcsInfo - RepoOwner string - RepoName string - Branches []string - PullRequestDetails vcsclient.PullRequestInfo - RepositoryCloneUrl string + RepoOwner string + RepoName string + Branches []string + PullRequestDetails vcsclient.PullRequestInfo + RepositoryCloneUrl string UploadSbomToVcs *bool UploadPrSecurityResultsToVcs bool GitlabScanResultsOutputDir string @@ -521,7 +521,7 @@ func getConfigurationProfile(xrayVersion string, jfrogServer *coreconfig.ServerD return } log.Debug(fmt.Sprintf("Searching central configuration associated to repository '%s'", jfrogServer.Url)) - if configProfile, err = xsc.GetConfigProfileByUrl(xrayVersion, jfrogServer, repoCloneUrl, projectKey); err != nil || configProfile == nil { + if configProfile, err = xsc.GetConfigProfileByUrl(xrayVersion, jfrogServer, repoCloneUrl, projectKey, ""); err != nil || configProfile == nil { return } From cd1f022ab9aa9465990dca2423fddc4498dad15b Mon Sep 17 00:00:00 2001 From: attiasas Date: Wed, 29 Jul 2026 15:10:12 +0300 Subject: [PATCH 2/4] Handle new services attributes --- scanpullrequest/scanpullrequest.go | 17 ++++++++++++ utils/issues/issuescollection.go | 42 +++++++++++++++++++++++++++--- utils/utils.go | 10 +++++++ 3 files changed, 66 insertions(+), 3 deletions(-) diff --git a/scanpullrequest/scanpullrequest.go b/scanpullrequest/scanpullrequest.go index 5cc0d2888..d46980542 100644 --- a/scanpullrequest/scanpullrequest.go +++ b/scanpullrequest/scanpullrequest.go @@ -202,6 +202,7 @@ func filterFailedResultsIfScannersFailuresAreAllowed(targetResults, sourceResult filterScaResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source) filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepContextualAnalysis) filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepSecrets) + filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepServices) filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepIaC) filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepSast) } @@ -211,6 +212,7 @@ func filterFailedResultsIfScannersFailuresAreAllowed(targetResults, sourceResult filterScaResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source) filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepContextualAnalysis) filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepSecrets) + filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepServices) filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepIaC) filterJasResultsIfScanFailed(targetSourceResultsPair.target, targetSourceResultsPair.source, results.CmdStepSast) } @@ -220,6 +222,7 @@ func filterFailedResultsIfScannersFailuresAreAllowed(targetResults, sourceResult filterScaResultsIfScanFailed(nil, sourceResult) filterJasResultsIfScanFailed(nil, sourceResult, results.CmdStepContextualAnalysis) filterJasResultsIfScanFailed(nil, sourceResult, results.CmdStepSecrets) + filterJasResultsIfScanFailed(nil, sourceResult, results.CmdStepServices) filterJasResultsIfScanFailed(nil, sourceResult, results.CmdStepIaC) filterJasResultsIfScanFailed(nil, sourceResult, results.CmdStepSast) } @@ -263,6 +266,12 @@ func filterSpecificScannersViolationsIfScanFailed(sourceResults *results.Securit sourceResults.Violations.Secrets = nil } + if (sourceStatusCodes.ServicesScanStatusCode != nil && *sourceStatusCodes.ServicesScanStatusCode != 0) || + (targetStatusCodes.ServicesScanStatusCode != nil && *targetStatusCodes.ServicesScanStatusCode != 0) { + log.Debug(fmt.Sprintf(violationsFilteringErrorMessage, results.CmdStepServices)) + sourceResults.Violations.Services = nil + } + if (sourceStatusCodes.IacScanStatusCode != nil && *sourceStatusCodes.IacScanStatusCode != 0) || (targetStatusCodes.IacScanStatusCode != nil && *targetStatusCodes.IacScanStatusCode != 0) { log.Debug(fmt.Sprintf(violationsFilteringErrorMessage, results.CmdStepIaC)) @@ -361,6 +370,10 @@ func filterJasResultsIfScanFailed(targetResult, sourceResult *results.TargetResu if sourceResult.JasResults != nil { sourceResult.JasResults.JasVulnerabilities.SecretsScanResults = nil } + case results.CmdStepServices: + if sourceResult.JasResults != nil { + sourceResult.JasResults.JasVulnerabilities.ServicesScanResults = nil + } case results.CmdStepIaC: if sourceResult.JasResults != nil { sourceResult.JasResults.JasVulnerabilities.IacScanResults = nil @@ -450,6 +463,9 @@ func scanResultsToIssuesCollection(scanResults *results.SecurityCommandResults, IacVulnerabilities: simpleJsonResults.IacsVulnerabilities, IacViolations: simpleJsonResults.IacsViolations, + ServicesVulnerabilities: simpleJsonResults.ServicesVulnerabilities, + ServicesViolations: simpleJsonResults.ServicesViolations, + SecretsVulnerabilities: simpleJsonResults.SecretsVulnerabilities, SecretsViolations: simpleJsonResults.SecretsViolations, @@ -489,6 +505,7 @@ func getScanStatus(cmdResults ...formats.SimpleJsonResults) formats.ScanStatus { for _, sourceResults := range cmdResults[1:] { statuses.ScaStatusCode = getWorstScanStatus(statuses.ScaStatusCode, sourceResults.Statuses.ScaStatusCode) statuses.IacStatusCode = getWorstScanStatus(statuses.IacStatusCode, sourceResults.Statuses.IacStatusCode) + statuses.ServicesStatusCode = getWorstScanStatus(statuses.ServicesStatusCode, sourceResults.Statuses.ServicesStatusCode) statuses.SecretsStatusCode = getWorstScanStatus(statuses.SecretsStatusCode, sourceResults.Statuses.SecretsStatusCode) statuses.SastStatusCode = getWorstScanStatus(statuses.SastStatusCode, sourceResults.Statuses.SastStatusCode) statuses.ApplicabilityStatusCode = getWorstScanStatus(statuses.ApplicabilityStatusCode, sourceResults.Statuses.ApplicabilityStatusCode) diff --git a/utils/issues/issuescollection.go b/utils/issues/issuescollection.go index 08b95bf2b..48b53f1e4 100644 --- a/utils/issues/issuescollection.go +++ b/utils/issues/issuescollection.go @@ -27,6 +27,9 @@ type ScansIssuesCollection struct { IacVulnerabilities []formats.SourceCodeRow IacViolations []formats.SourceCodeRow + ServicesVulnerabilities []formats.SourceCodeRow + ServicesViolations []formats.SourceCodeRow + SecretsVulnerabilities []formats.SourceCodeRow SecretsViolations []formats.SourceCodeRow @@ -78,6 +81,13 @@ func (ic *ScansIssuesCollection) Append(issues *ScansIssuesCollection) { if len(issues.IacViolations) > 0 { ic.IacViolations = append(ic.IacViolations, issues.IacViolations...) } + // Services + if len(issues.ServicesVulnerabilities) > 0 { + ic.ServicesVulnerabilities = append(ic.ServicesVulnerabilities, issues.ServicesVulnerabilities...) + } + if len(issues.ServicesViolations) > 0 { + ic.ServicesViolations = append(ic.ServicesViolations, issues.ServicesViolations...) + } // Last-write-wins, not a true merge: today only one non-nil Violations source is ever appended // (scan-pr calls Append exactly once, from the source-branch scan). Revisit if that changes. if issues.Violations != nil { @@ -92,6 +102,9 @@ func (ic *ScansIssuesCollection) AppendStatus(scanStatus formats.ScanStatus) { if ic.IacStatusCode == nil || (*ic.IacStatusCode == 0 && scanStatus.IacStatusCode != nil) { ic.IacStatusCode = scanStatus.IacStatusCode } + if ic.ServicesStatusCode == nil || (*ic.ServicesStatusCode == 0 && scanStatus.ServicesStatusCode != nil) { + ic.ServicesStatusCode = scanStatus.ServicesStatusCode + } if ic.SecretsStatusCode == nil || (*ic.SecretsStatusCode == 0 && scanStatus.SecretsStatusCode != nil) { ic.SecretsStatusCode = scanStatus.SecretsStatusCode } @@ -115,6 +128,8 @@ func (ic *ScansIssuesCollection) GetScanStatus(scanType utils.SubScanType) *int return ic.ScaStatusCode case utils.IacScan: return ic.IacStatusCode + case utils.ServicesScan: + return ic.ServicesStatusCode case utils.SecretsScan: return ic.SecretsStatusCode case utils.SastScan: @@ -136,6 +151,9 @@ func (ic *ScansIssuesCollection) HasErrors() bool { if iacStatus := ic.GetScanStatus(utils.IacScan); iacStatus != nil && *iacStatus != 0 { return true } + if servicesStatus := ic.GetScanStatus(utils.ServicesScan); servicesStatus != nil && *servicesStatus != 0 { + return true + } if secretsStatus := ic.GetScanStatus(utils.SecretsScan); secretsStatus != nil && *secretsStatus != 0 { return true } @@ -175,6 +193,14 @@ func (ic *ScansIssuesCollection) GetScanIssuesSeverityCount(scanType utils.SubSc if vulnerabilities { jasVulnerabilities = ic.IacVulnerabilities } + case utils.ServicesScan: + // Count Services issues only if requested + if isViolation { + jasViolations = ic.ServicesViolations + } + if vulnerabilities { + jasVulnerabilities = ic.ServicesVulnerabilities + } case utils.SecretsScan: // Count Secrets issues only if requested if isViolation { @@ -203,7 +229,7 @@ func (ic *ScansIssuesCollection) GetScanIssuesSeverityCount(scanType utils.SubSc } func (ic *ScansIssuesCollection) IssuesExists(includeSecrets bool) bool { - return ic.ScaIssuesExists() || ic.IacIssuesExists() || ic.SastIssuesExists() || (includeSecrets && ic.SecretsIssuesExists()) + return ic.ScaIssuesExists() || ic.IacIssuesExists() || ic.SastIssuesExists() || ic.ServicesIssuesExists() || (includeSecrets && ic.SecretsIssuesExists()) } func (ic *ScansIssuesCollection) ScaIssuesExists() bool { @@ -214,6 +240,10 @@ func (ic *ScansIssuesCollection) IacIssuesExists() bool { return len(ic.IacVulnerabilities) > 0 || len(ic.IacViolations) > 0 } +func (ic *ScansIssuesCollection) ServicesIssuesExists() bool { + return len(ic.ServicesVulnerabilities) > 0 || len(ic.ServicesViolations) > 0 +} + func (ic *ScansIssuesCollection) SecretsIssuesExists() bool { return len(ic.SecretsVulnerabilities) > 0 || len(ic.SecretsViolations) > 0 } @@ -260,6 +290,12 @@ func (ic *ScansIssuesCollection) IsFailPrRuleApplied() bool { return true } } + for _, servicesViolation := range ic.ServicesViolations { + if servicesViolation.FailPr { + log.Debug(fmt.Sprintf(FailPrRuleMessage, servicesViolation.ViolationContext.Watch)) + return true + } + } return false } @@ -339,7 +375,7 @@ func (ic *ScansIssuesCollection) GetApplicableEvidences() (evidences []Applicabl // Violations func (ic *ScansIssuesCollection) GetTotalViolations(includeSecrets bool) int { - total := ic.GetTotalScaViolations() + len(ic.IacViolations) + len(ic.SastViolations) + total := ic.GetTotalScaViolations() + len(ic.IacViolations) + len(ic.SastViolations) + len(ic.ServicesViolations) if includeSecrets { total += len(ic.SecretsViolations) } @@ -353,7 +389,7 @@ func (ic *ScansIssuesCollection) GetTotalScaViolations() int { // Vulnerabilities func (ic *ScansIssuesCollection) GetTotalVulnerabilities(includeSecrets bool) int { - total := len(ic.ScaVulnerabilities) + len(ic.IacVulnerabilities) + len(ic.SastVulnerabilities) + total := len(ic.ScaVulnerabilities) + len(ic.IacVulnerabilities) + len(ic.SastVulnerabilities) + len(ic.ServicesVulnerabilities) if includeSecrets { total += len(ic.SecretsVulnerabilities) } diff --git a/utils/utils.go b/utils/utils.go index b8e30ae63..5baec0fa8 100644 --- a/utils/utils.go +++ b/utils/utils.go @@ -365,6 +365,7 @@ func GetVulnerabiltiesUniqueID(vulnerability formats.VulnerabilityOrViolationRow func ConvertSarifPathsToRelative(issues *issues.ScansIssuesCollection, workingDirs ...string) { convertSarifPathsInCveApplicability(issues.ScaVulnerabilities, workingDirs...) convertSarifPathsInIacs(issues.IacVulnerabilities, workingDirs...) + convertSarifPathsInServices(issues.ServicesVulnerabilities, workingDirs...) convertSarifPathsInSecrets(issues.SecretsVulnerabilities, workingDirs...) convertSarifPathsInSast(issues.SastVulnerabilities, workingDirs...) convertSarifPathsInCveApplicability(issues.ScaViolations, workingDirs...) @@ -396,6 +397,15 @@ func convertSarifPathsInIacs(iacs []formats.SourceCodeRow, workingDirs ...string } } +func convertSarifPathsInServices(services []formats.SourceCodeRow, workingDirs ...string) { + for i := range services { + service := &services[i] + for _, wd := range workingDirs { + service.Location.File = utils.GetRelativePath(service.Location.File, wd) + } + } +} + func convertSarifPathsInSecrets(secrets []formats.SourceCodeRow, workingDirs ...string) { for i := range secrets { secret := &secrets[i] From 4ef3ac0589d65b7cb0acbd9e7e764ae1c9491381 Mon Sep 17 00:00:00 2001 From: attiasas Date: Wed, 29 Jul 2026 16:10:15 +0300 Subject: [PATCH 3/4] Output new content --- utils/comment.go | 13 ++++++++++++- utils/outputwriter/outputcontent.go | 20 ++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/utils/comment.go b/utils/comment.go index 9c9d0dd3d..9764be3eb 100644 --- a/utils/comment.go +++ b/utils/comment.go @@ -32,6 +32,7 @@ const ( ApplicableComment ReviewCommentType = "Applicable" IacComment ReviewCommentType = "Iac" SastComment ReviewCommentType = "Sast" + ServicesComment ReviewCommentType = "Services" SecretComment ReviewCommentType = "Secrets" SnippetComment ReviewCommentType = "Snippet" @@ -221,7 +222,15 @@ func getNewReviewComments(repo *Repository, issues *issues.ScansIssuesCollection commentsToAdd = append(commentsToAdd, generateReviewComment(SastComment, similarSastIssues.Location, generateSourceCodeReviewContent(SastComment, true, writer, similarSastIssues.issues...))) } } - + // Services review comments + for _, services := range issues.ServicesVulnerabilities { + commentsToAdd = append(commentsToAdd, generateReviewComment(ServicesComment, services.Location, generateSourceCodeReviewContent(ServicesComment, false, writer, services))) + } + if len(issues.ServicesViolations) > 0 { + for _, similarServicesIssues := range groupSimilarJasIssues(issues.ServicesViolations) { + commentsToAdd = append(commentsToAdd, generateReviewComment(ServicesComment, similarServicesIssues.Location, generateSourceCodeReviewContent(ServicesComment, true, writer, similarServicesIssues.issues...))) + } + } // Secrets review comments if !repo.FrogbotConfig.ShowSecretsAsPrComment { return @@ -386,6 +395,8 @@ func generateSourceCodeReviewContent(commentType ReviewCommentType, violation bo return outputwriter.GenerateReviewCommentContent(outputwriter.SastReviewContent(violation, writer, similarIssues...), writer) case SecretComment: return outputwriter.GenerateReviewCommentContent(outputwriter.SecretReviewContent(violation, writer, similarIssues...), writer) + case ServicesComment: + return outputwriter.GenerateReviewCommentContent(outputwriter.ServicesReviewContent(violation, writer, similarIssues...), writer) } return } diff --git a/utils/outputwriter/outputcontent.go b/utils/outputwriter/outputcontent.go index bb75a89b8..c12cd022d 100644 --- a/utils/outputwriter/outputcontent.go +++ b/utils/outputwriter/outputcontent.go @@ -35,6 +35,7 @@ const ( //#nosec G101 -- not a secret secretsTitle = "🤫 Secret" + servicesTitle = "🔌 Services" contextualAnalysisTitle = "📦🔍 Contextual Analysis CVE" iacTitle = "🛠️ Infrastructure as Code" sastTitle = "🎯 Static Application Security Testing (SAST)" @@ -181,6 +182,7 @@ func ScanSummaryContent(issues issues.ScansIssuesCollection, context results.Res table.AddRow(MarkAsBold("Contextual Analysis"), getSubScanResultStatus(issues.GetScanStatus(utils.ContextualAnalysisScan)), "") table.AddRow(MarkAsBold("Static Application Security Testing (SAST)"), getSubScanResultStatus(issues.GetScanStatus(utils.SastScan)), getScanSecurityIssuesDetails(issues, context, utils.SastScan, writer)) table.AddRow(MarkAsBold("Secrets"), getSubScanResultStatus(issues.GetScanStatus(utils.SecretsScan)), secretsDetails) + table.AddRow(MarkAsBold("Services"), getSubScanResultStatus(issues.GetScanStatus(utils.ServicesScan)), getScanSecurityIssuesDetails(issues, context, utils.ServicesScan, writer)) table.AddRow(MarkAsBold("Infrastructure as Code (IaC)"), getSubScanResultStatus(issues.GetScanStatus(utils.IacScan)), getScanSecurityIssuesDetails(issues, context, utils.IacScan, writer)) WriteContent(&contentBuilder, table.Build()) return contentBuilder.String() @@ -227,6 +229,8 @@ func getScanSecurityIssuesDetails(issues issues.ScansIssuesCollection, context r severityCountMap = issues.GetScanIssuesSeverityCount(utils.SecretsScan, countVulnerabilities, countViolations) case utils.IacScan: severityCountMap = issues.GetScanIssuesSeverityCount(utils.IacScan, countVulnerabilities, countViolations) + case utils.ServicesScan: + severityCountMap = issues.GetScanIssuesSeverityCount(utils.ServicesScan, countVulnerabilities, countViolations) } totalIssues := getTotalIssues(severityCountMap) if totalIssues == 0 { @@ -497,6 +501,22 @@ func IacReviewContent(violation bool, writer OutputWriter, issues ...formats.Sou return contentBuilder.String() } +func ServicesReviewContent(violation bool, writer OutputWriter, issues ...formats.SourceCodeRow) string { + var contentBuilder strings.Builder + WriteContent(&contentBuilder, + writer.MarkAsTitle(fmt.Sprintf("%s %s", servicesTitle, getIssueType(violation)), 2), + writer.MarkInCenter(getJasIssueDescriptionTable(writer, issues...)), + getJasFullDescription(violation, writer, getServicesRuleFullDescriptionTable, issues...), + ) + return contentBuilder.String() +} + +func getServicesRuleFullDescriptionTable(info formats.ScannerInfo, writer OutputWriter) *MarkdownTableBuilder { + table := getBaseJasDetailsTable(info, writer) + table.AddRow(MarkAsBold("Rule ID:"), info.RuleId) + return table +} + func SastReviewContent(violation bool, writer OutputWriter, issues ...formats.SourceCodeRow) string { var contentBuilder strings.Builder WriteContent(&contentBuilder, From c56b1e3c14c2d3773a6093fc71466c3c9dfbc590 Mon Sep 17 00:00:00 2001 From: attiasas Date: Thu, 30 Jul 2026 15:15:56 +0300 Subject: [PATCH 4/4] Update deps --- go.mod | 6 +++--- go.sum | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/go.mod b/go.mod index 2fc30598a..006c475d6 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/jfrog/gofrog v1.7.6 github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e github.com/jfrog/jfrog-cli-security v1.31.3 - github.com/jfrog/jfrog-client-go v1.55.1-0.20260728135425-4a7f34efb305 + github.com/jfrog/jfrog-client-go v1.55.1-0.20260729072925-e1104f6b9e00 github.com/owenrumney/go-sarif/v3 v3.2.3 github.com/stretchr/testify v1.11.1 github.com/urfave/cli/v2 v2.27.7 @@ -131,7 +131,7 @@ require ( ) // attiasas:services-sub-scan-source-code -replace github.com/jfrog/jfrog-cli-security => github.com/attiasas/jfrog-cli-security v0.0.0-20260729091050-19a015b12436 +replace github.com/jfrog/jfrog-cli-security => github.com/attiasas/jfrog-cli-security v0.0.0-20260730121053-1ffb8298f1fe // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev @@ -140,6 +140,6 @@ replace github.com/jfrog/jfrog-cli-security => github.com/attiasas/jfrog-cli-sec // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go dev // orto17:missconfiguration-service -replace github.com/jfrog/jfrog-client-go => github.com/orto17/jfrog-client-go v0.0.0-20260728142826-c098e2d936bf +replace github.com/jfrog/jfrog-client-go => github.com/orto17/jfrog-client-go v0.0.0-20260729095022-f0072c4ddd4b // replace github.com/jfrog/froggit-go => github.com/jfrog/froggit-go master diff --git a/go.sum b/go.sum index 284160432..71a3ece16 100644 --- a/go.sum +++ b/go.sum @@ -21,8 +21,8 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFI github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/attiasas/jfrog-cli-security v0.0.0-20260729091050-19a015b12436 h1:uY1A8FdAf+lB0sWZyoJp+c9tUVSKVDE/4zcvLsNQQvY= -github.com/attiasas/jfrog-cli-security v0.0.0-20260729091050-19a015b12436/go.mod h1:wFFpDWGr2dXFz4lE9ChAn+VVWIqzrWjBkOCKP+hY0Wk= +github.com/attiasas/jfrog-cli-security v0.0.0-20260730121053-1ffb8298f1fe h1:stpBcJTF5nyeK8EQVnEHc5EAyQxeEoSLdy0O+mV6SAU= +github.com/attiasas/jfrog-cli-security v0.0.0-20260730121053-1ffb8298f1fe/go.mod h1:QMB1JjQik4QfvVHKu46Niry8Er/pGo+oh7QOa05ukeY= github.com/beevik/etree v1.7.0 h1:xjBk9O4p4x7D1YajePjfLzdaFC4/uYUENA7P0pv6gXA= github.com/beevik/etree v1.7.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc= github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M= @@ -213,8 +213,8 @@ github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw= github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA= github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A= github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k= -github.com/orto17/jfrog-client-go v0.0.0-20260728142826-c098e2d936bf h1:CPQgMBf4XsvIdi2T5ktqrsYzJwkbWPz5jxuBqakhIhc= -github.com/orto17/jfrog-client-go v0.0.0-20260728142826-c098e2d936bf/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= +github.com/orto17/jfrog-client-go v0.0.0-20260729095022-f0072c4ddd4b h1:sxMPb46s61Wzde900lemIxsIWocktOi9vxmjGeN1ZAc= +github.com/orto17/jfrog-client-go v0.0.0-20260729095022-f0072c4ddd4b/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/owenrumney/go-sarif/v3 v3.2.3 h1:n6mdX5ugKwCrZInvBsf6WumXmpAe3mbmQXgkXlIq34U= github.com/owenrumney/go-sarif/v3 v3.2.3/go.mod h1:1bV7t8SZg7pX41spaDkEUs8/yEjzk9JapztMoX1XNjg= github.com/package-url/packageurl-go v0.1.3 h1:4juMED3hHiz0set3Vq3KeQ75KD1avthoXLtmE3I0PLs=