Merge branch 'dev' into patch-3

Author: shay-dahan

go.mod

@@ -3,6 +3,7 @@ module github.com/jfrog/frogbot/v2
 go 1.24.2
 
 require (
+	github.com/CycloneDX/cyclonedx-go v0.9.2
 	github.com/go-git/go-git/v5 v5.16.0
 	github.com/golang/mock v1.6.0
 	github.com/google/go-github/v45 v45.2.0
@@ -25,7 +26,6 @@ require (
 require (
 	dario.cat/mergo v1.0.1 // indirect
 	github.com/BurntSushi/toml v1.4.0 // indirect
-	github.com/CycloneDX/cyclonedx-go v0.9.2 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.1.6 // indirect
 	github.com/andybalholm/brotli v1.1.1 // indirect
@@ -125,7 +125,7 @@ require (
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 )
 
-// replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security dev
+replace github.com/jfrog/jfrog-cli-security => github.com/jfrog/jfrog-cli-security v1.20.3-0.20250803110644-e1c158a10a1e
 
 // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev
 

go.sum

@@ -139,8 +139,8 @@ github.com/jfrog/jfrog-cli-artifactory v0.5.1 h1:C1H8x6ldg7VmKIb4F8OZKm0PJbBrlA7
 github.com/jfrog/jfrog-cli-artifactory v0.5.1/go.mod h1:RXz0AZ5qVEOhanXRGmC4+atqr29ZtIeV5kUCbNGtVj4=
 github.com/jfrog/jfrog-cli-core/v2 v2.59.3 h1:AlFC9l3Cwvx2FzuAP0txxEjZPDjv5bpO7YPTOjHp7HA=
 github.com/jfrog/jfrog-cli-core/v2 v2.59.3/go.mod h1:Itfva9wqPMkUVBuNpKw0Oe4qoPlt0PdXfmWqf7fBebU=
-github.com/jfrog/jfrog-cli-security v1.20.2 h1:GGpSdEnxcmUbK5Iinm8LN0EUG9KAm1+K958yYtcqxeQ=
-github.com/jfrog/jfrog-cli-security v1.20.2/go.mod h1:3sDIo2prTKwB2IeiWk7Hqxxags8obqRi5uNnh9i9XIc=
+github.com/jfrog/jfrog-cli-security v1.20.3-0.20250803110644-e1c158a10a1e h1:37Wxxr9qbt2dSuvYCcMN3YNsTWVVhfnSBf3SI+l5vas=
+github.com/jfrog/jfrog-cli-security v1.20.3-0.20250803110644-e1c158a10a1e/go.mod h1:3sDIo2prTKwB2IeiWk7Hqxxags8obqRi5uNnh9i9XIc=
 github.com/jfrog/jfrog-client-go v1.54.3 h1:tIhhDhM7rDMT1lzgeQy4nr6H2ihlqnumhiFybIWlLz0=
 github.com/jfrog/jfrog-client-go v1.54.3/go.mod h1:1v0eih4thdPA4clBo9TuvAMT25sGDr1IQJ81DXQ/lBY=
 github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=

scanrepository/scanrepository.go

@@ -191,6 +191,12 @@ func (cfp *ScanRepositoryCmd) scanAndFixProject(repository *utils.Repository) (i
 			if err = utils.UploadSarifResultsToGithubSecurityTab(scanResults, repository, cfp.scanDetails.BaseBranch(), cfp.scanDetails.Client()); err != nil {
 				log.Warn(err)
 			}
+
+			if *repository.UploadSbomToVcs && scanResults.EntitledForJas {
+				if err = utils.UploadSbomSnapshotToGithubDependencyGraph(repository.RepoOwner, repository.RepoName, scanResults, cfp.scanDetails.Client(), cfp.scanDetails.BaseBranch()); err != nil {
+					log.Warn(err)
+				}
+			}
 		}
 		if repository.DetectionOnly {
 			continue

utils/consts.go

@@ -42,6 +42,7 @@ const (
 	GitUsernameEnv                   = "JF_GIT_USERNAME"
 	GitUseLocalRepositoryEnv         = "JF_USE_LOCAL_REPOSITORY"
 	UseMostCommonAncestorAsTargetEnv = "JF_USE_MOST_COMMON_ANCESTOR_AS_TARGET"
+	GitDependencyGraphSubmissionEnv  = "JF_UPLOAD_SBOM_TO_VCS"
 
