Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
18c22a1
Add parallel PR scanning functions (CompareJasResults, UnifyScaAndJas…
eyalk007 Jan 5, 2026
6c07738
Add RunBranchDiffAudit for sequential branch scanning with clean logs
eyalk007 Jan 5, 2026
caf59eb
Add Logger field to AuditBasicParams for parallel scan log separation
eyalk007 Jan 5, 2026
7fc3bd0
Add LogCollector for isolated parallel audit logging
eyalk007 Jan 11, 2026
96ae51a
Update go.mod/go.sum
eyalk007 Jan 11, 2026
b22d7c4
Update LogCollector with ReplayTo for proper log formatting
eyalk007 Jan 12, 2026
16f7f21
Simplify comments to match repo style
eyalk007 Jan 13, 2026
c38b6c3
Remove accidentally added test file
eyalk007 Jan 13, 2026
5e4a231
Remove unused branchdiff.go
eyalk007 Jan 13, 2026
86e70fd
Clean up diff functions: remove AM references, simplify comments
eyalk007 Jan 13, 2026
37f3743
Move diff functions to separate file: utils/results/diff.go
eyalk007 Jan 13, 2026
b0eb167
Remove extra comments from logCollector field
eyalk007 Jan 13, 2026
957b363
Add diff function tests adapted from analyzer-manager
eyalk007 Jan 13, 2026
809a52f
Merge upstream/dev - resolve conflicts (keep both logCollector and us…
eyalk007 Jan 13, 2026
a5897a9
Remove unused MergeStatusCodes function and tests
eyalk007 Jan 14, 2026
22f7713
Fix UnifyScaAndJasResults to preserve Applicability from SCA scan
eyalk007 Jan 14, 2026
56609db
Fix: Copy GitContext in UnifyScaAndJasResults for proper upload paths
eyalk007 Jan 14, 2026
816605d
CR fixes - update go.mod replace directive to use git commit
eyalk007 Jan 15, 2026
1ca4a0a
CR fixes: extract logger helper, use sarifutils, rename functions
eyalk007 Jan 18, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion commands/audit/audit.go
Original file line number Diff line number Diff line change
Expand Up @@ -292,6 +292,11 @@ func (auditCmd *AuditCommand) CommandName() string {
// Returns an audit Results object containing all the scan results.
// If the current server is entitled for JAS, the advanced security results will be included in the scan results.
func RunAudit(auditParams *AuditParams) (cmdResults *results.SecurityCommandResults) {
// Set up isolated logging if a log collector is provided
if collector := auditParams.GetLogCollector(); collector != nil {
log.SetLoggerForGoroutine(collector.Logger())
defer log.ClearLoggerForGoroutine()
}
// Prepare the command for the scan.
if cmdResults = prepareToScan(auditParams); cmdResults.GeneralError != nil {
return
Expand Down Expand Up @@ -623,7 +628,17 @@ func addJasScansToRunner(auditParallelRunner *utils.SecurityParallelRunner, audi
return
}
auditParallelRunner.JasWg.Add(1)
if _, jasErr := auditParallelRunner.Runner.AddTaskWithError(createJasScansTask(auditParallelRunner, scanResults, serverDetails, auditParams, jasScanner), func(taskErr error) {
// Capture current logger (may be a BufferedLogger for isolated parallel logging).
// Worker goroutines need this propagated so their logs are captured in the same buffer.
currentLogger := log.GetLogger()
jasTask := createJasScansTask(auditParallelRunner, scanResults, serverDetails, auditParams, jasScanner)
wrappedJasTask := func(threadId int) error {
// Propagate parent's logger to this worker goroutine for isolated log capture
log.SetLoggerForGoroutine(currentLogger)
defer log.ClearLoggerForGoroutine()
return jasTask(threadId)
}
if _, jasErr := auditParallelRunner.Runner.AddTaskWithError(wrappedJasTask, func(taskErr error) {
Comment on lines +632 to +641
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you can use WrapTaskWithLoggerPropagation here as well

scanResults.AddGeneralError(fmt.Errorf("failed while adding JAS scan tasks: %s", taskErr.Error()), auditParams.AllowPartialResults())
}); jasErr != nil {
generalError = fmt.Errorf("failed to create JAS task: %s", jasErr.Error())
Expand Down
14 changes: 12 additions & 2 deletions commands/audit/auditbasicparams.go
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,9 @@ type AuditBasicParams struct {
xrayVersion string
xscVersion string
configProfile *xscservices.ConfigProfile
solutionFilePath string
useIncludedBuilds bool
solutionFilePath string
logCollector *LogCollector
useIncludedBuilds bool
}

