Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add technology to audit params if provided by user through 'install' command #749

Conversation

eranturgeman
Copy link
Contributor

@eranturgeman eranturgeman commented Sep 11, 2024

  • All tests passed. If this feature is not already covered by the tests, I added new tests.
  • This pull request is on the dev branch.
  • I used gofmt for formatting the code before submitting the pull request.
  • Update documentation about new features / new supported technologies

This PR updates the Audit parameters to include a specified technology from the install command, if provided.

This change leverages a new enhancement introduced here: jfrog/jfrog-cli-security#175

In that improvement, we enhanced the technology detection when an install command is provided, allowing Frogbot to better handle complex structures where technologies are incorrectly identified. For instance, in a Yarn project with several sub-projects (not in a multi-module setup), where the sub-projects only have a package.json file without other Yarn indicators, these sub-projects are mistakenly identified as NPM projects.

This fix addresses that issue by enabling tech detection using descriptors when an install command is provided, rather than relying solely on indicators (which we typically use to avoid collisions between technologies with similar descriptors, like Yarn and NPM). If an install command is specified along with the working directories to scan (via frogbot-config.yml), we enforce this technology on each of the directories and use descriptors alone for verification, resolving the issue described.

@eranturgeman eranturgeman added bug Something isn't working safe to test Approve running integration tests on a pull request labels Sep 11, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 11, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Sep 11, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 11, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Sep 11, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 11, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Sep 11, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 11, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Sep 15, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 15, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Sep 15, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 15, 2024
Copy link
Contributor

@attiasas attiasas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, take a look at my comment

utils/params.go Show resolved Hide resolved
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Sep 15, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 15, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Sep 15, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 15, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Sep 15, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Sep 15, 2024
Copy link
Contributor

👍 Frogbot scanned this pull request and did not find any new security issues.


@eranturgeman eranturgeman merged commit 32170ad into jfrog:dev Sep 15, 2024
33 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants