From 56fc75e5ea33dd4600babb052f4f789aeb68ff46 Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Tue, 4 Aug 2026 11:29:46 +0300 Subject: [PATCH 1/6] use new SendScanEndedEvent --- go.mod | 6 +- go.sum | 12 +-- scanpullrequest/scanpullrequest.go | 13 +-- scanrepository/scanrepository.go | 50 +++--------- scanrepository/scanrepository_test.go | 110 -------------------------- 5 files changed, 25 insertions(+), 166 deletions(-) diff --git a/go.mod b/go.mod index 7b2f39118..8afc87588 100644 --- a/go.mod +++ b/go.mod @@ -9,12 +9,12 @@ require ( github.com/go-git/go-git/v5 v5.19.1 github.com/golang/mock v1.6.0 github.com/google/go-github/v45 v45.2.0 - github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d + github.com/jfrog/build-info-go v1.13.1-0.20260803032325-7865244a87b5 github.com/jfrog/froggit-go v1.23.1 github.com/jfrog/gofrog v1.7.6 github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e github.com/jfrog/jfrog-cli-security v1.32.0 - github.com/jfrog/jfrog-client-go v1.55.1-0.20260729072925-e1104f6b9e00 + github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195 github.com/owenrumney/go-sarif/v3 v3.2.3 github.com/stretchr/testify v1.11.1 github.com/urfave/cli/v2 v2.27.7 @@ -130,7 +130,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security dev +replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev diff --git a/go.sum b/go.sum index 07e915567..62fb33b07 100644 --- a/go.sum +++ b/go.sum @@ -61,6 +61,8 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b h1:3UCHa3TgUy/uEDMXMBROjSsqQ0YvzzD/E4zMtwQvPeI= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b/go.mod h1:az2LjaYenQL+l2c06Lm3lW6xDV8IcTkx63KHK/WSYSA= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= @@ -142,8 +144,8 @@ github.com/jedib0t/go-pretty/v6 v6.8.3 h1:yVSk5aemoYHCvcrtqyXklwqcgHQIQzmy/oUzFl github.com/jedib0t/go-pretty/v6 v6.8.3/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU= github.com/jfrog/archiver/v3 v3.6.3 h1:hkAmPjBw393tPmQ07JknLNWFNZjXdy2xFEnOW9wwOxI= github.com/jfrog/archiver/v3 v3.6.3/go.mod h1:5V9l+Fte30Y4qe9dUOAd3yNTf8lmtVNuhKNrvI8PMhg= -github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d h1:Yqbx+/9cIiZJmpyIkWDyC9Qjh4OaVeGWutADFaUzHr0= -github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d/go.mod h1:CYRUCvLKfyARjoJXLWAxce1qNUxTEtbRKAARkV42vpE= +github.com/jfrog/build-info-go v1.13.1-0.20260803032325-7865244a87b5 h1:CpYQMkM0+ZYE+zlSfmyDDoXleazRAODXmAm+eMridKg= +github.com/jfrog/build-info-go v1.13.1-0.20260803032325-7865244a87b5/go.mod h1:CYRUCvLKfyARjoJXLWAxce1qNUxTEtbRKAARkV42vpE= github.com/jfrog/froggit-go v1.23.1 h1:4wmaHeuptxVINbovMaeITzVhi3+VQoc/FFIjF4axzu0= github.com/jfrog/froggit-go v1.23.1/go.mod h1:wRDryqyp3oe+eHgME2mpnEQmO8XBECIPagFwj0nHmdI= github.com/jfrog/gofrog v1.7.6 h1:QmfAiRzVyaI7JYGsB7cxfAJePAZTzFz0gRWZSE27c6s= @@ -154,10 +156,8 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260801102623-d512ca031f85 h1:9 github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260801102623-d512ca031f85/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e h1:K0IK3w5a5h6SIi9yoOJ6a7DL+kuFjs5acypOxKyT2OM= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0= -github.com/jfrog/jfrog-cli-security v1.32.0 h1:O+GHLFlBtQTUIB5Mv8qBROeXvy2Om2ZH0vo8Dmrb5JQ= -github.com/jfrog/jfrog-cli-security v1.32.0/go.mod h1:2DVy/0F2EFhF2/gbtXVK6OckYX6DoUVMEjp8Z5Gmmbc= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260729072925-e1104f6b9e00 h1:QekOqpZ4c34Xb/eX9UCM1JMGipGoW/ZpkbwsWrx/kAQ= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260729072925-e1104f6b9e00/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= +github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195 h1:1h6qSM8fanMsy9xT7zrRn/lrAMclzQzT5OJt4a9X4Qo= +github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo= github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY= diff --git a/scanpullrequest/scanpullrequest.go b/scanpullrequest/scanpullrequest.go index 5cc0d2888..66bac1e94 100644 --- a/scanpullrequest/scanpullrequest.go +++ b/scanpullrequest/scanpullrequest.go @@ -91,14 +91,7 @@ func auditPullRequestAndReport(repoConfig *utils.Repository, client vcsclient.Vc repoConfig.Params.JFrogPlatform.JFrogProjectKey, ) defer func() { - if issuesCollection != nil { - xsc.SendScanEndedEvent( - scanDetails.XrayVersion, - scanDetails.XscVersion, - scanDetails.ServerDetails, - scanDetails.MultiScanId, scanDetails.StartTime, issuesCollection.GetAllIssuesCount(true), &scanDetails.ResultContext, err, - ) - } + xsc.SendScanEndedEvent(scanDetails.ServerDetails, scanResults) }() issuesCollection, scanResults, err = auditPullRequestCode(repoConfig, scanDetails, sourceBranchWd, targetBranchWd) return @@ -144,7 +137,7 @@ func auditPullRequestCode(repoConfig *utils.Repository, scanDetails *utils.ScanD log.Debug("Scanning target branch code...") if targetScanResults, e := auditPullRequestTargetCode(scanDetails, targetBranchWd); e != nil { issuesCollection.AppendStatus(getResultScanStatues(targetScanResults)) - return issuesCollection, nil, fmt.Errorf("failed to audit target branch. Error: %s", e.Error()) + return issuesCollection, targetScanResults, fmt.Errorf("failed to audit target branch. Error: %s", e.Error()) } else { scanDetails.SetResultsToCompare(targetScanResults) } @@ -155,7 +148,7 @@ func auditPullRequestCode(repoConfig *utils.Repository, scanDetails *utils.ScanD // Scan error, report the scan status issuesCollection.AppendStatus(pullRequestIssues.ScanStatus) } - return issuesCollection, nil, fmt.Errorf("failed to audit source branch code. Error: %s", e.Error()) + return issuesCollection, sourceScanResults, fmt.Errorf("failed to audit source branch code. Error: %s", e.Error()) } issuesCollection.Append(pullRequestIssues) scanResults = sourceScanResults diff --git a/scanrepository/scanrepository.go b/scanrepository/scanrepository.go index 44d2c97c1..ca5edafaf 100644 --- a/scanrepository/scanrepository.go +++ b/scanrepository/scanrepository.go @@ -106,11 +106,11 @@ func (sr *ScanRepositoryCmd) prepareEnvAndScanBranch(repository *utils.Repositor repository.Params.JFrogPlatform.JFrogProjectKey, ) - findings := 0 + var scanResults *results.SecurityCommandResults defer func() { - xsc.SendScanEndedEvent(sr.scanDetails.XrayVersion, sr.scanDetails.XscVersion, sr.scanDetails.ServerDetails, sr.scanDetails.MultiScanId, sr.scanDetails.StartTime, findings, &sr.scanDetails.ResultContext, err) + xsc.SendScanEndedEvent(sr.scanDetails.ServerDetails, scanResults) }() - findings, err = sr.scanAndFixBranch(repository) + scanResults, err = sr.scanAndFixBranch(repository) return } @@ -143,19 +143,13 @@ func (sr *ScanRepositoryCmd) setCommandPrerequisites(repository *utils.Repositor return } -func (sr *ScanRepositoryCmd) scanAndFixBranch(repository *utils.Repository) (totalFindings int, err error) { - scanResults, err := sr.scan() +func (sr *ScanRepositoryCmd) scanAndFixBranch(repository *utils.Repository) (scanResults *results.SecurityCommandResults, err error) { + scanResults, err = sr.scan() if err != nil { if err = utils.CreateErrorIfFailUponScannerErrorEnabled(repository.GeneralConfig.FailUponAnyScannerError, fmt.Sprintf("An error occurred during Audit execution for '%s' branch. Fixes will be skipped for this branch", sr.scanDetails.BaseBranch()), err); err != nil { - return 0, err + return scanResults, err } - } - if scanResults == nil { - err = fmt.Errorf("scan returned empty results for branch '%s'", sr.scanDetails.BaseBranch()) - if err = utils.CreateErrorIfFailUponScannerErrorEnabled(repository.GeneralConfig.FailUponAnyScannerError, fmt.Sprintf("An error occurred during Audit execution for '%s' branch. Downstream processing will be skipped", sr.scanDetails.BaseBranch()), err); err != nil { - return 0, err - } - return 0, nil + return scanResults, nil } defer func() { // Always check policy even if an error occurred during the scan @@ -165,42 +159,24 @@ func (sr *ScanRepositoryCmd) scanAndFixBranch(repository *utils.Repository) (tot } }() utils.PrintScanResultsTable(scanResults) - totalFindings = getTotalFindingsFromScanResults(scanResults) sr.uploadResultsToGithubDashboardsIfNeeded(repository, scanResults) sr.uploadGitLabScanResultsIfNeeded(repository, scanResults) if !repository.Params.FrogbotConfig.CreateAutoFixPr { log.Info(fmt.Sprintf("This command is running in detection mode only. To enable automatic fixing of issues, set the '%s' flag under the repository's configuration settings in Jfrog platform", createAutoFixPrConfigNameInProfile)) - return totalFindings, nil + return scanResults, nil } vulnerabilitiesByPathMap, err := sr.createVulnerabilitiesMap(repository.GeneralConfig.FailUponAnyScannerError, scanResults) if err != nil { if err = utils.CreateErrorIfFailUponScannerErrorEnabled(repository.GeneralConfig.FailUponAnyScannerError, fmt.Sprintf("An error occurred while preparing the vulnerabilities map for branch '%s'.", sr.scanDetails.BaseBranch()), err); err != nil { - return 0, err + return scanResults, err } } if len(vulnerabilitiesByPathMap) == 0 { log.Info(fmt.Sprintf("Didn't find any vulnerable dependencies with existing fix versions or that are currently supported for fixing, for %s", sr.scanDetails.RepoName)) - return totalFindings, nil - } - return totalFindings, sr.fixVulnerablePackages(repository, vulnerabilitiesByPathMap) -} - -func getTotalFindingsFromScanResults(scanResults *results.SecurityCommandResults) int { - if scanResults == nil { - return 0 + return scanResults, nil } - - summary, err := conversion.NewCommandResultsConvertor(conversion.ResultConvertParams{IncludeVulnerabilities: scanResults.IncludesVulnerabilities(), HasViolationContext: scanResults.HasViolationContext()}).ConvertToSummary(scanResults) - if err != nil { - log.Error("Failed to extract findings summary from scan results:", err) - return 0 - } - findingCount := summary.GetTotalViolations() - if findingCount == 0 { - findingCount = summary.GetTotalVulnerabilities() - } - return findingCount + return scanResults, sr.fixVulnerablePackages(repository, vulnerabilitiesByPathMap) } func (sr *ScanRepositoryCmd) uploadGitLabScanResultsIfNeeded(repository *utils.Repository, scanResults *results.SecurityCommandResults) { @@ -233,7 +209,7 @@ func (sr *ScanRepositoryCmd) uploadResultsToGithubDashboardsIfNeeded(repository func (sr *ScanRepositoryCmd) scan() (*results.SecurityCommandResults, error) { auditResults := sr.scanDetails.Audit(sr.baseWd) if err := auditResults.GetErrors(); err != nil { - return nil, err + return