func (abp *AuditBasicParams) DirectDependencies() *[]string {
Expand Down Expand Up @@ -344,6 +345,15 @@ func (abp *AuditBasicParams) SetSolutionFilePath(solutionFilePath string) *Audit
return abp
}

func (abp *AuditBasicParams) SetLogCollector(collector *LogCollector) *AuditBasicParams {
abp.logCollector = collector
return abp
}

func (abp *AuditBasicParams) GetLogCollector() *LogCollector {
return abp.logCollector
}

func (abp *AuditBasicParams) UseIncludedBuilds() bool { return abp.useIncludedBuilds }

func (abp *AuditBasicParams) SetUseIncludedBuilds(useIncludedBuilds bool) *AuditBasicParams {
Expand Down
41 changes: 41 additions & 0 deletions commands/audit/logcollector.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
package audit
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe this should be at jfrog/jfrog-client-go#1297?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these are the options

Move LogCollector to client-go - but it's really just a wrapper
Delete LogCollector entirely - Frogbot can use BufferedLogger directly from client-go

or we Keep it as is

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing code from repo is always good :)
If you already passing it in params, just use it no need for wrapper here


import (
"github.com/jfrog/jfrog-client-go/utils/log"
)

// LogCollector captures logs for isolated parallel audit operations.
type LogCollector struct {
logger *log.BufferedLogger
}

func NewLogCollector(level log.LevelType) *LogCollector {
return &LogCollector{
logger: log.NewBufferedLogger(level),
}
}

func (c *LogCollector) Logger() log.Log {
return c.logger
}

// ReplayTo outputs captured logs through the target logger (preserving colors).
func (c *LogCollector) ReplayTo(target log.Log) {
c.logger.ReplayTo(target)
}

func (c *LogCollector) HasLogs() bool {
return c.logger.Len() > 0
}

func (c *LogCollector) Len() int {
return c.logger.Len()
}

func (c *LogCollector) String() string {
return c.logger.String()
}

func (c *LogCollector) Clear() {
c.logger.Clear()
}
8 changes: 4 additions & 4 deletions go.mod
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/jfrog/jfrog-cli-security

go 1.25.4
go 1.25.5

require (
github.com/CycloneDX/cyclonedx-go v0.9.3
Expand All @@ -11,7 +11,7 @@ require (
github.com/gookit/color v1.6.0
github.com/hashicorp/go-hclog v1.6.3
github.com/hashicorp/go-plugin v1.6.3
github.com/jfrog/build-info-go v1.12.5-0.20251209171349-eb030db986f9
github.com/jfrog/build-info-go v1.13.0
github.com/jfrog/froggit-go v1.20.6
github.com/jfrog/gofrog v1.7.6
github.com/jfrog/jfrog-apps-config v1.0.1
Expand Down Expand Up @@ -135,12 +135,12 @@ require (
gopkg.in/warnings.v0 v0.1.2 // indirect
)

// replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go master

// replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 master

//replace github.com/jfrog/jfrog-cli-artifactory => github.com/jfrog/jfrog-cli-artifactory main

// replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go dev

// replace github.com/jfrog/froggit-go => github.com/jfrog/froggit-go master

replace github.com/jfrog/jfrog-client-go => github.com/eyalk007/jfrog-client-go v0.0.0-20260114112951-67b77f49255f
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reminder to remove replace after merging dependend PR

