add IncludeDirs option to Xray Bom Lib by attiasas · Pull Request #670 · jfrog/jfrog-cli-security

attiasas · 2026-02-12T10:48:02Z

Support multiple working dirs with single-target scan flow & deprecate jfrog-apps-config in new flow

Summary

Refactors the audit scan pipeline to support multiple working directories via a single scan target (--static-sca / Xray lib flow), and deprecates the jfrog-apps-config.yml module system for JAS scans in the new flow. Scan configuration (include/exclude patterns, central config modules) is now carried directly on ScanTarget instead of being resolved through jfrog-apps-config modules.

Depends on:

XRAY-135682 (bug: secrets/CA when multiple roots are passed)
XRAY-138915 (improvement: iac does not support multiple roots)

Analyzer-Manager minimum version: 1.33.0

Update AnalyzerManager version to 1.33.0 #748

Changes

ScanTarget extended – added Include, Exclude, DeprecatedAppsConfigModule, and CentralConfigModules fields; added methods IsScanRequestedByCentralConfig, GetCentralConfigExclusions, GetDeprecatedAppsConfigModuleExclusions.
New single-target detection (createSingleScanTarget) – when the new flow (Xray lib BOM generator) is active, a single ScanTarget is created with the working directories as include paths, instead of detecting one target per technology directory.
JAS scanners refactored – every scanner (Secrets, IaC, SAST, Applicability) now exposes two code paths: Run(target ScanTarget) (new flow, target-based) and DeprecatedRun(module, centralConfigExclusions) (old flow, module-based). Config file generation, exclude-pattern resolution, and SARIF result reading follow the same split.
jfrog-apps-config deprecated in new flow – AppsConfigModule replaced by DeprecatedAppsConfigModule; config loading only happens in the old (graph-based) flow. A deprecation warning is emitted when the file is detected.
Exclude/include patterns moved to target level – ScanTarget.Exclude is set during target detection and passed through to BOM generation (Xray lib IgnorePatterns + IncludeDirs) and all JAS scanner config files.
Central config profile support per-target – matchCentralConfigModules assigns profile modules to targets; ShouldSkipScannerByConfigProfile checks enablement per scan type on the target.
SARIF invocation rework – fillMissingRequiredInvocationInformation now aggregates execution success and creates a single canonical invocation with include property bag for multi-root targets.
SBOM logging moved to bomgenerator – logging of component counts and duration is now in the shared GenerateSbomForTarget instead of duplicated in XrayLibBomGenerator.
Utility additions – GetFullPathsWorkingDirs, IsPathExcluded, ElementsEqual, CreateNewInvocation.
Tests – new unit tests in commands/audit/audit_test.go, jas/common_test.go, jas/secrets/secretsscanner_test.go, jas/iac/iacscanner_test.go, jas/applicability/applicabilitymanager_test.go, utils/results/results_test.go, utils/paths_test.go, utils/utils_test.go.

Testing

New and updated unit tests covering target detection, exclude-pattern resolution, central-config module matching, SARIF invocation creation, and scanner config-file generation.
Existing integration tests updated to match new signatures.

Notes

In the new flow, jfrog-apps-config.yml is deprecated – flags, env vars, or central JFrog Platform config should be used instead.
The old graph-based flow is untouched and still loads jfrog-apps-config as before.

…config in new flow

github-actions · 2026-05-04T11:44:38Z

🐸 JFrog Frogbot

eranturgeman · 2026-05-07T13:10:34Z

+	return []string{target.Target}
+}
+
+func GetWorkingDirsFromTarget(target results.ScanTarget) []string {


Unused func, delete

eranturgeman · 2026-05-07T13:21:45Z


-func (a *JasScanner) Run(scannerCmd ScannerCmd, module jfrogappsconfig.Module) (vulnerabilitiesSarifRuns []*sarif.Run, violationsSarifRuns []*sarif.Run, err error) {
+func (a *JasScanner) DeprecatedRun(scannerCmd ScannerCmd, module jfrogappsconfig.Module, centralConfigExclusions []string) (vulnerabilitiesSarifRuns []*sarif.Run, violationsSarifRuns []*sarif.Run, err error) {
 	func() {


we can remove the func() {...}() wrapper - it adds no value it wraps it and calls the func inside DeprecatedRun.

eranturgeman · 2026-05-07T13:26:37Z

+	if len(st.Include) > 0 {
+		relativePaths := []string{}
+		for _, path := range st.Include {
+			relativePaths = append(relativePaths, utils.GetRelativePath(path, st.Target))


aren't they already relative paths here?

eranturgeman · 2026-05-07T13:37:25Z

+	return false
 }

 func (st ScanTarget) String() (str string) {


in line 267 do str += st.Name or you'll erase the previous step of the Target/Target + Include dirs

