XRAY-156682 - Yarn native support by Phavya-jfrog · Pull Request #854 · jfrog/jfrog-cli-security

Phavya-jfrog · 2026-08-19T11:28:24Z

The pull request is targeting the dev branch.
The code has been validated to compile successfully by running go vet ./....
The code has been formatted properly using go fmt ./....
All static analysis checks passed.
All tests have passed. If this feature is not already covered by the tests, new tests have been added.
Updated the Contributing page / ReadMe page / CI Workflow files if needed.
All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

Add native repository resolution for yarn v2 and v3 in jf ca.

Yarn v2, v3 resolution priority:

npmRegistryServer entry in .yarnrc.yml — the only source ("Set me up")
Clear error if it doesn't resolve

Screenshots attached in https://jfrog-int.atlassian.net/browse/XRAY-156682?focusedCommentId=1210543

gauriy-tech · 2026-08-25T09:59:36Z

[Re: sca/bom/buildinfo/technologies/yarn/yarn.go:298] curationNoLockfileError unconditionally frames any pre-lockfile install failure as "curation is blocking manifests, not just tarballs," even when installErr is unrelated (e.g. a plugin-install permission error). Since probeBlockedDirectDeps authenticates independently via params.ServerDetails, an unrelated failure here (including the fallback-auth gap above) would still report zero blocked packages while the top-level message blames curation — pointing engineers toward removing/waiving packages that curation never actually evaluated.

Consider branching on whether installErr actually carries a curation-block signal before choosing this wording, falling back to a neutral "install failed, see debug log" message otherwise.

Review generated by xray-pr-review

gauriy-tech · 2026-08-25T09:59:38Z

[Re: commands/curation/curationaudit.go:975] This log line still says "(V4 native mode)" — after this PR, .yarnrc.yml-native resolution applies to V2/V3 too, so the label is now inconsistent with the rest of this change (not introduced by this PR, but adjacent to it). Consider dropping the version-specific qualifier, e.g. "...treating project as yarn (native .yarnrc.yml mode)."

Review generated by xray-pr-review

gauriy-tech · 2026-08-25T10:00:16Z

Missing test coverage for the two behavioral changes flagged above:

No test exercises configureYarnResolutionServerAndRunInstall / runYarnResolveOnlyLockfile end-to-end with IsCurationCmd: true and a fallback-only credential (no token in .yarnrc.yml) to confirm the spawned yarn subprocess actually authenticates. yarn_test.go is untouched by this PR, and TestSetRepoFromYarnrcAcceptsMatchingHost (added here) only asserts setRepoFromYarnrc populates ca.PackageManagerConfig — it stops short of driving that credential through to the subprocess.
No test on curationNoLockfileError covers a non-curation-shaped installErr (e.g. a plugin-install permission error) to confirm the message doesn't misattribute the failure to curation policy.

Both are reproducible with a fake yarn executable/script standing in for the real binary — happy to share a sketch if useful.

Review generated by xray-pr-review

Phavya-jfrog requested a deployment to frogbot August 19, 2026 11:28 — with GitHub Actions Waiting

Phavya-jfrog added improvement Automatically generated release notes safe to test Approve running integration tests on a pull request labels Aug 19, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Aug 19, 2026

Phavya-jfrog added the safe to test Approve running integration tests on a pull request label Aug 24, 2026

Phavya-jfrog requested a deployment to frogbot August 24, 2026 05:32 — with GitHub Actions Waiting