8 changes: 4 additions & 4 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,8 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o
github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
github.com/eyalk007/jfrog-client-go v0.0.0-20260114112951-67b77f49255f h1:wievyISUpwoYv47Q+SreXShHnwPaNBkcqGjSOJ7hRZk=
github.com/eyalk007/jfrog-client-go v0.0.0-20260114112951-67b77f49255f/go.mod h1:sCE06+GngPoyrGO0c+vmhgMoVSP83UMNiZnIuNPzU8U=
github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
Expand Down Expand Up @@ -146,8 +148,8 @@ github.com/jedib0t/go-pretty/v6 v6.7.5 h1:9dJSWTJnsXJVVAbvxIFxeHf/JxoJd7GUl5o3Uz
github.com/jedib0t/go-pretty/v6 v6.7.5/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
github.com/jfrog/archiver/v3 v3.6.1 h1:LOxnkw9pOn45DzCbZNFV6K0+6dCsQ0L8mR3ZcujO5eI=
github.com/jfrog/archiver/v3 v3.6.1/go.mod h1:VgR+3WZS4N+i9FaDwLZbq+jeU4B4zctXL+gL4EMzfLw=
github.com/jfrog/build-info-go v1.12.5-0.20251209171349-eb030db986f9 h1:CL7lp7Y7srwQ1vy1btX66t4wbztzEGQbqi/9tdEz7xk=
github.com/jfrog/build-info-go v1.12.5-0.20251209171349-eb030db986f9/go.mod h1:9W4U440fdTHwW1HiB/R0VQvz/5q8ZHsms9MWcq+JrdY=
github.com/jfrog/build-info-go v1.13.0 h1:bHedp1Gl+a8eR71xxP5JvkqwDj2X3r6e5NiIwNcIwRM=
github.com/jfrog/build-info-go v1.13.0/go.mod h1:+OCtMb22/D+u7Wne5lzkjJjaWr0LRZcHlDwTH86Mpwo=
github.com/jfrog/froggit-go v1.20.6 h1:Xp7+LlEh0m1KGrQstb+u0aGfjRUtv1eh9xQBV3571jQ=
github.com/jfrog/froggit-go v1.20.6/go.mod h1:obSG1SlsWjktkuqmKtpq7MNTTL63e0ot+ucTnlOMV88=
github.com/jfrog/gofrog v1.7.6 h1:QmfAiRzVyaI7JYGsB7cxfAJePAZTzFz0gRWZSE27c6s=
Expand All @@ -158,8 +160,6 @@ github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20251211075913-35ebcd308e93 h1:r
github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20251211075913-35ebcd308e93/go.mod h1:7cCaRhXorlbyXZgiW5bplCExFxlnROaG21K12d8inpQ=
github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20251210085744-f8481d179ac5 h1:GYE67ubwl+ZRw3CcXFUi49EwwQp6k+qS8sX0QuHDHO8=
github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20251210085744-f8481d179ac5/go.mod h1:BMoGi2rG0udCCeaghqlNgiW3fTmT+TNnfTnBoWFYgcg=
github.com/jfrog/jfrog-client-go v1.55.1-0.20251217080430-c92b763b7465 h1:Ff3BlNPndrAfa1xFI/ORFzfWTxQxF0buWG61PEJwd3U=
github.com/jfrog/jfrog-client-go v1.55.1-0.20251217080430-c92b763b7465/go.mod h1:WQ5Y+oKYyHFAlCbHN925bWhnShTd2ruxZ6YTpb76fpU=
github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88/go.mod h1:3w7q1U84EfirKl04SVQ/s7nPm1ZPhiXd34z40TNz36k=
Expand Down
4 changes: 3 additions & 1 deletion jas/runner/jasrunner.go
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,9 @@ func addJasScanTaskForModuleIfNeeded(params JasRunnerParams, subScan utils.SubSc

func addModuleJasScanTask(scanType jasutils.JasScanType, securityParallelRunner *utils.SecurityParallelRunner, task parallel.TaskFunc, scanResults *results.TargetResults, allowSkippingErrors bool) (generalError error) {
securityParallelRunner.JasScannersWg.Add(1)
if _, addTaskErr := securityParallelRunner.Runner.AddTaskWithError(task, func(err error) {
// Wrap task to propagate logger to worker goroutines (for isolated parallel logging)
wrappedTask := utils.WrapTaskWithLoggerPropagation(task)
if _, addTaskErr := securityParallelRunner.Runner.AddTaskWithError(wrappedTask, func(err error) {
_ = scanResults.AddTargetError(fmt.Errorf("failed to run %s scan: %s", scanType, err.Error()), allowSkippingErrors)
}); addTaskErr != nil {
generalError = scanResults.AddTargetError(fmt.Errorf("error occurred while adding '%s' scan to parallel runner: %s", scanType, addTaskErr.Error()), allowSkippingErrors)
Expand Down
5 changes: 4 additions & 1 deletion sca/scan/scascan.go
Original file line number Diff line number Diff line change
Expand Up @@ -73,8 +73,11 @@ func RunScaScan(strategy SbomScanStrategy, params ScaScanParams) (generalError e
// For Audit scans, we run the scan in parallel using the SecurityParallelRunner.
func runScaScanWithRunner(strategy SbomScanStrategy, params ScaScanParams) (generalError error) {
targetResult := params.ScanResults
scaTask := createScaScanTaskWithRunner(params.Runner, strategy, params)
// Wrap task to propagate logger to worker goroutines (for isolated parallel logging)
wrappedScaTask := utils.WrapTaskWithLoggerPropagation(scaTask)
// Create sca scan task
if _, taskCreationErr := params.Runner.Runner.AddTaskWithError(createScaScanTaskWithRunner(params.Runner, strategy, params), func(err error) {
if _, taskCreationErr := params.Runner.Runner.AddTaskWithError(wrappedScaTask, func(err error) {
_ = targetResult.AddTargetError(fmt.Errorf("failed to execute SCA scan: %s", err.Error()), params.AllowPartialResults)
}); taskCreationErr != nil {
_ = targetResult.AddTargetError(fmt.Errorf("failed to create SCA scan task: %s", taskCreationErr.Error()), params.AllowPartialResults)
Expand Down
Loading