The log can contain Target + Include dirs + Name + techs and it will look like that:
{} [].
maybe we should make it a bit more readable, like:
: {} [technologies: ]

eranturgeman · 2026-05-07T13:45:03Z

 		relative := utils.GetRelativePath(potential.Target, sourceBasePath)
 		log.Debug(fmt.Sprintf("Comparing target %s, relative: '%s'", potential.String(), relative))
-		if technology != techutils.NoTech && potential.Technology != technology {
+		if len(technologies) > 0 && !utils.ElementsEqual[techutils.Technology](potential.Technologies, technologies) {


maybe not something we want to address but maybe worth noting- if a new tech is added in a PR (new module or something) we will find no match. this is a edge case but maybe worth a comment

eranturgeman · 2026-05-07T13:52:18Z

 	return filepath.Join(curationFolder, "nuget"), nil
 }

+func GetFullPathsWorkingDirs(workingDirs []string) ([]string, error) {


can maybe be replaced with coreutils.GetFullPathsWorkingDirs

eranturgeman · 2026-05-07T14:26:04Z

+		})
+	}
+	// Load deprecated apps config information for all targets
+	if params.DeprecatedAppsConfig() == nil && !isNewFlow(params.bomGenerator) {


shouldn't it be params.DeprecatedAppsConfig != nil ?

eranturgeman · 2026-05-07T14:35:52Z

 	return
 }

+func runApplicabilityScan(applicabilityScanManager *ApplicabilityScanManager, params ContextualAnalysisScanParams) (vulnerabilitiesSarifRuns []*sarif.Run, err error) {


why manager is passed as a param and it is not a method?

eranturgeman · 2026-05-07T14:36:03Z

 	return
 }

+func runIacScan(iacScanManager *IacScanManager, params IacScanParams) (vulnerabilitiesResults []*sarif.Run, violationsResults []*sarif.Run, err error) {


why manager is passed as a param and it is not a method?

eranturgeman · 2026-05-07T14:39:32Z

 	return
 }

+func runSastScan(sastScanManager *SastScanManager, params SastScanParams) (vulnerabilitiesResults []*sarif.Run, violationsResults []*sarif.Run, err error) {


why manager is passed as a param and it is not a method?

eranturgeman · 2026-05-07T14:40:20Z

 	return
 }

+func runSecretsScan(secretScanManager *SecretScanManager, params SecretsScanParams) (vulnerabilitiesResults []*sarif.Run, violationsResults []*sarif.Run, err error) {


why manager is passed as a param and it is not a method?

eranturgeman · 2026-05-07T14:43:27Z

+		log.Debug(fmt.Sprintf("Skipping %s scan as requested by '%s' config profile...", jasType, configProfile.ProfileName))
+		return true
+	}
+	// validate target is excluded by config profile exclude patterns


// validate IF target is excluded by config profile exclude patterns

eranturgeman · 2026-05-07T14:46:06Z

 	require.Equal(t, "dir/file2", sarifutils.GetLocationFileName(result.Locations[0]))
 }

+func TestShouldSkipScannerByConfigProfile(t *testing.T) {


what about test for ShouldSkipScannerByModule

eranturgeman · 2026-05-07T14:50:10Z


 func GenerateSbomForTarget(generator SbomGenerator, params SbomGeneratorParams) {
+	startLog := "Generating SBOM"
+	if params.TotalTargets > 1 {


just making sure - it TotalTarget > 1, do we have them all in params.Target.Target?.
Also change the log to " for targets: %s"

eranturgeman · 2026-05-07T15:04:18Z

 	}
+	outLog := "SBOM generated"
+	if totalTargets > 1 {
+		outLog += fmt.Sprintf(" for target '%s'", target)


also here, it totalTargets > 1 we need to change the log to " for targets ..."

eranturgeman · 2026-05-10T07:16:44Z

 		log.Debug(fmt.Sprintf("%sSkipping SCA for %s as requested by input...", logPrefix, params.ScanResults.Target))
 		return false, nil
 	}
+	if params.ScanResults == nil {


I see this check existed before, but I dont think it is really a possible usecase. we can leave it for safety though

eranturgeman · 2026-05-10T08:02:41Z

 }
+
+func TestPrepareSimpleJsonVulnerabilities_Technology(t *testing.T) {
+	testCases := []struct {


maybe add another testcase with multi-rows and different technologies?

eranturgeman · 2026-05-10T08:14:27Z

+		return
+	}
+	// Applicability scan does not produce violations.
+	vulnerabilitiesSarifRuns, _, err = applicabilityScanManager.scanner.DeprecatedRun(applicabilityScanManager, *params.Target.DeprecatedAppsConfigModule, params.Target.GetCentralConfigExclusions(utils.ContextualAnalysisScan))


please check that calling GetCentralConfigExclusions is the correct call here. Here we are at the Deprecated case but we are callign the new GetExclusions func (which doesnt include AppsConfig)

eranturgeman · 2026-05-10T08:14:35Z

+	if params.Target.DeprecatedAppsConfigModule == nil {
+		return iacScanManager.scanner.Run(iacScanManager, params.Target)
+	}
+	return iacScanManager.scanner.DeprecatedRun(iacScanManager, *params.Target.DeprecatedAppsConfigModule, params.Target.GetCentralConfigExclusions(utils.IacScan))