 	// Git naming template environment variables
 	BranchNameTemplateEnv       = "JF_BRANCH_NAME_TEMPLATE"

utils/params.go

@@ -51,7 +51,7 @@ type FrogbotDetails struct {
 
 type RepoAggregator []Repository
 
-// NewRepoAggregator returns an initialized RepoAggregator with an empty repository
+// Returns an initialized RepoAggregator with an empty repository
 func newRepoAggregator() RepoAggregator {
 	return RepoAggregator{{Params: Params{Scan: Scan{Projects: []Project{{}}}}}}
 }
@@ -336,6 +336,7 @@ type Git struct {
 	PullRequestDetails            vcsclient.PullRequestInfo
 	RepositoryCloneUrl            string
 	UseLocalRepository            bool
+	UploadSbomToVcs               *bool `yaml:"uploadSbomToVcs,omitempty"`
 }
 
 func (g *Git) GetRepositoryHttpsCloneUrl(gitClient vcsclient.VcsClient) (string, error) {
@@ -377,6 +378,17 @@ func (g *Git) setDefaultsIfNeeded(gitParamsFromEnv *Git, commandName string) (er
 			return
 		}
 	}
+
+	// We don't need to examine gitParamsFromEnv since GitDependencyGraphSubmissionEnv value is not fetched upon gitParamsFromEnv creation
+	if g.UploadSbomToVcs == nil || !*g.UploadSbomToVcs {
+		if g.UploadSbomToVcs == nil {
+			envValue, err := getBoolEnv(GitDependencyGraphSubmissionEnv, true)
+			if err != nil {
+				return err
+			}
+			g.UploadSbomToVcs = &envValue
+		}
+	}
 	return
 }
 
@@ -394,15 +406,13 @@ func (g *Git) extractScanPullRequestEnvParams(gitParamsFromEnv *Git) (err error)
 		}
 	}
 	if g.UseMostCommonAncestorAsTarget == nil || !*g.UseMostCommonAncestorAsTarget {
-		defaultValue := true
-		if g.UseMostCommonAncestorAsTarget != nil {
-			defaultValue = *g.UseMostCommonAncestorAsTarget
-		}
-		envValue, err := getBoolEnv(UseMostCommonAncestorAsTargetEnv, defaultValue)
-		if err != nil {
-			return err
+		if g.UseMostCommonAncestorAsTarget == nil {
+			envValue, err := getBoolEnv(UseMostCommonAncestorAsTargetEnv, true)
+			if err != nil {
+				return err
+			}
+			g.UseMostCommonAncestorAsTarget = &envValue
 		}
-		g.UseMostCommonAncestorAsTarget = &envValue
 	}
 	g.AvoidExtraMessages, err = getBoolEnv(AvoidExtraMessages, false)
 	return
@@ -508,7 +518,7 @@ func GetFrogbotDetails(commandName string) (frogbotDetails *FrogbotDetails, err
 	return
 }
 
-// getConfigAggregator returns a RepoAggregator based on frogbot-config.yml and environment variables.
+// Returns a RepoAggregator based on frogbot-config.yml and environment variables.
 func getConfigAggregator(xrayVersion, xscVersion string, gitClient vcsclient.VcsClient, gitParamsFromEnv *Git, jfrogServer *coreconfig.ServerDetails, commandName string) (RepoAggregator, error) {
 	configFileContent, err := getConfigFileContent(gitClient, gitParamsFromEnv, commandName)
 	if err != nil {
@@ -520,7 +530,7 @@ func getConfigAggregator(xrayVersion, xscVersion string, gitClient vcsclient.Vcs
 	return BuildRepoAggregator(xrayVersion, xscVersion, gitClient, configFileContent, gitParamsFromEnv, jfrogServer, commandName)
 }
 
-// getConfigFileContent retrieves the content of the frogbot-config.yml file
+// Retrieves the content of the frogbot-config.yml file
 func getConfigFileContent(gitClient vcsclient.VcsClient, gitParamsFromEnv *Git, commandName string) ([]byte, error) {
 	var errMissingConfig *ErrMissingConfig
 
@@ -543,7 +553,7 @@ func getConfigFileContent(gitClient vcsclient.VcsClient, gitParamsFromEnv *Git,
 	return configFileContent, err
 }
 
-// BuildRepoAggregator receives the content of a frogbot-config.yml file, along with the Git (built from environment variables) and ServerDetails parameters.
+// Receives the content of a frogbot-config.yml file, along with the Git (built from environment variables) and ServerDetails parameters.
 // Returns a RepoAggregator instance with all the defaults and necessary fields.
 func BuildRepoAggregator(xrayVersion, xscVersion string, gitClient vcsclient.VcsClient, configFileContent []byte, gitParamsFromEnv *Git, server *coreconfig.ServerDetails, commandName string) (resultAggregator RepoAggregator, err error) {
 	var cleanAggregator RepoAggregator
@@ -566,7 +576,7 @@ func BuildRepoAggregator(xrayVersion, xscVersion string, gitClient vcsclient.Vcs
 	return
 }
 
-// unmarshalFrogbotConfigYaml uses the yaml.Unmarshaler interface to parse the yamlContent.
+// Uses the yaml.Unmarshaler interface to parse the yamlContent.
 // If there is no config file, the function returns a RepoAggregator with an empty repository.
 func unmarshalFrogbotConfigYaml(yamlContent []byte) (result RepoAggregator, err error) {
 	if len(yamlContent) == 0 {
@@ -739,7 +749,7 @@ func SanitizeEnv() error {
 	return nil
 }
 
-// ReadConfigFromFileSystem looks for .frogbot/frogbot-config.yml from the given path and return its content. The path is relative and starts from the root of the project.
+// Looks for .frogbot/frogbot-config.yml from the given path and return its content. The path is relative and starts from the root of the project.
 // If the config file is not found in the relative path, it will search in parent dirs.
 func ReadConfigFromFileSystem(configRelativePath string) (configFileContent []byte, err error) {
 	log.Debug("Reading config from file system. Looking for", osFrogbotConfigPath)

utils/testsutils.go

@@ -3,7 +3,7 @@ package utils
 import (
 	"encoding/json"
 	"fmt"
-	"github.com/jfrog/jfrog-client-go/xsc/services"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -12,6 +12,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/jfrog/jfrog-client-go/xsc/services"
+
 	"github.com/go-git/go-git/v5"
 	goGitConfig "github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing/object"
@@ -230,3 +232,98 @@ func CreateXscMockServerForConfigProfile(t *testing.T, xrayVersion string) (mock
 	}
 	return
 }
+
+// CreateMockServerForDependencySubmission creates a mock GitHub server for testing dependency submission
+func CreateMockServerForDependencySubmission(t *testing.T, owner, repo string) *httptest.Server {
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify correct URL construction
+		expectedPath := fmt.Sprintf("/repos/%s/%s/dependency-graph/snapshots", owner, repo)
+		if r.URL.Path != expectedPath {
+			t.Errorf("Expected path is '%s', got '%s'", expectedPath, r.URL.Path)
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		// Verify correct method
+		if r.Method != http.MethodPost {
+			t.Errorf("Expected POST method, got %s", r.Method)
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
+		}
+
+		// Read request body and parse it to ensure all mandatory fields exist
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Errorf("Failed to read request body: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		var snapshot map[string]interface{}
+		if err := json.Unmarshal(body, &snapshot); err != nil {
+			t.Errorf("Failed to parse request body as JSON: %v", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+
+		// Verify required fields are present
+		requiredFields := []string{"version", "sha", "ref", "scanned", "job", "detector"}
+		for _, field := range requiredFields {
+			if _, exists := snapshot[field]; !exists {
+				t.Errorf("Missing required field: %s", field)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+		}
+
+		// Verify required job fields
+		if job, ok := snapshot["job"].(map[string]interface{}); ok {
+			if _, exists := job["id"]; !exists {
+				t.Errorf("Missing job.id field")
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			if _, exists := job["correlator"]; !exists {
+				t.Errorf("Missing job.correlator field")
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+		}
+
+		// Verify required detector fields
+		if detector, ok := snapshot["detector"].(map[string]interface{}); ok {
+			if _, exists := detector["name"]; !exists {
+				t.Errorf("Missing detector.name field")
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			if _, exists := detector["version"]; !exists {
+				t.Errorf("Missing detector.version field")
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			if _, exists := detector["url"]; !exists {
+				t.Errorf("Missing detector.url field")
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+		}
+
+		// Return success response
+		w.WriteHeader(http.StatusCreated)
+	}))
+}
+
+// CreateMockServerForDependencySubmissionError creates a mock GitHub server that returns an error
+func CreateMockServerForDependencySubmissionError(t *testing.T, owner, repo string) *httptest.Server {
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify correct URL construction
+		expectedPath := fmt.Sprintf("/repos/%s/%s/dependency-graph/snapshots", owner, repo)
+		if r.URL.Path != expectedPath {
+			t.Errorf("Expected path is '%s', got '%s'", expectedPath, r.URL.Path)
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+
+		// Return error response
+		w.WriteHeader(http.StatusBadRequest)
+	}))
+}