auditResults, err } log.Info("Xray scan completed") sr.OutputWriter.SetJasOutputFlags(auditResults.Entitlements.Jas, auditResults.HasJasScansResults(jasutils.Applicability)) @@ -686,7 +662,7 @@ func (sr *ScanRepositoryCmd) aggregateFixAndOpenPullRequest(repository *utils.Re // Determines whether an update is necessary: // First, checks if the working tree is clean. If so, no update is required. // Second, checks if there is an already open pull request for the fix. If so, no update is needed. -// Lastly, performs a comparison of Xray scan result hashes between an existing pull request's remote source branch and the current source branch to identify any differences. +// Lastly, performs a comparison of Xray scans result hashes between an existing pull request's remote source branch and the current source branch to identify any differences. func (sr *ScanRepositoryCmd) isUpdateRequired(fixedVulnerabilities []*utils.VulnerabilityDetails, prInfo *vcsclient.PullRequestInfo) (updateRequired bool, err error) { isClean, err := sr.gitManager.IsClean() if err != nil { diff --git a/scanrepository/scanrepository_test.go b/scanrepository/scanrepository_test.go index ec8b6ec27..3e93af094 100644 --- a/scanrepository/scanrepository_test.go +++ b/scanrepository/scanrepository_test.go @@ -638,116 +638,6 @@ func loadTestSBOM(t *testing.T, filename string) *cyclonedx.BOM { return bom } -func TestGetTotalFindingsFromScanResults(t *testing.T) { - testCases := []struct { - name string - scanResults *results.SecurityCommandResults - expectedCount int - }{ - { - name: "Nil scan results", - scanResults: nil, - expectedCount: 0, - }, - { - name: "No violations or vulnerabilities", - scanResults: &results.SecurityCommandResults{Targets: []*results.TargetResults{{ - ScanTarget: results.ScanTarget{Target: "target1"}, - }}}, - expectedCount: 0, - }, - { - name: "Vulnerabilities only", - scanResults: &results.SecurityCommandResults{ - ResultsMetaData: results.ResultsMetaData{ - ResultContext: results.ResultContext{IncludeVulnerabilities: true}}, - Targets: []*results.TargetResults{{ - ScanTarget: results.ScanTarget{Target: "target1", Technologies: []techutils.Technology{techutils.Npm}}, - ScaResults: &results.ScaScanResults{ - Sbom: loadTestSBOM(t, "sbom_with_vulnerabilities.json"), - }, - }}, - }, - expectedCount: 4, - }, - { - name: "Violations only", - scanResults: &results.SecurityCommandResults{ - ResultsMetaData: results.ResultsMetaData{ - ResultContext: results.ResultContext{Watches: []string{"w1"}}}, - Targets: []*results.TargetResults{{ - ScanTarget: results.ScanTarget{Target: "target1", Technologies: []techutils.Technology{techutils.Npm}}, - }}, - Violations: &violationutils.Violations{ - Sca: []violationutils.CveViolation{ - { - ScaViolation: violationutils.ScaViolation{ - ImpactedComponent: &cyclonedx.Component{ - BOMRef: "pkg:npm/viol1@1.0.0", - PackageURL: "pkg:npm/viol1@1.0.0", - }, - }, - CveVulnerability: cyclonedx.Vulnerability{BOMRef: "CVE-2023-1234"}, - }, - { - ScaViolation: violationutils.ScaViolation{ - ImpactedComponent: &cyclonedx.Component{ - BOMRef: "pkg:npm/viol2@2.0.0", - PackageURL: "pkg:npm/viol2@2.0.0", - }, - }, - CveVulnerability: cyclonedx.Vulnerability{BOMRef: "CVE-2022-1234"}, - }, - }, - }, - }, - expectedCount: 2, - }, - { - name: "Violations take precedence over vulnerabilities", - scanResults: &results.SecurityCommandResults{ - ResultsMetaData: results.ResultsMetaData{ - ResultContext: results.ResultContext{IncludeVulnerabilities: true, Watches: []string{"w1"}}}, - Targets: []*results.TargetResults{{ - ScanTarget: results.ScanTarget{Target: "target1", Technologies: []techutils.Technology{techutils.Npm}}, - ScaResults: &results.ScaScanResults{ - Sbom: loadTestSBOM(t, "sbom_with_vulnerabilities.json"), - }, - }}, - Violations: &violationutils.Violations{ - Sca: []violationutils.CveViolation{ - { - ScaViolation: violationutils.ScaViolation{ - ImpactedComponent: &cyclonedx.Component{ - BOMRef: "pkg:npm/viol1@1.0.0", - PackageURL: "pkg:npm/viol1@1.0.0", - }, - }, - CveVulnerability: cyclonedx.Vulnerability{BOMRef: "CVE-2023-1234"}, - }, - { - ScaViolation: violationutils.ScaViolation{ - ImpactedComponent: &cyclonedx.Component{ - BOMRef: "pkg:npm/viol2@2.0.0", - PackageURL: "pkg:npm/viol2@2.0.0", - }, - }, - CveVulnerability: cyclonedx.Vulnerability{BOMRef: "CVE-2022-1234"}, - }, - }, - }, - }, - expectedCount: 2, - }, - } - - for _, testCase := range testCases { - t.Run(testCase.name, func(t *testing.T) { - assert.Equal(t, testCase.expectedCount, getTotalFindingsFromScanResults(testCase.scanResults)) - }) - } -} - // Verifies unsupported packages return specific error // Other logic is implemented inside each package-handler. func TestUpdatePackageToFixedVersion(t *testing.T) { From db9b4ab8572036d03c94fbecba6058db5c39054d Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Tue, 4 Aug 2026 13:52:17 +0300 Subject: [PATCH 2/6] . --- go.mod | 2 +- go.sum | 4 ++-- scanpullrequest/scanpullrequest.go | 2 +- scanrepository/scanrepository.go | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/go.mod b/go.mod index 8afc87588..f625c523a 100644 --- a/go.mod +++ b/go.mod @@ -130,7 +130,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b +// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security dev // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev diff --git a/go.sum b/go.sum index 62fb33b07..f62ea8b7d 100644 --- a/go.sum +++ b/go.sum @@ -61,8 +61,6 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= -github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b h1:3UCHa3TgUy/uEDMXMBROjSsqQ0YvzzD/E4zMtwQvPeI= -github.com/eranturgeman/jfrog-cli-security v0.0.0-20260804082620-d99a9429e18b/go.mod h1:az2LjaYenQL+l2c06Lm3lW6xDV8IcTkx63KHK/WSYSA= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= @@ -156,6 +154,8 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260801102623-d512ca031f85 h1:9 github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260801102623-d512ca031f85/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e h1:K0IK3w5a5h6SIi9yoOJ6a7DL+kuFjs5acypOxKyT2OM= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0= +github.com/jfrog/jfrog-cli-security v1.32.0 h1:O+GHLFlBtQTUIB5Mv8qBROeXvy2Om2ZH0vo8Dmrb5JQ= +github.com/jfrog/jfrog-cli-security v1.32.0/go.mod h1:2DVy/0F2EFhF2/gbtXVK6OckYX6DoUVMEjp8Z5Gmmbc= github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195 h1:1h6qSM8fanMsy9xT7zrRn/lrAMclzQzT5OJt4a9X4Qo= github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= diff --git a/scanpullrequest/scanpullrequest.go b/scanpullrequest/scanpullrequest.go index 66bac1e94..7bd410ae5 100644 --- a/scanpullrequest/scanpullrequest.go +++ b/scanpullrequest/scanpullrequest.go @@ -91,7 +91,7 @@ func auditPullRequestAndReport(repoConfig *utils.Repository, client vcsclient.Vc repoConfig.Params.JFrogPlatform.JFrogProjectKey, ) defer func() { - xsc.SendScanEndedEvent(scanDetails.ServerDetails, scanResults) + xsc.SendScanEndedWithResults(scanDetails.ServerDetails, scanResults) }() issuesCollection, scanResults, err = auditPullRequestCode(repoConfig, scanDetails, sourceBranchWd, targetBranchWd) return diff --git a/scanrepository/scanrepository.go b/scanrepository/scanrepository.go index ca5edafaf..774523536 100644 --- a/scanrepository/scanrepository.go +++ b/scanrepository/scanrepository.go @@ -108,7 +108,7 @@ func (sr *ScanRepositoryCmd) prepareEnvAndScanBranch(repository *utils.Repositor var scanResults *results.SecurityCommandResults defer func() { - xsc.SendScanEndedEvent(sr.scanDetails.ServerDetails, scanResults) + xsc.SendScanEndedWithResults(sr.scanDetails.ServerDetails, scanResults) }() scanResults, err = sr.scanAndFixBranch(repository) return From d144ed8a1a9e6e0883487a89491883056c867bc0 Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Tue, 4 Aug 2026 17:10:11 +0300 Subject: [PATCH 3/6] mistakenly removed param while merge remote --- scanrepository/scanrepository.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanrepository/scanrepository.go b/scanrepository/scanrepository.go index a9777a686..66a52a4ed 100644 --- a/scanrepository/scanrepository.go +++ b/scanrepository/scanrepository.go @@ -176,7 +176,7 @@ func (sr *ScanRepositoryCmd) scanAndFixBranch(repository *utils.Repository) (sca log.Info(fmt.Sprintf("Didn't find any vulnerable dependencies with existing fix versions or that are currently supported for fixing, for %s", sr.scanDetails.RepoName)) return scanResults, nil } - return scanResults, sr.fixVulnerablePackages(repository, vulnerabilitiesByPathMap) + return scanResults, sr.fixVulnerablePackages(repository, scanResults.ResultsPlatformUrl, vulnerabilitiesByPathMap) } func (sr *ScanRepositoryCmd) uploadGitLabScanResultsIfNeeded(repository *utils.Repository, scanResults *results.SecurityCommandResults) { From 9c434e74717083b771531c403b44a49afab2ea85 Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Wed, 5 Aug 2026 16:21:16 +0300 Subject: [PATCH 4/6] Dependencies update for new External analytics flow through FinalizeEvent --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 43f2c0981..3155a142b 100644 --- a/go.mod +++ b/go.mod @@ -130,7 +130,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security dev +replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20260805131822-76e038fc880e // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev @@ -138,6 +138,6 @@ require ( // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go dev -// replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go master +replace github.com/jfrog/jfrog-client-go => github.com/eranturgeman/jfrog-client-go v0.0.0-20260805120611-78f489a08753 // replace github.com/jfrog/froggit-go => github.com/jfrog/froggit-go master diff --git a/go.sum b/go.sum index 06d717445..cad672124 100644 --- a/go.sum +++ b/go.sum @@ -61,6 +61,10 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20260805131822-76e038fc880e h1:+4vtmt7R/S7F1PzELXZqYGqf9KU1z3wsKpkr6n+Y8MM= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20260805131822-76e038fc880e/go.mod h1:yhqUs0uEWeMccs3y+h4uAmBkJiyqtbcNMBzWaDr/Akw= +github.com/eranturgeman/jfrog-client-go v0.0.0-20260805120611-78f489a08753 h1:yC/pOIJda5I8VE9sMgSF2FLH3uew+yJJNsyrdYDvwXA= +github.com/eranturgeman/jfrog-client-go v0.0.0-20260805120611-78f489a08753/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= @@ -154,10 +158,6 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260803134309-cea6be60a1f2 h1:I