Skip to content

feat: let Gradle component metadata resolve distribution URLs on a warm cache #7049

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
calhar-snyk wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: let Gradle component metadata resolve distribution URLs on a warm cache #7049

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions cliv2-private/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,11 +210,11 @@ require (
github.com/skeema/knownhosts v1.3.2 // indirect
github.com/snyk/cli-extension-agent-scan v0.0.0-20260715092951-4f8fa1b9886c // indirect
github.com/snyk/cli-extension-ai-bom v0.0.0-20260721084000-da8dc26c77f2 // indirect
github.com/snyk/cli-extension-dep-graph/v2 v2.7.2 // indirect
github.com/snyk/cli-extension-dep-graph/v2 v2.8.1 // indirect
github.com/snyk/cli-extension-iac v0.0.0-20260515092252-505c498f1077 // indirect
github.com/snyk/cli-extension-iac-rules v0.0.0-20260515141409-fb475901bb8e // indirect
github.com/snyk/cli-extension-os-flows v0.0.0-20260722114313-168a09671091 // indirect
github.com/snyk/cli-extension-sbom v0.0.0-20260722102401-3c3af28e7b93 // indirect
github.com/snyk/cli-extension-sbom v0.0.0-20260728161808-90fff659c450 // indirect
github.com/snyk/cli-extension-secrets v0.0.0-20260619070019-764c5c87eda3 // indirect
github.com/snyk/code-client-go v1.27.5 // indirect
github.com/snyk/container-cli v0.0.0-20260213211631-cd2b2cf8f3ea // indirect
Expand Down
8 changes: 4 additions & 4 deletions cliv2-private/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -573,16 +573,16 @@ github.com/snyk/cli-extension-ai-bom v0.0.0-20260721084000-da8dc26c77f2 h1:fYTWY
github.com/snyk/cli-extension-ai-bom v0.0.0-20260721084000-da8dc26c77f2/go.mod h1:axE+HO8U9CIcTjQ7k7BOLgdyZfNGqMn5QvZ0aIkUY4U=
github.com/snyk/cli-extension-cos v0.0.0-20260730085209-d326e44b9140 h1:7yYsL4egJlFruDMgsng/nXTe5MFx8Ciys0+ADH61yOw=
github.com/snyk/cli-extension-cos v0.0.0-20260730085209-d326e44b9140/go.mod h1:YpcOdcMBJOzwtla/OOoBOArx27Bc2v42Vcwd/FeGl9M=
github.com/snyk/cli-extension-dep-graph/v2 v2.7.2 h1:+D/r8zDdREbrZs1EZ4DmVzEf7oMHA2rRozhuaVFyg8U=
github.com/snyk/cli-extension-dep-graph/v2 v2.7.2/go.mod h1:I0GXbV6Rk8T0AEC9EugE4AgYE5SbDn0m0bGgAjZqy5U=
github.com/snyk/cli-extension-dep-graph/v2 v2.8.1 h1:ZlLN8KbMZiRN7QsiLzovFLsoIEVytC77+OESr+6wDhI=
github.com/snyk/cli-extension-dep-graph/v2 v2.8.1/go.mod h1:I0GXbV6Rk8T0AEC9EugE4AgYE5SbDn0m0bGgAjZqy5U=
github.com/snyk/cli-extension-iac v0.0.0-20260515092252-505c498f1077 h1:lteivlSoQL0zYyFcGQjEPZcQgDkzM5PcgIHlIgzRuhg=
github.com/snyk/cli-extension-iac v0.0.0-20260515092252-505c498f1077/go.mod h1:wRpQrWCjzWTPA5WK1xaHjWWI5zfY0qKe12PfKb+lcMk=
github.com/snyk/cli-extension-iac-rules v0.0.0-20260515141409-fb475901bb8e h1:HE22F5/ivTJ4TlTUnjasZqfkDKVyfmYjf36RaIZqrs4=
github.com/snyk/cli-extension-iac-rules v0.0.0-20260515141409-fb475901bb8e/go.mod h1:YN+M0+nNZ5VoQN2SxSvZSoTxs/PkdLgfNfUWvsKVL7o=
github.com/snyk/cli-extension-os-flows v0.0.0-20260722114313-168a09671091 h1:MDR3Tj4tFVNPonOtL+AzX0osWdOkNq0lEpQQehvjGak=
github.com/snyk/cli-extension-os-flows v0.0.0-20260722114313-168a09671091/go.mod h1:qNOr9aDWYUa3Tl74k+04hOCEgKcgpBLVcvs26L4ooN0=
github.com/snyk/cli-extension-sbom v0.0.0-20260722102401-3c3af28e7b93 h1:iCHSAW2OkvObczF5zNmEwnGeavQri4/rO1w1efaAfT4=
github.com/snyk/cli-extension-sbom v0.0.0-20260722102401-3c3af28e7b93/go.mod h1:YUDazoukFqA0OpYuACIoqVEsfPCAFXo9XotUk9RjmUY=
github.com/snyk/cli-extension-sbom v0.0.0-20260728161808-90fff659c450 h1:OZamCjj08Ss87/ELqWj2vI0uB14aotWtneLlPIHxq8o=
github.com/snyk/cli-extension-sbom v0.0.0-20260728161808-90fff659c450/go.mod h1:YUDazoukFqA0OpYuACIoqVEsfPCAFXo9XotUk9RjmUY=
github.com/snyk/cli-extension-secrets v0.0.0-20260619070019-764c5c87eda3 h1:wBYQm4YP65FTZ4rZ0iunhsIUYBindUEnfRWRi+Rugag=
github.com/snyk/cli-extension-secrets v0.0.0-20260619070019-764c5c87eda3/go.mod h1:D/Bk0EH8np/d6c1tG7wazpHI6iU9m8KzxytFcIQkEvQ=
github.com/snyk/code-client-go v1.27.5 h1:fog+j64VKoj5TH/sGehJ5AXe52q7LpOJtKEhwQrcXx4=
Expand Down
4 changes: 2 additions & 2 deletions cliv2/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,11 @@ require (
github.com/rs/zerolog v1.34.0
github.com/snyk/cli-extension-agent-scan v0.0.0-20260715092951-4f8fa1b9886c
github.com/snyk/cli-extension-ai-bom v0.0.0-20260721084000-da8dc26c77f2
github.com/snyk/cli-extension-dep-graph/v2 v2.7.2
github.com/snyk/cli-extension-dep-graph/v2 v2.8.1
github.com/snyk/cli-extension-iac v0.0.0-20260515092252-505c498f1077
github.com/snyk/cli-extension-iac-rules v0.0.0-20260515141409-fb475901bb8e
github.com/snyk/cli-extension-os-flows v0.0.0-20260722114313-168a09671091
github.com/snyk/cli-extension-sbom v0.0.0-20260722102401-3c3af28e7b93
github.com/snyk/cli-extension-sbom v0.0.0-20260728161808-90fff659c450
github.com/snyk/cli-extension-secrets v0.0.0-20260619070019-764c5c87eda3
github.com/snyk/code-client-go v1.27.0
github.com/snyk/container-cli v0.0.0-20260213211631-cd2b2cf8f3ea
Expand Down
8 changes: 4 additions & 4 deletions cliv2/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -527,16 +527,16 @@ github.com/snyk/cli-extension-agent-scan v0.0.0-20260715092951-4f8fa1b9886c h1:o
github.com/snyk/cli-extension-agent-scan v0.0.0-20260715092951-4f8fa1b9886c/go.mod h1:g1qxNvAl2Qb0V4UJivop+hCqehHVqzB0taEjwTm6VlU=
github.com/snyk/cli-extension-ai-bom v0.0.0-20260721084000-da8dc26c77f2 h1:fYTWYiCqw+NqeETMP/0TdVKjCHrHRng8M6+nxvrmluo=
github.com/snyk/cli-extension-ai-bom v0.0.0-20260721084000-da8dc26c77f2/go.mod h1:axE+HO8U9CIcTjQ7k7BOLgdyZfNGqMn5QvZ0aIkUY4U=
github.com/snyk/cli-extension-dep-graph/v2 v2.7.2 h1:+D/r8zDdREbrZs1EZ4DmVzEf7oMHA2rRozhuaVFyg8U=
github.com/snyk/cli-extension-dep-graph/v2 v2.7.2/go.mod h1:I0GXbV6Rk8T0AEC9EugE4AgYE5SbDn0m0bGgAjZqy5U=
github.com/snyk/cli-extension-dep-graph/v2 v2.8.1 h1:ZlLN8KbMZiRN7QsiLzovFLsoIEVytC77+OESr+6wDhI=
github.com/snyk/cli-extension-dep-graph/v2 v2.8.1/go.mod h1:I0GXbV6Rk8T0AEC9EugE4AgYE5SbDn0m0bGgAjZqy5U=
github.com/snyk/cli-extension-iac v0.0.0-20260515092252-505c498f1077 h1:lteivlSoQL0zYyFcGQjEPZcQgDkzM5PcgIHlIgzRuhg=
github.com/snyk/cli-extension-iac v0.0.0-20260515092252-505c498f1077/go.mod h1:wRpQrWCjzWTPA5WK1xaHjWWI5zfY0qKe12PfKb+lcMk=
github.com/snyk/cli-extension-iac-rules v0.0.0-20260515141409-fb475901bb8e h1:HE22F5/ivTJ4TlTUnjasZqfkDKVyfmYjf36RaIZqrs4=
github.com/snyk/cli-extension-iac-rules v0.0.0-20260515141409-fb475901bb8e/go.mod h1:YN+M0+nNZ5VoQN2SxSvZSoTxs/PkdLgfNfUWvsKVL7o=
github.com/snyk/cli-extension-os-flows v0.0.0-20260722114313-168a09671091 h1:MDR3Tj4tFVNPonOtL+AzX0osWdOkNq0lEpQQehvjGak=
github.com/snyk/cli-extension-os-flows v0.0.0-20260722114313-168a09671091/go.mod h1:qNOr9aDWYUa3Tl74k+04hOCEgKcgpBLVcvs26L4ooN0=
github.com/snyk/cli-extension-sbom v0.0.0-20260722102401-3c3af28e7b93 h1:iCHSAW2OkvObczF5zNmEwnGeavQri4/rO1w1efaAfT4=
github.com/snyk/cli-extension-sbom v0.0.0-20260722102401-3c3af28e7b93/go.mod h1:YUDazoukFqA0OpYuACIoqVEsfPCAFXo9XotUk9RjmUY=
github.com/snyk/cli-extension-sbom v0.0.0-20260728161808-90fff659c450 h1:OZamCjj08Ss87/ELqWj2vI0uB14aotWtneLlPIHxq8o=
github.com/snyk/cli-extension-sbom v0.0.0-20260728161808-90fff659c450/go.mod h1:YUDazoukFqA0OpYuACIoqVEsfPCAFXo9XotUk9RjmUY=
github.com/snyk/cli-extension-secrets v0.0.0-20260619070019-764c5c87eda3 h1:wBYQm4YP65FTZ4rZ0iunhsIUYBindUEnfRWRi+Rugag=
github.com/snyk/cli-extension-secrets v0.0.0-20260619070019-764c5c87eda3/go.mod h1:D/Bk0EH8np/d6c1tG7wazpHI6iU9m8KzxytFcIQkEvQ=
github.com/snyk/code-client-go v1.27.0 h1:FOX4JzgHssm5fei4ALyrBAIL9eJGnG52yTkqWcM1Qew=
Expand Down
10 changes: 5 additions & 5 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@
"snyk-cpp-plugin": "^2.24.3",
"snyk-docker-plugin": "^9.16.0",
"snyk-go-plugin": "2.2.1",
"snyk-gradle-plugin": "7.0.0",
"snyk-gradle-plugin": "7.1.0",
"snyk-module": "3.1.0",
"snyk-mvn-plugin": "4.9.2",
"snyk-nodejs-lockfile-parser": "2.10.0",
Expand Down
8 changes: 8 additions & 0 deletions src/lib/plugins/get-single-plugin-result.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,14 @@ export async function getSinglePluginResult(
...(options['include-component-metadata'] !== undefined && {
includeComponentMetadata: options['include-component-metadata'],
}),
// Forwarded alongside include-component-metadata (see
// cli-extension-dep-graph's legacy resolution path). The Gradle plugin
// reads it to force --refresh-dependencies so distribution:url can be
// resolved; ignored by other plugins. Only added when set to keep the
// default plugin-options shape unchanged.
...(options['gradle-refresh-dependencies'] !== undefined && {
gradleRefreshDependencies: options['gradle-refresh-dependencies'],
}),
},
snykHttpClient,
);
Expand Down
5 changes: 5 additions & 0 deletions src/lib/types.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,11 @@ export interface Options {
// get-single-plugin-result.ts). Intentionally not part of
// SupportedUserReachableFacingCliArgs so it stays off the documented surface.
'include-component-metadata'?: boolean;
// Internal/undocumented flag forwarded by cli-extension-dep-graph alongside
// include-component-metadata; makes the Gradle plugin force
// --refresh-dependencies so distribution:url provenance can be resolved. Kept
// off SupportedUserReachableFacingCliArgs for the same reason as above.
'gradle-refresh-dependencies'?: boolean;
includeProvenance?: boolean;
fingerprintAlgorithm?: string;
'project-name'?: string;
Expand Down
64 changes: 64 additions & 0 deletions test/jest/unit/lib/plugins/get-single-plugin-result.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,6 +248,70 @@ describe('getSinglePluginResult', () => {
});
});

