Does frogbot require Advanced Security?
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 372
- Forks
- 107
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 5
Description
I setup frogbot on a test repo and noticed that while Running Frogbot "scan-repository" command it does a series of checks for 200's back from various jfrog endpoints. We did not purchase the advanced security license so we do not have access to contextual_analysis.
17:23:12 [Debug] Sending HTTP GET request to: https://companyname.jfrog.io/xray/api/v1/entitlements/feature/contextual_analysis
Error: 2 [Error] got unexpected server response while attempting to get JFrog Xray entitlements response for contextual_analysis:
server response: 404 Not Found
I noticed that the documentation makes note:
NOTE: SAST, Vulnerability Contextual Analysis, Secrets Detection and Infrastructure as Code scans require the [JFrog Advanced Security Package](https://jfrog.com/xray/).
but that doesnt seem to include dependency scanning or license scanning. However the UrlAccessChecker function still appears to require access to that endpoint in order to start a scan on the branch. I dug through your documentation, but failed to find a concrete answer or clear list of requirements for frogbot.
If this isn't something that can be used without Advanced Security it should probably be noted more clearly in the documentation. However if this is possible, I don't understand what I am missing to skip the checks for the endpoints my organization did not purchase.
Thanks!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the UrlAccessChecker logic and the checks run during the scan-repository command, then compare them with the documented Advanced Security requirements. Done means the documentation clearly states which scans require Advanced Security and whether dependency and license scanning work without the unavailable entitlement endpoints.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, go
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100