jfrog / jfrog/jfrog-cli-security

Adding --watches and --project flags to jf rt mvn command when scanning

Open
#374 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature request
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Problem Description:
When scanning local file system artifacts before uploading them from a build using jf rt mvn --scan, Currently JFrog CLI will use jf scan with a --repo-path flag by default. The repo-path will be the repo-deploy-release that is configured with mvnc command.
In case repo-deploy-release is defined as a virtual repository Xray will use it as the repo-path but won't find any watches on it since a virtual repository can't be indexed in Xray and therefore can't be configured for watches.

Feature Description:
Instead of using the default repo-path add --watches and --project to jf rt mvn when using --scan flag, like in jf scan command, so it can be used to scan artifacts for violations when using a virtual repository as the deploy repository.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the jf rt mvn --scan handling and compare it with the jf scan command's --watches and --project options. Trace how the configured repo-deploy-release becomes the repo-path during scanning. Done means scans can accept and use both flags when the deploy repository is virtual, allowing Xray violations to be found through the selected watches and project.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.