AST-168518 Additional SCA Package Manager and Publish Plugin Version by cx-anand-nandeshwar · Pull Request #269 · Checkmarx/ast-eclipse-plugin

cx-anand-nandeshwar · 2026-08-19T14:48:53Z

By submitting a PR to this repository, you agree to the terms within the Checkmarx Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Added new package manager support for OSS scan engine listed below.

Java: Gradle (build.gradle, build.gradle.kts)
Java: SBT (build.sbt, any .sbt file ✱)
JS/TS: Yarn (1 & 2) (package.json, yarn.lock)
JS/TS: Bower (bower.json)
Python: PIP (requirements.txt, requirements-.txt, requirement.txt, requirement-.txt)
Python: Setup.py / Setuptools (Setup.py, Setup.cfg)
Python: Poetry (pyproject.toml, poetry.lock)
PHP/Drupal: Composer (composer.json, composer.lock)
Ruby: RubyGems (Gemfile, Gemfile.lock)

Publish plugin version and refactor existing wrapper call code

Publish plugin version with format Eclipse_<Cx_Eclipse_Plugin_version>/ASTCLI_<ASTCLI_VERSION> in every API call that happens via CLI
Created factory class to interact with CLI
Refactor existing reference of CLI call, now it will go through the wrapper factory class.

Improved Checkmarx Login settings page

Persist the connected state and success message across page reopens.
lock/unlock the API key field and Connect/Logout buttons based on
connection state.
Added a logout confirmation dialog, and focus the API key field on open.
Persist API key after logout to reuse the key

Checkmarx One Assist Page: Checkmarx MCP settings section

Added Install MCP
Added Edit MCP: Open Copilot MCP configuration preference page

References

Testing

Describe how this change was tested. Be specific about anything not tested and reasons why. If this solution has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

Please include any manual steps for testing end-to-end or functionality not covered by unit/integration tests.

Checklist

I have added documentation for new/changed functionality in this PR (if applicable).
All active GitHub checks for tests, formatting, and security are passing
The correct base branch is being used

…chitectural cleanup This commit implements comprehensive refactoring to enable plugin version telemetry: Core changes: - Added agent name + plugin version stamping in CxWrapperFactory to report "Eclipse_<version>" in all API calls - Created common-lib/wrapper/CxWrapperFactory with version reading from OSGi Bundle metadata - Created WrapperProvider facade for common-lib (project/auth/tenant operations) - Created ScannerWrapperProvider in devassist-lib (scanner-specific operations, not exported) - Moved CxWrapperFactory from devassist-lib/factory to common-lib/wrapper (shared location) Refactoring across all wrapper consumers: - DataProvider: removed hand-built CxWrapper/CxConfig, uses WrapperProvider for all operations - Authenticator: centralized via WrapperProvider for test-connection credential validation - TenantSettingsProvider: uses WrapperProvider for MCP feature-flag checks - All 5 scanner services (Asca/OSS/Container/IaC/Secrets): inject ScannerWrapperProvider field Architectural improvements: - Eliminated duplicate wrapper-building logic across 9 files - Encapsulated scanner operations in devassist-lib (not exported from common-lib) - Established clear inversion-of-control pattern with injected provider instances - Added comprehensive unit tests (CxWrapperFactoryTest, WrapperProviderTest) Build & test verification: - Full reactor compile: SUCCESS - All 64 tests pass (58 DataProvider + 2 new factory tests + 4 new provider tests) - Java 17 JDT settings (consistent with Tycho build target) - Cleaned up dead comment blocks referencing deleted factory path Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Updated dependency version to match the latest stable release. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

…g_mgr' into feature/anand_sca_plugin_version # Conflicts: # devassist-lib/src/com/checkmarx/eclipse/devassist/utils/DevAssistConstants.java

…n' into feature/anand_sca_plugin_version # Conflicts: # devassist-lib/src/com/checkmarx/eclipse/devassist/scanners/containers/ContainerScannerService.java # devassist-lib/src/com/checkmarx/eclipse/devassist/scanners/oss/OssScannerService.java

- Added plugin version with expected format - Resolved review comments for #265

stepsecurity-app · 2026-08-19T14:49:04Z

✅ Resolved — a later workflow run passed this policy check.

Original alert (resolved)

Security Policy Alert: Actions Policy Violation

This workflow run has been blocked by StepSecurity's actions policy.

Disallowed Actions:

timonvs/pr-labeler-action@8b99f404a073744885d8021d1de4e40c6eaf38e2

To fix this issue, please modify the workflow to use only allowed actions. Contact your organization administrator to request changes to the allowed actions list if needed.

For more information, see StepSecurity's Actions Policy documentation.

Add a help page link, reposition the CLI help link and Connect/Logout buttons for correct layout ordering and spacing, and require a Yes/Cancel confirmation before logging out with a success message shown afterward.

Persist the connected state and success message across page reopens, lock/unlock the API key field and Connect/Logout buttons based on connection state, add a logout confirmation dialog, and focus the API key field on open.

Introduce Preferences.isAuthenticated() as the single source of truth for login state, and route every existing "API key non-blank" check through it instead, so a future auth method (e.g. OAuth) only needs to set/clear the same flag. Logout now only clears the validated flag and no longer wipes the stored API key, which stays visible/editable in the preferences page.

stepsecurity-app · 2026-08-20T12:11:02Z

Security Policy Alert: Secret Policy Violation

This workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch.

Secret references detected:

secrets.AST_RND_SCANS_BASE_URI at line 20
secrets.AST_RND_SCANS_TENANT at line 21
secrets.AST_RND_SCANS_CLIENT_ID at line 22
secrets.AST_RND_SCANS_CLIENT_SECRET at line 23

To approve this workflow, please add the workflows-approved label to this PR.

Note: The label must be added by someone other than the PR author (cx-anand-nandeshwar) or automation bots to ensure proper security review.

After the label is added, you can re-run the blocked workflow to proceed.

This workflow will be automatically approved once merged into the default branch.

For more information, see StepSecurity's Secret Exfiltration Policy documentation.

cx-rakesh-kadu · 2026-08-20T12:52:50Z

@@ -97,30 +94,25 @@ public void setCurrentResults(Results currentResults) {
 	 */
 	public List<Project> getProjects() throws Exception {
 		List<Project> projectList = new ArrayList<Project>();


Previously, authenticateWithAST() ran outside the try/catch, so a CxException propagated out of these methods; live callers in CheckmarxView.java (getProjects() ~line 2956, getTriageInfo() ~line 1984) both catch that exception and call PluginUtils.showMessage(...) to surface it. The refactor now catches IOException | InterruptedException | CxException inside DataProvider, logs it, and returns an empty list — so on auth failure, expired session, or network error, users now silently see an empty project/triage list instead of an error message. This is a normal-usage trigger (any auth/session hiccup), not an edge case.

Suggested fix: Let the checked exceptions propagate (remove the local catch, matching the pre-PR authenticateWithAST()-outside-try behavior), or explicitly re-throw after logging — as triageUpdate()/getScanInformation() already correctly do in this same file.

Evidence: New code: try { projectList = wrapperProvider.getProjects(LIMIT_FILTER); } catch (IOException | InterruptedException | CxException e) { CxLogger.error(...); } (no rethrow); CheckmarxView.java lines 2956-2968 and 1984-1996 both wrap the call in try/catch(Exception e) { ... showMessage(...) }, now unreachable for these exception types.

cx-rakesh-kadu · 2026-08-20T12:55:19Z

+		// load() called on them yet at this point in createFieldEditors(), so their
+		// text
+		// controls are still empty.
+		lastValidatedApiKey = (Preferences.isCredentialsValidated() && StringUtils.isNotBlank(Preferences.getApiKey()))


Optional : lastValidatedApiKey persistence across page reopen, the logout confirmation dialog, and field enable/disable transitions are meaningfully complex new interacting logic with no test anywhere in the suite.

cx-rakesh-kadu · 2026-08-20T12:56:26Z

+		connectionButton.setLayoutData(connectionButtonGridData);
+		// Disabled while already connected - re-enabled on logout (see logoutButton
+		// below).
+		connectionButton.setEnabled(!isConnected);


Connect button no longer disabled when the API key field is blank

Suggested Fix : Restore the blank-check in both the initial setEnabled call and the modify listener (!stillMatchesValidatedKey && StringUtils.isNotBlank(textControl.getText())), and/or add the same blank-guard Authenticator.doAuthentication is missing relative to TenantSettingsProvider.isAiMcpServerEnabled.

