Applications for leap

go.mod

@@ -118,12 +118,15 @@ require (
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 )
 
-replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security v1.13.9-0.20250106070938-333ac33ce675
+replace github.com/jfrog/jfrog-cli-security => github.com/orto17/jfrog-cli-security v0.0.0-20250106071330-575521ecca16
+//replace github.com/jfrog/jfrog-cli-security => ../jfrog-cli-security
 
-// replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev
+replace github.com/jfrog/jfrog-cli-core/v2 => github.com/orto17/jfrog-cli-core/v2 v2.0.0-20250106064835-4987fc040d3d
 
 // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go dev
 
-replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go v1.28.1-0.20241230154616-e342ed5065f1
+replace github.com/jfrog/jfrog-client-go => /github.com/orto17/jfrog-client-go v0.0.0-20250105135705-d0d16a2c04fa
+//replace github.com/jfrog/jfrog-client-go => ../jfrog-client-go //github.com/orto17/jfrog-client-go v0.0.0-20250105135705-d0d16a2c04fa
+
+replace github.com/jfrog/froggit-go => github.com/orto17/froggit-go v0.0.0-20250113090427-0a3d80025d0c
 
-// replace github.com/jfrog/froggit-go => github.com/jfrog/froggit-go dev

go.sum

@@ -123,18 +123,12 @@ github.com/jfrog/archiver/v3 v3.6.1 h1:LOxnkw9pOn45DzCbZNFV6K0+6dCsQ0L8mR3ZcujO5
 github.com/jfrog/archiver/v3 v3.6.1/go.mod h1:VgR+3WZS4N+i9FaDwLZbq+jeU4B4zctXL+gL4EMzfLw=
 github.com/jfrog/build-info-go v1.10.7 h1:10NVHYg0193gJpQft+S4WQfvYMtj5jlwwhJRvkFJtBE=
 github.com/jfrog/build-info-go v1.10.7/go.mod h1:JcISnovFXKx3wWf3p1fcMmlPdt6adxScXvoJN4WXqIE=
-github.com/jfrog/froggit-go v1.16.2 h1:F//S83iXH14qsCwYzv0zB2JtjS2pJVEsUoEmYA+37dQ=
-github.com/jfrog/froggit-go v1.16.2/go.mod h1:5VpdQfAcbuyFl9x/x8HGm7kVk719kEtW/8YJFvKcHPA=
 github.com/jfrog/gofrog v1.7.6 h1:QmfAiRzVyaI7JYGsB7cxfAJePAZTzFz0gRWZSE27c6s=
 github.com/jfrog/gofrog v1.7.6/go.mod h1:ntr1txqNOZtHplmaNd7rS4f8jpA5Apx8em70oYEe7+4=
 github.com/jfrog/jfrog-apps-config v1.0.1 h1:mtv6k7g8A8BVhlHGlSveapqf4mJfonwvXYLipdsOFMY=
 github.com/jfrog/jfrog-apps-config v1.0.1/go.mod h1:8AIIr1oY9JuH5dylz2S6f8Ym2MaadPLR6noCBO4C22w=
-github.com/jfrog/jfrog-cli-core/v2 v2.57.5 h1:guVB/zPPtS8CWpNvAFPCxNvSgVra4TyX8lzs4V4+I/4=
-github.com/jfrog/jfrog-cli-core/v2 v2.57.5/go.mod h1:LfKvCRXbvwgE0V6aX3/GabkzCedghXq0Y6lmsEuxr44=
-github.com/jfrog/jfrog-cli-security v1.13.9-0.20250106070938-333ac33ce675 h1:tAGGhyUrHXS8xpFJcR9TsEUOYI3zV2OuEHttgLTrHk4=
-github.com/jfrog/jfrog-cli-security v1.13.9-0.20250106070938-333ac33ce675/go.mod h1:lwaXWYJirqBhNmQ148xpM2h4s9xGLaoG50T2/Ax2jM0=
-github.com/jfrog/jfrog-client-go v1.28.1-0.20241230154616-e342ed5065f1 h1:JQvbTSPDkPNpts1NLHGTKvtG4cMFY1ptBHTNMYFyMhs=
-github.com/jfrog/jfrog-client-go v1.28.1-0.20241230154616-e342ed5065f1/go.mod h1:2ySOMva54L3EYYIlCBYBTcTgqfrrQ19gtpA/MWfA/ec=
+github.com/jfrog/jfrog-cli-security v1.13.6 h1:gm8TnGTlprMJbRga0cujeoN2xal7Pagd2kDkUfclvrw=
+github.com/jfrog/jfrog-cli-security v1.13.6/go.mod h1:NarJyhl8Kh0HL6br74oeStIosLmCjA7atLYxZIFHJc4=
 github.com/jordan-wright/email v4.0.1-0.20210109023952-943e75fe5223+incompatible h1:jdpOPRN1zP63Td1hDQbZW73xKmzDvZHzVdNYxhnTMDA=
 github.com/jordan-wright/email v4.0.1-0.20210109023952-943e75fe5223+incompatible/go.mod h1:1c7szIrayyPPB/987hsnvNzLushdWf4o/79s3P08L8A=
 github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88/go.mod h1:3w7q1U84EfirKl04SVQ/s7nPm1ZPhiXd34z40TNz36k=
@@ -192,6 +186,13 @@ github.com/nwaples/rardecode v1.1.3 h1:cWCaZwfM5H7nAD6PyEdcVnczzV8i/JtotnyW/dD9l
 github.com/nwaples/rardecode v1.1.3/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
 github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
 github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
+github.com/orto17/froggit-go v0.0.0-20250113090427-0a3d80025d0c h1:cy2uZ2sQTRxaVat47CAzjeYA7/Nqrt5eKMsBgoiUcvs=
+github.com/orto17/froggit-go v0.0.0-20250113090427-0a3d80025d0c/go.mod h1:5VpdQfAcbuyFl9x/x8HGm7kVk719kEtW/8YJFvKcHPA=
+github.com/orto17/jfrog-cli-core/v2 v2.0.0-20250106064835-4987fc040d3d h1:FS4HhBj3d8qFmLcIqMUsqpWUFJ800919w7aJA3yprLM=
+github.com/orto17/jfrog-cli-core/v2 v2.0.0-20250106064835-4987fc040d3d/go.mod h1:LfKvCRXbvwgE0V6aX3/GabkzCedghXq0Y6lmsEuxr44=
+github.com/orto17/jfrog-cli-security v0.0.0-20250106071330-575521ecca16/go.mod h1:L0NSfgYh8GPpI7upJXQ5lxl8MDhORj+9r+r4aC+vz5I=
+github.com/orto17/jfrog-client-go v0.0.0-20250105135705-d0d16a2c04fa h1:1gfSR4cS3AngC3PPC5YQRh2cdjaoWy7vKLZwdb6O7YU=
+github.com/orto17/jfrog-client-go v0.0.0-20250105135705-d0d16a2c04fa/go.mod h1:2ySOMva54L3EYYIlCBYBTcTgqfrrQ19gtpA/MWfA/ec=
 github.com/owenrumney/go-sarif v1.1.1/go.mod h1:dNDiPlF04ESR/6fHlPyq7gHKmrM0sHUvAGjsoh8ZH0U=
 github.com/owenrumney/go-sarif/v2 v2.3.1 h1:77opmuqxQZE1UF6TylFz5XllVEI72WijgwpwNw4JTmY=
 github.com/owenrumney/go-sarif/v2 v2.3.1/go.mod h1:MSqMMx9WqlBSY7pXoOZWgEsVB4FDNfhcaXDA1j6Sr+w=

scanpullrequest/scanpullrequest.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"strconv"
 
 	"github.com/jfrog/frogbot/v2/utils"
 	"github.com/jfrog/frogbot/v2/utils/issues"
@@ -15,7 +16,9 @@ import (
 	"github.com/jfrog/jfrog-cli-security/utils/jasutils"
 	"github.com/jfrog/jfrog-cli-security/utils/results"
 	"github.com/jfrog/jfrog-cli-security/utils/results/conversion"
+	"github.com/jfrog/jfrog-cli-security/utils/unifiedpolicy"
 	"github.com/jfrog/jfrog-cli-security/utils/xsc"
+	evaluate "github.com/jfrog/jfrog-client-go/unifiedpolicy/services"
 	"github.com/jfrog/jfrog-client-go/utils/log"
 	"github.com/jfrog/jfrog-client-go/xray/services"
 )
@@ -152,6 +155,11 @@ func auditPullRequest(repoConfig *utils.Repository, client vcsclient.VcsClient)
 		utils.CreateScanEvent(scanDetails.ServerDetails, nil, analyticsScanPrScanType),
 	)
 
+	err = utils.SendCommitInfo(scanDetails)
+	if err != nil {
+		return
+	}
+
 	defer func() {
 		if issuesCollection != nil {
 			xsc.SendScanEndedEvent(scanDetails.XrayVersion, scanDetails.XscVersion, scanDetails.ServerDetails, scanDetails.MultiScanId, scanDetails.StartTime, issuesCollection.GetAllIssuesCount(true), err)
@@ -170,9 +178,30 @@ func auditPullRequest(repoConfig *utils.Repository, client vcsclient.VcsClient)
 		issuesCollection.Append(projectIssues)
 	}
 	resultContext = scanDetails.ResultContext
+
+	err = sendUnifiedPolicyEvaluationRequest(scanDetails, err)
 	return
 }
 
+func sendUnifiedPolicyEvaluationRequest(scanDetails *utils.ScanDetails, err error) error {
+	evaluateRequest := &evaluate.EvaluateRequest{
+		Action: "application:pr",
+		Context: evaluate.Context{
+			Stage: "development",
+		},
+		Resource: evaluate.Resource{
+			ApplicationKey: scanDetails.ApplicationKey,
+			Type:           "pr",
+			MultiScanId:    scanDetails.MultiScanId,
+			GitRepoUrl:     scanDetails.Git.RepositoryCloneUrl,
+			PullRequestId:  strconv.FormatInt(scanDetails.Git.PullRequestDetails.ID, 10),
+		},
+	}
+	// currently we will not be using the unified policy decision, as we are still running the traditional policies and watches flow.
+	_, err = unifiedpolicy.Evaluate(scanDetails.ServerDetails, evaluateRequest)
+	return err
+}
+
 func auditPullRequestInProject(repoConfig *utils.Repository, scanDetails *utils.ScanDetails) (auditIssues *issues.ScansIssuesCollection, err error) {
 	// Download source branch
 	sourcePullRequestInfo := scanDetails.PullRequestDetails.Source

utils/application.go

@@ -0,0 +1,37 @@
+package utils
+
+import (
+	"context"
+	"github.com/jfrog/jfrog-cli-security/utils/application"
+	"github.com/jfrog/jfrog-client-go/application/services"
+	"strings"
+)
+
+func SendCommitInfo(scanDetails *ScanDetails) (err error) {
+	latestCommit, err := scanDetails.client.GetLatestCommit(context.Background(), scanDetails.Git.PullRequestDetails.Source.Owner,
+		scanDetails.Git.PullRequestDetails.Source.Repository, scanDetails.Git.PullRequestDetails.Source.Name)
+	if err != nil {
+		return
+	}
+	changedFiles, err := scanDetails.client.GetModifiedFiles(context.Background(), scanDetails.Git.PullRequestDetails.Source.Owner,
+		scanDetails.Git.PullRequestDetails.Source.Repository, latestCommit.Hash, latestCommit.ParentHashes[0])
+	if err != nil {
+		return
+	}
+	commitInfo := services.CreateApplicationCommitInfo{
+		GitRepoUrl:     scanDetails.Git.RepositoryCloneUrl,
+		CommitHash:     latestCommit.Hash,
+		ParentHash:     latestCommit.ParentHashes[0],
+		Branch:         scanDetails.Git.PullRequestDetails.Source.Name,
+		AuthorEmail:    latestCommit.AuthorEmail,
+		AuthorName:     latestCommit.AuthorName,
+		AuthorDate:     latestCommit.AuthorDate,
+		CommitterDate:  latestCommit.Timestamp,
+		CommitterName:  latestCommit.CommitterName,
+		CommitterEmail: latestCommit.CommitterEmail,
+		MessageSubject: latestCommit.Message,
+		ChangedFiles:   []byte(strings.Join(changedFiles, ",")),
+	}
+
+	return application.SendCommitInfo(scanDetails.ApplicationKey, scanDetails.ServerDetails, commitInfo)
+}

utils/consts.go

@@ -33,6 +33,7 @@ const (
 	JFrogTokenEnv            = "JF_ACCESS_TOKEN"
 	JfrogUseConfigProfileEnv = "JF_USE_CONFIG_PROFILE"
 	JfrogConfigProfileEnv    = "JF_CONFIG_PROFILE"
+	JfrogApplicationKey      = "JF_APPLICATION_KEY"
 
 	// Git environment variables
 	GitProvider                      = "JF_GIT_PROVIDER"

utils/params.go

@@ -594,6 +594,7 @@ func extractJFrogCredentialsFromEnvs() (*coreconfig.ServerDetails, error) {
 	} else {
 		return nil, fmt.Errorf("%s and %s or %s environment variables are missing", JFrogUserEnv, JFrogPasswordEnv, JFrogTokenEnv)
 	}
+	server.ApplicationKey = getTrimmedEnv(JfrogApplicationKey)
 	return &server, nil
 }