Skip to content

AST-168518 Additional SCA Package Manager and Publish Plugin Version - #269

Open
cx-anand-nandeshwar wants to merge 8 commits into
feature/hoverfrom
feature/anand_sca_plugin_version
Open

AST-168518 Additional SCA Package Manager and Publish Plugin Version#269
cx-anand-nandeshwar wants to merge 8 commits into
feature/hoverfrom
feature/anand_sca_plugin_version

Conversation

@cx-anand-nandeshwar

Copy link
Copy Markdown
Contributor

By submitting a PR to this repository, you agree to the terms within the Checkmarx Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Added new package manager support for OSS scan engine listed below.

  • Java: Gradle (build.gradle, build.gradle.kts)
  • Java: SBT (build.sbt, any .sbt file ✱)
  • JS/TS: Yarn (1 & 2) (package.json, yarn.lock)
  • JS/TS: Bower (bower.json)
  • Python: PIP (requirements.txt, requirements-.txt, requirement.txt, requirement-.txt)
  • Python: Setup.py / Setuptools (Setup.py, Setup.cfg)
  • Python: Poetry (pyproject.toml, poetry.lock)
  • PHP/Drupal: Composer (composer.json, composer.lock)
  • Ruby: RubyGems (Gemfile, Gemfile.lock)

Publish plugin version and refactor existing wrapper call code

  • Publish plugin version with format Eclipse_<Cx_Eclipse_Plugin_version>/ASTCLI_<ASTCLI_VERSION> in every API call that happens via CLI
  • Created factory class to interact with CLI
  • Refactor existing reference of CLI call, now it will go through the wrapper factory class.

References

Testing

Describe how this change was tested. Be specific about anything not tested and reasons why. If this solution has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

Please include any manual steps for testing end-to-end or functionality not covered by unit/integration tests.

Checklist

  • I have added documentation for new/changed functionality in this PR (if applicable).
  • All active GitHub checks for tests, formatting, and security are passing
  • The correct base branch is being used

cx-anand-nandeshwar and others added 8 commits August 15, 2026 02:18
…chitectural cleanup

This commit implements comprehensive refactoring to enable plugin version telemetry:

Core changes:
- Added agent name + plugin version stamping in CxWrapperFactory to report "Eclipse_<version>" in all API calls
- Created common-lib/wrapper/CxWrapperFactory with version reading from OSGi Bundle metadata
- Created WrapperProvider facade for common-lib (project/auth/tenant operations)
- Created ScannerWrapperProvider in devassist-lib (scanner-specific operations, not exported)
- Moved CxWrapperFactory from devassist-lib/factory to common-lib/wrapper (shared location)

Refactoring across all wrapper consumers:
- DataProvider: removed hand-built CxWrapper/CxConfig, uses WrapperProvider for all operations
- Authenticator: centralized via WrapperProvider for test-connection credential validation
- TenantSettingsProvider: uses WrapperProvider for MCP feature-flag checks
- All 5 scanner services (Asca/OSS/Container/IaC/Secrets): inject ScannerWrapperProvider field

Architectural improvements:
- Eliminated duplicate wrapper-building logic across 9 files
- Encapsulated scanner operations in devassist-lib (not exported from common-lib)
- Established clear inversion-of-control pattern with injected provider instances
- Added comprehensive unit tests (CxWrapperFactoryTest, WrapperProviderTest)

Build & test verification:
- Full reactor compile: SUCCESS
- All 64 tests pass (58 DataProvider + 2 new factory tests + 4 new provider tests)
- Java 17 JDT settings (consistent with Tycho build target)
- Cleaned up dead comment blocks referencing deleted factory path

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Updated dependency version to match the latest stable release.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…g_mgr' into feature/anand_sca_plugin_version

# Conflicts:
#	devassist-lib/src/com/checkmarx/eclipse/devassist/utils/DevAssistConstants.java
…n' into feature/anand_sca_plugin_version

# Conflicts:
#	devassist-lib/src/com/checkmarx/eclipse/devassist/scanners/containers/ContainerScannerService.java
#	devassist-lib/src/com/checkmarx/eclipse/devassist/scanners/oss/OssScannerService.java
- Added plugin version with expected format
- Resolved review comments for #265
@stepsecurity-app

stepsecurity-app Bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Security Policy Alert: Actions Policy Violation

This workflow run has been blocked by StepSecurity's actions policy.

Disallowed Actions:

  • timonvs/pr-labeler-action@8b99f404a073744885d8021d1de4e40c6eaf38e2

To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed.

For more information, see StepSecurity's Actions Policy documentation.

@cx-anand-nandeshwar cx-anand-nandeshwar changed the title Feature/anand sca plugin version AST-168518 Additional SCA Package Manager and Publish Plugin Version Aug 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant