feat(integration-jfrog): delete XRay issue on withdrawn report (Stage 2) - #51
Merged
Conversation
When the feed re-delivers a report as withdrawn (for example a retracted
false positive), delete the matching XRay Custom Issue instead of logging a
no-op. The issue id is the reproducible SD-<report_id>, so the delete needs
no stored name-to-id mapping.
- Add deleteMaliciousPackage to the xrayClient port: DELETE
/xray/api/v1/events/{id}. 404 is benign (already absent), an over-length id
is skipped (never pushed), other non-2xx is a logged best-effort failure.
- handleRecord routes a withdrawn report to delete, any other malicious report
to push.
- printClient prints "Would delete" for dry-run and sends nothing.
- Docs: run behaviour and the internal design doc updated to reflect delete.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
SafeDep Report Summary
No dependency changes detected. Nothing to scan. This report is generated by SafeDep GitHub App |
…ary as description The feed title is only the first few words of the feed summary, so mapping the XRay summary to the feed title produced a truncated, redundant headline. Set the XRay summary to the synthesized "MALICIOUS PACKAGE: <name> contains malicious code" instead, and keep the XRay description sourced from the feed summary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
arunanshub
previously approved these changes
Aug 26, 2026
…elete 404 XRay does not upsert on a duplicate id, so re-pushing an unchanged report (on restart or an overlapping --backfill) returns 400 "already exists". That is the desired end state (issue present), so pushMaliciousPackage now returns it as benign (id, 400, nil) and the service logs "Already present" at info level, matching the delete "already absent" (404) handling instead of a yellow "Push failed" warning. Other 400s remain errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
Change the synthesized XRay Custom Issue summary from "MALICIOUS PACKAGE: <name> contains malicious code" to "<name> identified as Malware by SafeDep". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
arunanshub
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stage 2 of the JFrog integration: act on withdrawn reports by deleting the XRay Custom Issue. Builds on the merged feed migration (#47) and dry-run/cursor work (#49).
What
When the feed re-delivers a report as
withdrawn(for example a retracted false positive), delete the matching XRay Custom Issue instead of logging a no-op. Before this, the daemon printedWithdrawn report … retraction handling not yet enabled, skipping.How
deleteMaliciousPackageto thexrayClientport:DELETE /xray/api/v1/events/{id}, keyed by the reproducibleSD-<report_id>(no stored name-to-id mapping needed).handleRecordroutes a withdrawn report to delete, any other malicious report to push.printClientprintsWould delete:for dry-run and sends nothing.Delete semantics
Tests
DELETE …/events/SD-…+ bearer), 404 benign, 500 error, over-length skip (no call).go build ./...,go test ./..., gofmt, and the cobra convention tests are green.Docs
docs/cmd/integration-jfrog-run.md: withdrawn-report behaviour now describes the delete.docs/integration-jfrog.md: flow diagram, log examples, and the withdrawn-reports section updated.🤖 Generated with Claude Code
https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
Generated by Claude Code