Skip to content

scan-repository: include vulnerabilities in scan output - #1417

Open
amarkdotdev wants to merge 1 commit into
jfrog:mainfrom
amarkdotdev:fix/sast-vuln-display-1414
Open

scan-repository: include vulnerabilities in scan output#1417
amarkdotdev wants to merge 1 commit into
jfrog:mainfrom
amarkdotdev:fix/sast-vuln-display-1414

Conversation

@amarkdotdev

@amarkdotdev amarkdotdev commented Aug 31, 2026

Copy link
Copy Markdown

Fixes #1414

scan-repository was creating a ResultContext with IncludeVulnerabilities=false. When watches are configured, that hid JAS vulnerability tables (including SAST) even though the scan found issues.

Test plan

  • go test ./utils/issues/... ./utils/outputwriter/... -count=1 (pass)
  • scanrepository tests require JF_URL; change is a one-line context flag fix aligned with scan-pull-request behavior

Summary by CodeRabbit

  • Bug Fixes
    • Scan repository results now use the correct results context configuration, improving how scan outcomes are handled and displayed.

Fixes jfrog#1414

Signed-off-by: Aaron <amark@g.jct.ac.il>
@coderabbitai

coderabbitai Bot commented Sep 4, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: c1084798-2563-47ad-9c0e-1f2817d453fc

📥 Commits

Reviewing files that changed from the base of the PR and between f1b6baa and 6dd9dbe.

📒 Files selected for processing (1)
  • scanrepository/scanrepository.go

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.


📝 Walkthrough

Walkthrough

The scan repository command now enables the results context during prerequisite setup.

Changes

Scan repository results

Layer / File(s) Summary
Enable scan results context
scanrepository/scanrepository.go
setCommandPrerequisites now passes true to SetResultsContext. This changes the results context configuration for scan repository operations.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 6dd9d

Scan repository output will include detected vulnerabilities, including SAST results, with no identified merge-blocking risk.

Suggested reviewers: attiasas, eranturgeman, orto17

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the primary change: including vulnerabilities in scan-repository output.
Linked Issues check ✅ Passed The change sets the results context to include vulnerabilities, which directly addresses issue #1414 and enables SAST results in scan output.
Out of Scope Changes check ✅ Passed The pull request contains one focused configuration change related to vulnerability output. No unrelated changes are present.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

After scanning with Frogbot v3, the SAST scan results cannot be displayed in the xray-scanlist-git repository.

1 participant