Evidence: PreferencesPage.java:266 connectionButton.setEnabled(!isConnected);; lines 280-293 modify listener never checks blankness; line ~426 logout handler re-enables Connect with a field just cleared to ""; TenantSettingsProvider.java:25 shows the blank-guard pattern Authenticator.java lacks.

cx-rakesh-kadu · 2026-08-20T12:57:15Z

-								apiKey_str, additionalParams_str);
+						return Authenticator.INSTANCE.doAuthentication(apiKey_str, additionalParams_str);
 					} catch (Throwable t) {
 						CxLogger.error(PluginConstants.ERROR_AUTHENTICATING_AST, new Exception(t));


CxLogger.error(PluginConstants.ERROR_AUTHENTICATING_AST, new Exception(t)); passes the raw %s-containing format string without String.format, dropping the actual failure cause from the log — operators only ever see the literal text with %s in it, right on the Connect-flow's exception path this PR reworked.

Suggested fix: CxLogger.error(String.format(PluginConstants.ERROR_AUTHENTICATING_AST, t.getMessage()), new Exception(t)); — matches the correct pattern already used in Authenticator.java:31.

Evidence: PreferencesPage.java:317 vs. Authenticator.java:31 (correct pattern in the same authentication flow).

cx-rakesh-kadu · 2026-08-20T12:58:38Z

 	   }

 	   // for test only
 	   public Authenticator(Logger logger) {


doAuthentication() now calls new WrapperProvider().authValidate(...), which builds its own logger internally in CxWrapperFactory — the injected log field is write-only, so the "for test only" constructor no longer isolates log output the way its comment implies.

Suggested fix: Remove the now-unused log field/constructor, or thread the injected logger through to WrapperProvider/CxWrapperFactory if test log-isolation is still a goal.

Evidence: Authenticator.java lines 10-20 (log field assigned, never read); line 27 delegates entirely to new WrapperProvider().authValidate(...).

cx-rakesh-kadu · 2026-08-20T12:59:24Z

-	   
-	   private Authenticator() {
+
+	   public Authenticator() {


Constructor widened from private to public, weakening the singleton invariant

public static final Authenticator INSTANCE = new Authenticator(); implies single-instance usage, but the no-arg constructor is now public with no current caller needing it (repo-wide grep finds only INSTANCE's own initializer). No live regression today, but it invites accidental multi-instantiation if the class gains real per-instance state later.

Suggested fix: Revert to private Authenticator() unless a specific caller requires public construction.

Evidence: Diff: -private Authenticator() { / +public Authenticator() {; INSTANCE field retained unchanged.

cx-rakesh-kadu · 2026-08-20T13:05:23Z

+import com.checkmarx.eclipse.devassist.common.ScanResult;
+import com.checkmarx.eclipse.devassist.common.ScannerConfig;
+import com.checkmarx.eclipse.devassist.utils.DevAssistConstants;
+import com.checkmarx.eclipse.devassist.utils.ScanEngine;


Two structurally different ScanEngine enums coexist in the repo; this file is the sole outlier using utils.ScanEngine instead of model.ScanEngine. Harmless today because the only use is .name() feeding a String field and both produce "ASCA", but since the types are distinct classes, passing this file's constant into any of the many APIs keyed on model.ScanEngine (ScannerStateManager, RemediationManager) would hit a confusing compile error, and a careless workaround could silently diverge ASCA's state/notification path from the rest of the engine-keyed logic.

Suggested fix: Change the import back to com.checkmarx.eclipse.devassist.model.ScanEngine; consider deleting the unused duplicate utils.ScanEngine enum entirely.

