Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add descriptor to results #73

Draft
wants to merge 17 commits into
base: dev
Choose a base branch
from

Conversation

attiasas
Copy link
Contributor

@attiasas attiasas commented Jun 2, 2024

  • The pull request is targeting the dev branch.
  • The code has been validated to compile successfully by running go vet ./....
  • The code has been formatted properly using go fmt ./....
  • All static analysis checks passed.
  • All tests have passed. If this feature is not already covered by the tests, new tests have been added.
  • All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

Refactor Results --> ScanCommandResults

  • Divide results per target: (audit=working-dir, scan=binary-file, docker scan=binary-file, build-scan=build name + number)
  • Enrich each XrayScanResults with related technology and target path (descriptor, optional)

Aditional changes

Restructure repository packages and code

  • Resrcture will reduce import cycles and coupling
  • Separation of big files into logical files helps locate needed code and maintain it more easily
  • Combine similar code that was implemented in different places in the repository
  • TechnologyHadler interface will help support new technologies and maintain them in all of our commands

Enrich SCA results in Sarif format

  • adding artifactLocation.uri for all scan commands and m

This PR:

  • Refactor project structure - move SC related content to its own root dir softwarecomponents not related to commands.
  • Add our Result object ability to group SCA results per descriptor file.
  • For each technology, provide the dependency graph as follows: Tech Root Node -> Descriptor File Node -> Descriptor Dependencies

TBD: Multi module projects techs

This is not a complete implementation of all the features needed to process the descriptor files. missing:

  • Locate dependency at the descriptor
  • Provide custom deps tree per tech/descriptor

@attiasas attiasas added improvement Automatically generated release notes safe to test Approve running integration tests on a pull request labels Jun 2, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Jun 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
improvement Automatically generated release notes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant