jfrog / jfrog/jfrog-cli-security
Adding --watches and --project flags to jf rt mvn command when scanning
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Problem Description:
When scanning local file system artifacts before uploading them from a build using jf rt mvn --scan, Currently JFrog CLI will use jf scan with a --repo-path flag by default. The repo-path will be the repo-deploy-release that is configured with mvnc command.
In case repo-deploy-release is defined as a virtual repository Xray will use it as the repo-path but won't find any watches on it since a virtual repository can't be indexed in Xray and therefore can't be configured for watches.
Feature Description:
Instead of using the default repo-path add --watches and --project to jf rt mvn when using --scan flag, like in jf scan command, so it can be used to scan artifacts for violations when using a virtual repository as the deploy repository.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the jf rt mvn --scan handling and compare it with the jf scan command's --watches and --project options. Trace how the configured repo-deploy-release becomes the repo-path during scanning. Done means scans can accept and use both flags when the deploy repository is virtual, allowing Xray violations to be found through the selected watches and project.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100