github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260803134309-cea6be60a1f2/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e h1:K0IK3w5a5h6SIi9yoOJ6a7DL+kuFjs5acypOxKyT2OM= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0= -github.com/jfrog/jfrog-cli-security v1.32.1 h1:GQ89waCbRZSL6fEpFwGWpIeiy2c8SNUTzccyec2QC1Y= -github.com/jfrog/jfrog-cli-security v1.32.1/go.mod h1:BKhIR0RkW0KMIdAeJbufG4rl44wZbpn+5bfE2jEN338= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195 h1:1h6qSM8fanMsy9xT7zrRn/lrAMclzQzT5OJt4a9X4Qo= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo= github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY= From 71a4fcd2679145fe8d884ccce8649f84e210aded Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Thu, 6 Aug 2026 16:32:47 +0300 Subject: [PATCH 5/6] . --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 3155a142b..16ee4ef77 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/jfrog/build-info-go v1.13.1-0.20260803032325-7865244a87b5 github.com/jfrog/froggit-go v1.23.1 github.com/jfrog/gofrog v1.7.6 - github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e + github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260804120604-edaa34435a80 github.com/jfrog/jfrog-cli-security v1.32.1 github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195 github.com/owenrumney/go-sarif/v3 v3.2.3 @@ -64,7 +64,7 @@ require ( github.com/jedib0t/go-pretty/v6 v6.8.3 // indirect github.com/jfrog/archiver/v3 v3.6.3 // indirect github.com/jfrog/jfrog-apps-config v1.0.1 // indirect - github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260803134309-cea6be60a1f2 // indirect + github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260804124646-1a5e6a2d3caf // indirect github.com/kevinburke/ssh_config v1.6.0 // indirect github.com/klauspost/compress v1.18.6 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect @@ -130,7 +130,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect ) -replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20260805131822-76e038fc880e +replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli-security v0.0.0-20260806115920-c99379c9fb66 // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev @@ -138,6 +138,6 @@ replace github.com/jfrog/jfrog-cli-security => github.com/eranturgeman/jfrog-cli // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go dev -replace github.com/jfrog/jfrog-client-go => github.com/eranturgeman/jfrog-client-go v0.0.0-20260805120611-78f489a08753 +replace github.com/jfrog/jfrog-client-go => github.com/eranturgeman/jfrog-client-go v0.0.0-20260806100242-d3b0c1fb01ae // replace github.com/jfrog/froggit-go => github.com/jfrog/froggit-go master diff --git a/go.sum b/go.sum index cad672124..4d4b1458f 100644 --- a/go.sum +++ b/go.sum @@ -61,10 +61,10 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= -github.com/eranturgeman/jfrog-cli-security v0.0.0-20260805131822-76e038fc880e h1:+4vtmt7R/S7F1PzELXZqYGqf9KU1z3wsKpkr6n+Y8MM= -github.com/eranturgeman/jfrog-cli-security v0.0.0-20260805131822-76e038fc880e/go.mod h1:yhqUs0uEWeMccs3y+h4uAmBkJiyqtbcNMBzWaDr/Akw= -github.com/eranturgeman/jfrog-client-go v0.0.0-20260805120611-78f489a08753 h1:yC/pOIJda5I8VE9sMgSF2FLH3uew+yJJNsyrdYDvwXA= -github.com/eranturgeman/jfrog-client-go v0.0.0-20260805120611-78f489a08753/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20260806115920-c99379c9fb66 h1:2z5c1H0LIlAeze6RVpxt7kmR1Zn/h2+rCCW+3VpOOs8= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20260806115920-c99379c9fb66/go.mod