Skip to content

Devassist: Realtime scanners (OSS, Secrets, Containers, IaC) with unified wrapper and enhanced parsing(AST-115438) #451

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
cx-anurag-dalke merged 12 commits into from
Dec 15, 2025
Merged

Devassist: Realtime scanners (OSS, Secrets, Containers, IaC) with unified wrapper and enhanced parsing(AST-115438) #451

cx-anurag-dalke merged 12 commits into from
Dec 15, 2025

Conversation

@cx-atish-jadhav
Copy link
Contributor

@cx-atish-jadhav cx-atish-jadhav commented Dec 3, 2025 •
edited by atlassian bot
Loading

Summary

  • Adds end-to-end support for all realtime scanners: OSS, Secrets, Containers, and IaC.
  • Introduces a unified realtime scan wrapper to reduce duplication and standardize execution.
  • Provides resilient JSON parsing and normalized models across scanners.
  • Adds configuration hooks and minor logging improvements for cleaner realtime output.

References

Testing Automated

  • Unit tests:

    • Validate JSON parsing, error handling, and model normalization for OSS, Secrets, Containers, and IaC scanners.
    • Cover edge cases such as blank lines, malformed JSON, missing keys, and null/empty arrays.

  • Integration tests (assumption-guarded):

    • Execute CLI-backed realtime scans for representative inputs and assert non-null, well-formed results.
    • Verify scan consistency by running multiple times on the same source.
    • Validate ignore-list behavior (where applicable) produces stable or reduced result sets.

Manual

  • Prerequisites: Configure PATH_TO_EXECUTABLE for the Checkmarx CLI and ensure environment access as needed.

  • OSS:

    • Run a realtime scan on a dependency manifest (e.g., Maven/Node/Python format).
    • Verify packages are returned with expected fields; optionally re-run with an ignore file and confirm filtered output.

  • Secrets:

    • Run a realtime scan on a known file with and without embedded credentials.
    • Verify findings on vulnerable files and low/no findings on clean files.

  • Containers:

    • Run a realtime scan on a Dockerfile or image reference.
    • Verify images and any associated vulnerabilities appear as expected.

  • IaC:

    • Run a realtime scan on IaC source (e.g., Terraform/Kubernetes manifests).
    • Confirm issues are surfaced with locations and metadata.

Not covered / notes

  • Integration tests are assumption-guarded and will skip where the CLI or environment isn’t available.

Expected outcomes

  • All new unit tests pass locally and in CI.
  • Existing tests continue to pass without regressions.
  • Realtime scans return structured, non-null results and behave consistently across repeated runs.

cx-atish-jadhav and others added 11 commits December 3, 2025 19:18
@cx-atish-jadhav
aimcp server changes
1810e78
@cx-atish-jadhav
oss-realtime scanner changes
bf95eb7
@cx-atish-jadhav
Create OssRealtimeVulnerability.java
7c72274
@cx-atish-jadhav
Unify realtime scan wrappers; consolidate Secrets/IaC models; depreca…
0677502 
…te and stub obsolete result classes
@cx-atish-jadhav
Add ContainersRealtimeVulnerability model for containers realtime sca…
2f0f55b 
…n parsing
@cx-atish-jadhav
Add @JsonCreator constructor to OssRealtimeVulnerability for reliable…
d1cb41c 
… Jackson deserialization
@cx-atish-jadhav
Refactoring package name and adding test for oss and mcp flag
b2f2588
@cx-atish-jadhav
Add integration tests for OSS, Container, and Secrets realtime scanners
d647f57
@cx-anand-nandeshwar @cx-atish-jadhav
Changed variable from id to CVE as per OSS response
ee4c90c
@cx-atish-jadhav
Add maskedResult for secret remediation and change log level from INF…
97c6c69 
…O to DEBUG
@cx-atish-jadhav
Remove masked secrets functionality from codebase
82d6c66
@cx-ben-alvo
Copy link
Collaborator

cx-ben-alvo commented Dec 3, 2025 •
edited
Loading

Logo
Checkmarx One – Scan Summary & Details – b8acd0b4-56c5-4030-81e1-e18272943ca2

Great job! No new security vulnerabilities introduced in this pull request

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

cx-anurag-dalke
cx-anurag-dalke approved these changes Dec 15, 2025
View reviewed changes
Copy link
Collaborator

@cx-anurag-dalke cx-anurag-dalke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

@cx-anurag-dalke cx-anurag-dalke merged commit 09bebed into main Dec 15, 2025
5 checks passed
cx-atish-jadhav added a commit that referenced this pull request Dec 29, 2025
@cx-atish-jadhav
Squashed commit of the following:
00ab820 
commit d95cdea
Merge: 09bebed bfcd160
Author: AST Sypher <astsypher@checkmarx.com>
Date:   Mon Dec 15 15:41:37 2025 +0530

    Merge pull request #452 from Checkmarx/feature/update_cli_2.3.41

    Update checkmarx-ast-cli binaries with 2.3.41

commit bfcd160
Author: cx-anurag-dalke <120229307+cx-anurag-dalke@users.noreply.github.com>
Date:   Mon Dec 15 09:54:20 2025 +0000

    Update checkmarx-ast-cli to 2.3.41

commit 87bb7ad
Author: github-actions <github-actions@github.com>
Date:   Mon Dec 15 09:54:19 2025 +0000

    Track Checkmarx CLI binaries with Git LFS

commit 09bebed
Author: Atish Jadhav <141334503+cx-atish-jadhav@users.noreply.github.com>
Date:   Mon Dec 15 13:26:35 2025 +0530

    Devassist: Realtime scanners (OSS, Secrets, Containers, IaC) with unified wrapper and enhanced parsing(AST-115438) (#451)

    * aimcp server changes

    * oss-realtime scanner changes

    * Create OssRealtimeVulnerability.java

    * Unify realtime scan wrappers; consolidate Secrets/IaC models; deprecate and stub obsolete result classes

    * Add ContainersRealtimeVulnerability model for containers realtime scan parsing

    * Add @JsonCreator constructor to OssRealtimeVulnerability for reliable Jackson deserialization

    * Refactoring package name and adding test for oss and mcp flag

    * Add integration tests for OSS, Container, and Secrets realtime scanners

    * Changed variable from id to CVE as per OSS response

    * Add maskedResult for secret remediation and change log level from INFO to DEBUG

    * Remove masked secrets functionality from codebase

    * Implemented mask cmd in java wrapper

    ---------

    Co-authored-by: cx-anand-nandeshwar <73646287+cx-anand-nandeshwar@users.noreply.github.com>
Merge branch 'main' into feature/agentic_ai
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cx-anurag-dalke cx-anurag-dalke cx-anurag-dalke approved these changes

@cx-anand-nandeshwar cx-anand-nandeshwar Awaiting requested review from cx-anand-nandeshwar

@cx-umesh-waghode cx-umesh-waghode Awaiting requested review from cx-umesh-waghode

Assignees

No one assigned

Labels

feature

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@cx-atish-jadhav @cx-ben-alvo @cx-anurag-dalke @cx-anand-nandeshwar