Evidence: Diff swaps model.ScanEngine → utils.ScanEngine; grep confirms 17 other files use model.ScanEngine exclusively; only usage here is .engineName(ScanEngine.ASCA.name()).

cx-rakesh-kadu · 2026-08-20T13:07:26Z

-			scanResult = CxWrapperFactory.build().ScanAsca(path, ascaLatestVersion, agent, null);
+			scanResult = wrapperProvider.scanAsca(path, ascaLatestVersion, agent, null);
 		} catch (IOException e) {
 			e.printStackTrace();


Scan failures logged via e.printStackTrace() instead of CxLogger, inconsistent with sibling scanners touched by this same PR

Suggested fix: Replace e.printStackTrace() with CxLogger.error(LOG_TAG + " scan failed: " + e.getMessage(), e) in all three files, matching the Oss/Secrets pattern.

cx-rakesh-kadu · 2026-08-20T13:10:11Z

+		PYTHON(List.of("**/requirement*.txt", "**/constraints.txt", "**/constraints-*.txt", "**/pyproject.toml",
+				"**/setup.cfg", "**/setup.py")),
+		BOWER(List.of("**/bower.json")),
+    	//YARN(List.of("package.json", "yarn.lock")),


If not required then remove it

cx-rakesh-kadu · 2026-08-20T13:11:06Z

+	GO("go", ManifestFilePattern.GO),
+	PYTHON("python", ManifestFilePattern.PYTHON),
+	BOWER("bower", ManifestFilePattern.BOWER),
+	//YARN("yarn", ManifestFilePattern.YARN),


PR-claimed Yarn support is not actually implemented — enum constant fully commented out

… display

cx-atish-jadhav

Changes for SCA package manager validated all OK

cx-anand-nandeshwar and others added 8 commits August 15, 2026 02:18

- Added addition SCA package manager support

27861e0

Added additional SCA package manager support

4906dd3

Updated package manager with additional SCA support

a587a80

Upgrade ast-cli-java-wrapper from 2.4.24 to 2.4.27

6ff513b

Updated dependency version to match the latest stable release. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/feature/AST-168518_additional_pk…

67ec197

…g_mgr' into feature/anand_sca_plugin_version # Conflicts: # devassist-lib/src/com/checkmarx/eclipse/devassist/utils/DevAssistConstants.java

Additional Package Manager

0da81b3

- Added plugin version with expected format - Resolved review comments for #265

cx-anand-nandeshwar requested a review from cx-anurag-dalke as a code owner August 19, 2026 14:48

cx-anand-nandeshwar requested a review from cx-rakesh-kadu August 19, 2026 14:49

cx-anand-nandeshwar changed the title ~~Feature/anand sca plugin version~~ AST-168518 Additional SCA Package Manager and Publish Plugin Version Aug 19, 2026

Enhance Checkmarx One preferences page UI and add logout confirmation

1fbdd4e

Add a help page link, reposition the CLI help link and Connect/Logout buttons for correct layout ordering and spacing, and require a Yes/Cancel confirmation before logging out with a success message shown afterward.

cx-rakesh-kadu requested a review from cx-umesh-waghode August 20, 2026 09:21

cx-anand-nandeshwar added 2 commits August 20, 2026 15:46

Improve Checkmarx One preferences page connect/logout UX

fa226a5

Persist the connected state and success message across page reopens, lock/unlock the API key field and Connect/Logout buttons based on connection state, add a logout confirmation dialog, and focus the API key field on open.

cx-rakesh-kadu requested changes Aug 20, 2026

View reviewed changes

Add Checkmarx MCP configuration UI with install/edit links and status…

4ae2fb5

… display

cx-atish-jadhav self-requested a review August 21, 2026 07:01

cx-atish-jadhav approved these changes Aug 21, 2026

View reviewed changes

Set fixed width (500px) for API key and Additional Params input fields

50ab007

Uh oh!

Conversation

cx-anand-nandeshwar commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

References

Testing

Checklist

Uh oh!

stepsecurity-app Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Policy Alert: Actions Policy Violation

Disallowed Actions:

Uh oh!

stepsecurity-app Bot commented Aug 20, 2026

Security Policy Alert: Secret Policy Violation

Secret references detected:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cx-atish-jadhav left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cx-anand-nandeshwar commented Aug 19, 2026 •

edited

Loading

stepsecurity-app Bot commented Aug 19, 2026 •

edited

Loading