h1:Tirdj/Yf/aXGgMcixU23pU86Fi294AwUHkLzrXgEpko= +github.com/eranturgeman/jfrog-client-go v0.0.0-20260806100242-d3b0c1fb01ae h1:BlOET+51nCrMb+r3gviQbL9YMLZOWi+gUm3gLnivjbQ= +github.com/eranturgeman/jfrog-client-go v0.0.0-20260806100242-d3b0c1fb01ae/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= @@ -154,10 +154,10 @@ github.com/jfrog/gofrog v1.7.6 h1:QmfAiRzVyaI7JYGsB7cxfAJePAZTzFz0gRWZSE27c6s= github.com/jfrog/gofrog v1.7.6/go.mod h1:ntr1txqNOZtHplmaNd7rS4f8jpA5Apx8em70oYEe7+4= github.com/jfrog/jfrog-apps-config v1.0.1 h1:mtv6k7g8A8BVhlHGlSveapqf4mJfonwvXYLipdsOFMY= github.com/jfrog/jfrog-apps-config v1.0.1/go.mod h1:8AIIr1oY9JuH5dylz2S6f8Ym2MaadPLR6noCBO4C22w= -github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260803134309-cea6be60a1f2 h1:II1Wfz0RcKuGc+xIyIEBFz6PqsgqEKKqhijHESANlQM= -github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260803134309-cea6be60a1f2/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e h1:K0IK3w5a5h6SIi9yoOJ6a7DL+kuFjs5acypOxKyT2OM= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0= +github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260804124646-1a5e6a2d3caf h1:HJob3Bsj6FtQ3nq72GGzBWXJ7ZXvUz6rKSGpYGAXwKI= +github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260804124646-1a5e6a2d3caf/go.mod h1:UkVDiTbSgtk+7N2ePOsPvjPsgO8r8rJtUchjcnAk08w= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260804120604-edaa34435a80 h1:V8wTPQAO/9MMxYFMM5qD08E8QRCmV3EtS8Gh+7SmJzU= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260804120604-edaa34435a80/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo= github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY= From 5fd8ffd5bf10a62ed38683b8606f9b3929a20b25 Mon Sep 17 00:00:00 2001 From: Eran Turgeman Date: Thu, 6 Aug 2026 16:33:53 +0300 Subject: [PATCH 6/6] . --- go.sum | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/go.sum b/go.sum index c513885ce..4d4b1458f 100644 --- a/go.sum +++ b/go.sum @@ -61,6 +61,10 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20260806115920-c99379c9fb66 h1:2z5c1H0LIlAeze6RVpxt7kmR1Zn/h2+rCCW+3VpOOs8= +github.com/eranturgeman/jfrog-cli-security v0.0.0-20260806115920-c99379c9fb66/go.mod h1:Tirdj/Yf/aXGgMcixU23pU86Fi294AwUHkLzrXgEpko= +github.com/eranturgeman/jfrog-client-go v0.0.0-20260806100242-d3b0c1fb01ae h1:BlOET+51nCrMb+r3gviQbL9YMLZOWi+gUm3gLnivjbQ= +github.com/eranturgeman/jfrog-client-go v0.0.0-20260806100242-d3b0c1fb01ae/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= @@ -154,10 +158,6 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260804124646-1a5e6a2d3caf h1:H github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260804124646-1a5e6a2d3caf/go.mod h1:UkVDiTbSgtk+7N2ePOsPvjPsgO8r8rJtUchjcnAk08w= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260804120604-edaa34435a80 h1:V8wTPQAO/9MMxYFMM5qD08E8QRCmV3EtS8Gh+7SmJzU= github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260804120604-edaa34435a80/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0= -github.com/jfrog/jfrog-cli-security v1.33.0 h1:VD/ygYbUz9vDX+Cam8mPsXHtmVyJFmi2Ks7b7e2feIY= -github.com/jfrog/jfrog-cli-security v1.33.0/go.mod h1:rDtfkvy4cERKWcZSzEGXCXVB4n87BHN25y9HWtPX6Ag= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195 h1:1h6qSM8fanMsy9xT7zrRn/lrAMclzQzT5OJt4a9X4Qo= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260803094922-a87c05639195/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo= github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=