please check that calling GetCentralConfigExclusions is the correct call here. Here we are at the Deprecated case but we are callign the new GetExclusions func (which doesnt include AppsConfig)

eranturgeman · 2026-05-10T08:14:52Z

+	if params.Target.DeprecatedAppsConfigModule == nil {
+		return sastScanManager.scanner.Run(sastScanManager, params.Target)
+	}
+	return sastScanManager.scanner.DeprecatedRun(sastScanManager, *params.Target.DeprecatedAppsConfigModule, params.Target.GetCentralConfigExclusions(utils.SastScan))


please check that calling GetCentralConfigExclusions is the correct call here. Here we are at the Deprecated case but we are callign the new GetExclusions func (which doesnt include AppsConfig)

eranturgeman · 2026-05-10T08:23:57Z

+		slice1   []string
+		slice2   []string
+		expected bool
+	}{


please add testcases of:
slice1: {a, b, c}
slice2: (a, b, b)

slice1: {a,b,b}
slice2: {a,b,c}

eranturgeman · 2026-05-10T08:25:13Z

+		freq[v]++
+	}
+	for _, v := range slice2 {
+		freq[v]--


if v doesnt exist here wont we get a panic?
for example slice1 = {a,b,b}, slice2={a,c,b}
when we try doing freq["c"]-- I think we get a panic

eranturgeman

LGTM! see my comments

add IncludeDirs option to Xray Bom Lib

32dc1fb

attiasas added the ignore for release Automatically generated release notes label Feb 12, 2026

attiasas had a problem deploying to frogbot February 12, 2026 10:48 — with GitHub Actions Failure

attiasas added 2 commits February 12, 2026 16:22

prepare to pass working dirs

1a1a659

format

26955ad

attiasas had a problem deploying to frogbot February 12, 2026 14:22 — with GitHub Actions Failure

use isSingleTarget, start deprecate old JAS interface to remove apps-…

b004474

…config in new flow

attiasas had a problem deploying to frogbot February 12, 2026 15:52 — with GitHub Actions Failure

Merge remote-tracking branch 'upstream/dev' into pass_wd_to_xray_lib

c33f179

attiasas had a problem deploying to frogbot February 12, 2026 15:53 — with GitHub Actions Failure

attiasas added the safe to test Approve running integration tests on a pull request label Feb 12, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Feb 12, 2026

attiasas added 4 commits February 13, 2026 01:53

deprecate JAS apps config module, use scan target

d641985

new scan target detection logic

12005ea

start impl new flow in Secrets

abc25bb

update xray lib to 0.0.3-47

5fb9622

attiasas had a problem deploying to frogbot February 16, 2026 11:10 — with GitHub Actions Failure

attiasas added 3 commits February 16, 2026 13:25

fix tests

1bff793

Merge remote-tracking branch 'upstream/dev' into pass_wd_to_xray_lib

1d4fd00

fix static tests

8eac512

attiasas had a problem deploying to frogbot February 17, 2026 10:01 — with GitHub Actions Failure

attiasas added the safe to test Approve running integration tests on a pull request label Feb 17, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Feb 17, 2026

Merge remote-tracking branch 'upstream/dev' into pass_wd_to_xray_lib

1ec4aeb

attiasas had a problem deploying to frogbot February 17, 2026 13:04 — with GitHub Actions Failure

Fix target creation and JAS results parsing

4711afb

attiasas had a problem deploying to frogbot February 19, 2026 11:22 — with GitHub Actions Failure

pass target to applicable, fix invocations

d0f5aed

attiasas had a problem deploying to frogbot February 19, 2026 13:17 — with GitHub Actions Failure

attiasas added the safe to test Approve running integration tests on a pull request label Feb 19, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Apr 13, 2026

Fix TestDetectScansToPerform

87a9ec5

attiasas requested a deployment to frogbot April 15, 2026 08:25 — with GitHub Actions Waiting

Merge remote-tracking branch 'upstream/dev' into pass_wd_to_xray_lib

ecd7895

attiasas added 2 commits May 4, 2026 14:48

remove unrelated changes

3acb020

Merge remote-tracking branch 'upstream/dev' into pass_wd_to_xray_lib

116b2b4

eranturgeman reviewed May 7, 2026

View reviewed changes

eranturgeman reviewed May 10, 2026

View reviewed changes

Conversation

attiasas commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Support multiple working dirs with single-target scan flow & deprecate jfrog-apps-config in new flow

Summary

Changes

Testing

Notes

Uh oh!

github-actions Bot commented May 4, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eranturgeman May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eranturgeman May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eranturgeman May 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eranturgeman left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

attiasas commented Feb 12, 2026 •

edited

Loading

eranturgeman May 7, 2026 •

edited

Loading

eranturgeman May 7, 2026 •

edited

Loading

eranturgeman May 10, 2026 •

edited

Loading