describe('gradle-refresh-dependencies', () => {
it('should forward gradleRefreshDependencies to the plugin when set', async () => {
const options: Options & TestOptions = {
path: '/test',
packageManager: 'gradle',
showVulnPaths: 'some',
'gradle-refresh-dependencies': true,
};

await getSinglePluginResult('/test', options);

expect(mockModuleInfo.inspect).toHaveBeenCalledWith(
'/test',
undefined,
expect.objectContaining({
gradleRefreshDependencies: true,
}),
snykHttpClient,
);
});

it('should forward gradleRefreshDependencies=false when explicitly disabled', async () => {
const options: Options & TestOptions = {
path: '/test',
packageManager: 'gradle',
showVulnPaths: 'some',
'gradle-refresh-dependencies': false,
};

await getSinglePluginResult('/test', options);

expect(mockModuleInfo.inspect).toHaveBeenCalledWith(
'/test',
undefined,
expect.objectContaining({
gradleRefreshDependencies: false,
}),
snykHttpClient,
);
});

// The flag is gateway-driven and absent for almost every scan, so an unset
// flag must leave the plugin-options shape untouched rather than passing
// gradleRefreshDependencies: undefined.
it('should omit gradleRefreshDependencies entirely when unset', async () => {
const options: Options & TestOptions = {
path: '/test',
packageManager: 'gradle',
showVulnPaths: 'some',
};

await getSinglePluginResult('/test', options);

expect(mockModuleInfo.inspect).toHaveBeenCalledWith(
'/test',
undefined,
expect.not.objectContaining({
gradleRefreshDependencies: expect.anything(),
}),
snykHttpClient,
);
});
});

describe('MonitorOptions', () => {
it('should work with MonitorOptions for gomodules', async () => {
const options: Options & MonitorOptions = {
Expand Down