From 56fc75e5ea33dd4600babb052f4f789aeb68ff46 Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Tue, 4 Aug 2026 11:29:46 +0300 Subject: [PATCH 1/3] use new SendScanEndedEvent --- go.mod | 6 +- go.sum | 12 +-- scanpullrequest/scanpullrequest.go | 13 +-- scanrepository/scanrepository.go | 50 +++--------- scanrepository/scanrepository_test.go | 110 -------------------------- 5 files changed, 25 insertions(+), 166 deletions(-) diff --git a/go.mod b/go.mod index 7b2f39118..8afc87588 100644 --- a/go.mod +++ b/go.mod @@ -9,12 +9,12 @@ require ( github.com/go-git/go-git/v5 v5.19.1 github.com/golang/mock v1.6.0 github.com/google/go-github/v45 v45.2.0 - github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d + github.com/jfrog/build-info-go v1.13.1-0.20260803032325-7865244a87b5 github.com/jfrog/froggit-go v1.23.1 github.com/jfrog/gofrog v1.7.6 github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e github.com/jfrog/jfrog-cli-security v1.32.0 - github.com/jfrog/jfrog-client-go v1.55.1-0.20260729072925-e1104f6b9e00 + github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195 github.com/owenrumney/go-sarif/v3 v3.2.3 github.com/stretchr/testify v1.11.1 github.com/urfave/cli/v2 v2.27.7 @@ -130,7 +130,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security dev +replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev diff --git a/go.sum b/go.sum index 07e915567..62fb33b07 100644 --- a/go.sum +++ b/go.sum @@ -61,6 +61,8 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b h1:3UCHa3TgUy/uEDMXMBROjSsqQ0YvzzD/E4zMtwQvPeI= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b/go.mod h1:az2LjaYenQL+l2c06Lm3lW6xDV8IcTkx63KHK/WSYSA= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= @@ -142,8 +144,8 @@ github.com/jedib0t/go-pretty/v6 v6.8.3 h1:yVSk5aemoYHCvcrtqyXklwqcgHQIQzmy/oUzFl github.com/jedib0t/go-pretty/v6 v6.8.3/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU= github.com/jfrog/archiver/v3 v3.6.3 h1:hkAmPjBw393tPmQ07JknLNWFNZjXdy2xFEnOW9wwOxI= github.com/jfrog/archiver/v3 v3.6.3/go.mod h1:5V9l+Fte30Y4qe9dUOAd3yNTf8lmtVNuhKNrvI8PMhg= -github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d h1:Yqbx+/9cIiZJmpyIkWDyC9Qjh4OaVeGWutADFaUzHr0= -github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d/go.mod h1:CYRUCvLKfyARjoJXLWAxce1qNUxTEtbRKAARkV42vpE= +github.com/jfrog/build-info-go v1.13.1-0.20260803032325-7865244a87b5 h1:CpYQMkM0+ZYE+zlSfmyDDoXleazRAODXmAm+eMridKg= +github.com/jfrog/build-info-go v1.13.1-0.20260803032325-7865244a87b5/go.mod h1:CYRUCvLKfyARjoJXLWAxce1qNUxTEtbRKAARkV42vpE= github.com/jfrog/froggit-go v1.23.1 h1:4wmaHeuptxVINbovMaeITzVhi3+VQoc/FFIjF4axzu0= github.com/jfrog/froggit-go v1.23.1/go.mod h1:wRDryqyp3oe+eHgME2mpnEQmO8XBECIPagFwj0nHmdI= github.com/jfrog/gofrog v1.7.6 h1:QmfAiRzVyaI7JYGsB7cxfAJePAZTzFz0gRWZSE27c6s= @@ -154,10 +156,8 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260801102623-d512ca031f85 h1:9 github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260801102623-d512ca031f85/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e h1:K0IK3w5a5h6SIi9yoOJ6a7DL+kuFjs5acypOxKyT2OM= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0= -github.com/jfrog/jfrog-cli-security v1.32.0 h1:O+GHLFlBtQTUIB5Mv8qBROeXvy2Om2ZH0vo8Dmrb5JQ= -github.com/jfrog/jfrog-cli-security v1.32.0/go.mod h1:2DVy/0F2EFhF2/gbtXVK6OckYX6DoUVMEjp8Z5Gmmbc= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260729072925-e1104f6b9e00 h1:QekOqpZ4c34Xb/eX9UCM1JMGipGoW/ZpkbwsWrx/kAQ= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260729072925-e1104f6b9e00/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= +github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195 h1:1h6qSM8fanMsy9xT7zrRn/lrAMclzQzT5OJt4a9X4Qo= +github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo= github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY= diff --git a/scanpullrequest/scanpullrequest.go b/scanpullrequest/scanpullrequest.go index 5cc0d2888..66bac1e94 100644 --- a/scanpullrequest/scanpullrequest.go +++ b/scanpullrequest/scanpullrequest.go @@ -91,14 +91,7 @@ func auditPullRequestAndReport(repoConfig *utils.Repository, client vcsclient.Vc repoConfig.Params.JFrogPlatform.JFrogProjectKey, ) defer func() { - if issuesCollection != nil { - xsc.SendScanEndedEvent( - scanDetails.XrayVersion, - scanDetails.XscVersion, - scanDetails.ServerDetails, - scanDetails.MultiScanId, scanDetails.StartTime, issuesCollection.GetAllIssuesCount(true), &scanDetails.ResultContext, err, - ) - } + xsc.SendScanEndedEvent(scanDetails.ServerDetails, scanResults) }() issuesCollection, scanResults, err = auditPullRequestCode(repoConfig, scanDetails, sourceBranchWd, targetBranchWd) return @@ -144,7 +137,7 @@ func auditPullRequestCode(repoConfig *utils.Repository, scanDetails *utils.ScanD log.Debug("Scanning target branch code...") if targetScanResults, e := auditPullRequestTargetCode(scanDetails, targetBranchWd); e != nil { issuesCollection.AppendStatus(getResultScanStatues(targetScanResults)) - return issuesCollection, nil, fmt.Errorf("failed to audit target branch. Error: %s", e.Error()) + return issuesCollection, targetScanResults, fmt.Errorf("failed to audit target branch. Error: %s", e.Error()) } else { scanDetails.SetResultsToCompare(targetScanResults) } @@ -155,7 +148,7 @@ func auditPullRequestCode(repoConfig *utils.Repository, scanDetails *utils.ScanD // Scan error, report the scan status issuesCollection.AppendStatus(pullRequestIssues.ScanStatus) } - return issuesCollection, nil, fmt.Errorf("failed to audit source branch code. Error: %s", e.Error()) + return issuesCollection, sourceScanResults, fmt.Errorf("failed to audit source branch code. Error: %s", e.Error()) } issuesCollection.Append(pullRequestIssues) scanResults = sourceScanResults diff --git a/scanrepository/scanrepository.go b/scanrepository/scanrepository.go index 44d2c97c1..ca5edafaf 100644 --- a/scanrepository/scanrepository.go +++ b/scanrepository/scanrepository.go @@ -106,11 +106,11 @@ func (sr *ScanRepositoryCmd) prepareEnvAndScanBranch(repository *utils.Repositor repository.Params.JFrogPlatform.JFrogProjectKey, ) - findings := 0 + var scanResults *results.SecurityCommandResults defer func() { - xsc.SendScanEndedEvent(sr.scanDetails.XrayVersion, sr.scanDetails.XscVersion, sr.scanDetails.ServerDetails, sr.scanDetails.MultiScanId, sr.scanDetails.StartTime, findings, &sr.scanDetails.ResultContext, err) + xsc.SendScanEndedEvent(sr.scanDetails.ServerDetails, scanResults) }() - findings, err = sr.scanAndFixBranch(repository) + scanResults, err = sr.scanAndFixBranch(repository) return } @@ -143,19 +143,13 @@ func (sr *ScanRepositoryCmd) setCommandPrerequisites(repository *utils.Repositor return } -func (sr *ScanRepositoryCmd) scanAndFixBranch(repository *utils.Repository) (totalFindings int, err error) { - scanResults, err := sr.scan() +func (sr *ScanRepositoryCmd) scanAndFixBranch(repository *utils.Repository) (scanResults *results.SecurityCommandResults, err error) { + scanResults, err = sr.scan() if err != nil { if err = utils.CreateErrorIfFailUponScannerErrorEnabled(repository.GeneralConfig.FailUponAnyScannerError, fmt.Sprintf("An error occurred during Audit execution for '%s' branch. Fixes will be skipped for this branch", sr.scanDetails.BaseBranch()), err); err != nil { - return 0, err + return scanResults, err } - } - if scanResults == nil { - err = fmt.Errorf("scan returned empty results for branch '%s'", sr.scanDetails.BaseBranch()) - if err = utils.CreateErrorIfFailUponScannerErrorEnabled(repository.GeneralConfig.FailUponAnyScannerError, fmt.Sprintf("An error occurred during Audit execution for '%s' branch. Downstream processing will be skipped", sr.scanDetails.BaseBranch()), err); err != nil { - return 0, err - } - return 0, nil + return scanResults, nil } defer func() { // Always check policy even if an error occurred during the scan @@ -165,42 +159,24 @@ func (sr *ScanRepositoryCmd) scanAndFixBranch(repository *utils.Repository) (tot } }() utils.PrintScanResultsTable(scanResults) - totalFindings = getTotalFindingsFromScanResults(scanResults) sr.uploadResultsToGithubDashboardsIfNeeded(repository, scanResults) sr.uploadGitLabScanResultsIfNeeded(repository, scanResults) if !repository.Params.FrogbotConfig.CreateAutoFixPr { log.Info(fmt.Sprintf("This command is running in detection mode only. To enable automatic fixing of issues, set the '%s' flag under the repository's configuration settings in Jfrog platform", createAutoFixPrConfigNameInProfile)) - return totalFindings, nil + return scanResults, nil } vulnerabilitiesByPathMap, err := sr.createVulnerabilitiesMap(repository.GeneralConfig.FailUponAnyScannerError, scanResults) if err != nil { if err = utils.CreateErrorIfFailUponScannerErrorEnabled(repository.GeneralConfig.FailUponAnyScannerError, fmt.Sprintf("An error occurred while preparing the vulnerabilities map for branch '%s'.", sr.scanDetails.BaseBranch()), err); err != nil { - return 0, err + return scanResults, err } } if len(vulnerabilitiesByPathMap) == 0 { log.Info(fmt.Sprintf("Didn't find any vulnerable dependencies with existing fix versions or that are currently supported for fixing, for %s", sr.scanDetails.RepoName)) - return totalFindings, nil - } - return totalFindings, sr.fixVulnerablePackages(repository, vulnerabilitiesByPathMap) -} - -func getTotalFindingsFromScanResults(scanResults *results.SecurityCommandResults) int { - if scanResults == nil { - return 0 + return scanResults, nil } - - summary, err := conversion.NewCommandResultsConvertor(conversion.ResultConvertParams{IncludeVulnerabilities: scanResults.IncludesVulnerabilities(), HasViolationContext: scanResults.HasViolationContext()}).ConvertToSummary(scanResults) - if err != nil { - log.Error("Failed to extract findings summary from scan results:", err) - return 0 - } - findingCount := summary.GetTotalViolations() - if findingCount == 0 { - findingCount = summary.GetTotalVulnerabilities() - } - return findingCount + return scanResults, sr.fixVulnerablePackages(repository, vulnerabilitiesByPathMap) } func (sr *ScanRepositoryCmd) uploadGitLabScanResultsIfNeeded(repository *utils.Repository, scanResults *results.SecurityCommandResults) { @@ -233,7 +209,7 @@ func (sr *ScanRepositoryCmd) uploadResultsToGithubDashboardsIfNeeded(repository func (sr *ScanRepositoryCmd) scan() (*results.SecurityCommandResults, error) { auditResults := sr.scanDetails.Audit(sr.baseWd) if err := auditResults.GetErrors(); err != nil { - return nil, err + return auditResults, err } log.Info("Xray scan completed") sr.OutputWriter.SetJasOutputFlags(auditResults.Entitlements.Jas, auditResults.HasJasScansResults(jasutils.Applicability)) @@ -686,7 +662,7 @@ func (sr *ScanRepositoryCmd) aggregateFixAndOpenPullRequest(repository *utils.Re // Determines whether an update is necessary: // First, checks if the working tree is clean. If so, no update is required. // Second, checks if there is an already open pull request for the fix. If so, no update is needed. -// Lastly, performs a comparison of Xray scan result hashes between an existing pull request's remote source branch and the current source branch to identify any differences. +// Lastly, performs a comparison of Xray scans result hashes between an existing pull request's remote source branch and the current source branch to identify any differences. func (sr *ScanRepositoryCmd) isUpdateRequired(fixedVulnerabilities []*utils.VulnerabilityDetails, prInfo *vcsclient.PullRequestInfo) (updateRequired bool, err error) { isClean, err := sr.gitManager.IsClean() if err != nil { diff --git a/scanrepository/scanrepository_test.go b/scanrepository/scanrepository_test.go index ec8b6ec27..3e93af094 100644 --- a/scanrepository/scanrepository_test.go +++ b/scanrepository/scanrepository_test.go @@ -638,116 +638,6 @@ func loadTestSBOM(t *testing.T, filename string) *cyclonedx.BOM { return bom } -func TestGetTotalFindingsFromScanResults(t *testing.T) { - testCases := []struct { - name string - scanResults *results.SecurityCommandResults - expectedCount int - }{ - { - name: "Nil scan results", - scanResults: nil, - expectedCount: 0, - }, - { - name: "No violations or vulnerabilities", - scanResults: &results.SecurityCommandResults{Targets: []*results.TargetResults{{ - ScanTarget: results.ScanTarget{Target: "target1"}, - }}}, - expectedCount: 0, - }, - { - name: "Vulnerabilities only", - scanResults: &results.SecurityCommandResults{ - ResultsMetaData: results.ResultsMetaData{ - ResultContext: results.ResultContext{IncludeVulnerabilities: true}}, - Targets: []*results.TargetResults{{ - ScanTarget: results.ScanTarget{Target: "target1", Technologies: []techutils.Technology{techutils.Npm}}, - ScaResults: &results.ScaScanResults{ - Sbom: loadTestSBOM(t, "sbom_with_vulnerabilities.json"), - }, - }}, - }, - expectedCount: 4, - }, - { - name: "Violations only", - scanResults: &results.SecurityCommandResults{ - ResultsMetaData: results.ResultsMetaData{ - ResultContext: results.ResultContext{Watches: []string{"w1"}}}, - Targets: []*results.TargetResults{{ - ScanTarget: results.ScanTarget{Target: "target1", Technologies: []techutils.Technology{techutils.Npm}}, - }}, - Violations: &violationutils.Violations{ - Sca: []violationutils.CveViolation{ - { - ScaViolation: violationutils.ScaViolation{ - ImpactedComponent: &cyclonedx.Component{ - BOMRef: "pkg:npm/viol1@1.0.0", - PackageURL: "pkg:npm/viol1@1.0.0", - }, - }, - CveVulnerability: cyclonedx.Vulnerability{BOMRef: "CVE-2023-1234"}, - }, - { - ScaViolation: violationutils.ScaViolation{ - ImpactedComponent: &cyclonedx.Component{ - BOMRef: "pkg:npm/viol2@2.0.0", - PackageURL: "pkg:npm/viol2@2.0.0", - }, - }, - CveVulnerability: cyclonedx.Vulnerability{BOMRef: "CVE-2022-1234"}, - }, - }, - }, - }, - expectedCount: 2, - }, - { - name: "Violations take precedence over vulnerabilities", - scanResults: &results.SecurityCommandResults{ - ResultsMetaData: results.ResultsMetaData{ - ResultContext: results.ResultContext{IncludeVulnerabilities: true, Watches: []string{"w1"}}}, - Targets: []*results.TargetResults{{ - ScanTarget: results.ScanTarget{Target: "target1", Technologies: []techutils.Technology{techutils.Npm}}, - ScaResults: &results.ScaScanResults{ - Sbom: loadTestSBOM(t, "sbom_with_vulnerabilities.json"), - }, - }}, - Violations: &violationutils.Violations{ - Sca: []violationutils.CveViolation{ - { - ScaViolation: violationutils.ScaViolation{ - ImpactedComponent: &cyclonedx.Component{ - BOMRef: "pkg:npm/viol1@1.0.0", - PackageURL: "pkg:npm/viol1@1.0.0", - }, - }, - CveVulnerability: cyclonedx.Vulnerability{BOMRef: "CVE-2023-1234"}, - }, - { - ScaViolation: violationutils.ScaViolation{ - ImpactedComponent: &cyclonedx.Component{ - BOMRef: "pkg:npm/viol2@2.0.0", - PackageURL: "pkg:npm/viol2@2.0.0", - }, - }, - CveVulnerability: cyclonedx.Vulnerability{BOMRef: "CVE-2022-1234"}, - }, - }, - }, - }, - expectedCount: 2, - }, - } - - for _, testCase := range testCases { - t.Run(testCase.name, func(t *testing.T) { - assert.Equal(t, testCase.expectedCount, getTotalFindingsFromScanResults(testCase.scanResults)) - }) - } -} - // Verifies unsupported packages return specific error // Other logic is implemented inside each package-handler. func TestUpdatePackageToFixedVersion(t *testing.T) { From db9b4ab8572036d03c94fbecba6058db5c39054d Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Tue, 4 Aug 2026 13:52:17 +0300 Subject: [PATCH 2/3] . --- go.mod | 2 +- go.sum | 4 ++-- scanpullrequest/scanpullrequest.go | 2 +- scanrepository/scanrepository.go | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/go.mod b/go.mod index 8afc87588..f625c523a 100644 --- a/go.mod +++ b/go.mod @@ -130,7 +130,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b +// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security dev // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev diff --git a/go.sum b/go.sum index 62fb33b07..f62ea8b7d 100644 --- a/go.sum +++ b/go.sum @@ -61,8 +61,6 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= -github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b h1:3UCHa3TgUy/uEDMXMBROjSsqQ0YvzzD/E4zMtwQvPeI= -github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b/go.mod h1:az2LjaYenQL+l2c06Lm3lW6xDV8IcTkx63KHK/WSYSA= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= @@ -156,6 +154,8 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260801102623-d512ca031f85 h1:9 github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260801102623-d512ca031f85/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e h1:K0IK3w5a5h6SIi9yoOJ6a7DL+kuFjs5acypOxKyT2OM= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0= +github.com/jfrog/jfrog-cli-security v1.32.0 h1:O+GHLFlBtQTUIB5Mv8qBROeXvy2Om2ZH0vo8Dmrb5JQ= +github.com/jfrog/jfrog-cli-security v1.32.0/go.mod h1:2DVy/0F2EFhF2/gbtXVK6OckYX6DoUVMEjp8Z5Gmmbc= github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195 h1:1h6qSM8fanMsy9xT7zrRn/lrAMclzQzT5OJt4a9X4Qo= github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= diff --git a/scanpullrequest/scanpullrequest.go b/scanpullrequest/scanpullrequest.go index 66bac1e94..7bd410ae5 100644 --- a/scanpullrequest/scanpullrequest.go +++ b/scanpullrequest/scanpullrequest.go @@ -91,7 +91,7 @@ func auditPullRequestAndReport(repoConfig *utils.Repository, client vcsclient.Vc repoConfig.Params.JFrogPlatform.JFrogProjectKey, ) defer func() { - xsc.SendScanEndedEvent(scanDetails.ServerDetails, scanResults) + xsc.SendScanEndedWithResults(scanDetails.ServerDetails, scanResults) }() issuesCollection, scanResults, err = auditPullRequestCode(repoConfig, scanDetails, sourceBranchWd, targetBranchWd) return diff --git a/scanrepository/scanrepository.go b/scanrepository/scanrepository.go index ca5edafaf..774523536 100644 --- a/scanrepository/scanrepository.go +++ b/scanrepository/scanrepository.go @@ -108,7 +108,7 @@ func (sr *ScanRepositoryCmd) prepareEnvAndScanBranch(repository *utils.Repositor var scanResults *results.SecurityCommandResults defer func() { - xsc.SendScanEndedEvent(sr.scanDetails.ServerDetails, scanResults) + xsc.SendScanEndedWithResults(sr.scanDetails.ServerDetails, scanResults) }() scanResults, err = sr.scanAndFixBranch(repository) return From d144ed8a1a9e6e0883487a89491883056c867bc0 Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Tue, 4 Aug 2026 17:10:11 +0300 Subject: [PATCH 3/3] mistakenly removed param while merge remote --- scanrepository/scanrepository.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanrepository/scanrepository.go b/scanrepository/scanrepository.go index a9777a686..66a52a4ed 100644 --- a/scanrepository/scanrepository.go +++ b/scanrepository/scanrepository.go @@ -176,7 +176,7 @@ func (sr *ScanRepositoryCmd) scanAndFixBranch(repository *utils.Repository) (sca log.Info(fmt.Sprintf("Didn't find any vulnerable dependencies with existing fix versions or that are currently supported for fixing, for %s", sr.scanDetails.RepoName)) return scanResults, nil } - return scanResults, sr.fixVulnerablePackages(repository, vulnerabilitiesByPathMap) + return scanResults, sr.fixVulnerablePackages(repository, scanResults.ResultsPlatformUrl, vulnerabilitiesByPathMap) } func (sr *ScanRepositoryCmd) uploadGitLabScanResultsIfNeeded(repository *utils.Repository, scanResults *results.SecurityCommandResults) {