utils/utils.go

@@ -21,6 +21,7 @@ import (
 	"github.com/jfrog/jfrog-cli-core/v2/utils/usage"
 	"github.com/jfrog/jfrog-cli-security/utils"
 	"github.com/jfrog/jfrog-cli-security/utils/formats"
+	"github.com/jfrog/jfrog-cli-security/utils/formats/snapshotconvertor"
 	"github.com/jfrog/jfrog-cli-security/utils/results"
 	"github.com/jfrog/jfrog-cli-security/utils/results/conversion"
 	"github.com/jfrog/jfrog-cli-security/utils/results/output"
@@ -32,12 +33,14 @@ import (
 )
 
 const (
-	ScanPullRequest          = "scan-pull-request"
-	ScanAllPullRequests      = "scan-all-pull-requests"
-	ScanRepository           = "scan-repository"
-	ScanMultipleRepositories = "scan-multiple-repositories"
-	RootDir                  = "."
-	branchNameRegex          = `[~^:?\\\[\]@{}*]`
+	ScanPullRequest                     = "scan-pull-request"
+	ScanAllPullRequests                 = "scan-all-pull-requests"
+	ScanRepository                      = "scan-repository"
+	ScanMultipleRepositories            = "scan-multiple-repositories"
+	RootDir                             = "."
+	branchNameRegex                     = `[~^:?\\\[\]@{}*]`
+	dependencySubmissionFrogbotDetector = "JFrog Frogbot"
+	frogbotUrl                          = "https://github.com/jfrog/frogbot"
 
 	// Branch validation error messages
 	branchInvalidChars             = "branch name cannot contain the following chars  ~, ^, :, ?, *, [, ], @, {, }"
@@ -236,6 +239,43 @@ func UploadSarifResultsToGithubSecurityTab(scanResults *results.SecurityCommandR
 	return nil
 }
 
+func UploadSbomSnapshotToGithubDependencyGraph(owner, repo string, scanResults *results.SecurityCommandResults, client vcsclient.VcsClient, branch string) error {
+	if scanResults == nil {
+		return fmt.Errorf("got an empty scan results")
+	}
+
+	cyclonedxWithSbom, err := conversion.NewCommandResultsConvertor(conversion.ResultConvertParams{HasViolationContext: scanResults.HasViolationContext(), IncludeVulnerabilities: scanResults.IncludesVulnerabilities(), IncludeSbom: true}).ConvertToCycloneDx(scanResults)
+	if err != nil {
+		return fmt.Errorf("failed to convert results to CycloneDX format: %w", err)
+	}
+	var jobId, jobCorrelator, commitSha string
+	if jobId = getTrimmedEnv(utils.CurrentGithubWorkflowJobEnvVar); jobId == "" {
+		return fmt.Errorf("%s env var is empty and required for Github Dependency submission", utils.CurrentGithubWorkflowJobEnvVar)
+	}
+	workflowName := getTrimmedEnv(utils.CurrentGithubWorkflowNameEnvVar)
+	if workflowName == "" {
+		return fmt.Errorf("%s env var is empty and required for Github Dependency submission", utils.CurrentGithubWorkflowNameEnvVar)
+	}
+	jobCorrelator = fmt.Sprintf("%s_%s", workflowName, jobId)
+	if commitSha = getTrimmedEnv(utils.CurrentGithubShaEnvVar); commitSha == "" {
+		return fmt.Errorf("%s env var is empty and required for Github Dependency submission", utils.CurrentGithubShaEnvVar)
+	}
+
+	snapshot, err := snapshotconvertor.CreateGithubSnapshotFromSbom(cyclonedxWithSbom, 0, scanResults.StartTime, jobId, jobCorrelator, commitSha, branch, dependencySubmissionFrogbotDetector, FrogbotVersion, frogbotUrl)
+	if err != nil {
+		return fmt.Errorf("failed to convert CycloneDX to SBOM snapshot: %w", err)
+	}
+
+	if err = client.UploadSnapshotToDependencyGraph(context.Background(), owner, repo, snapshot); err != nil {
+		snapshotJson, e := utils.GetAsJsonString(snapshot, false, true)
+		if e != nil {
+			return fmt.Errorf("failed to upload SBOM snapshot to GitHub: %w", err)
+		}
+		return fmt.Errorf("failed to upload SBOM snapshot to GitHub: %w\nSent Snapshot:\n%s", err, snapshotJson)
+	}
+	return nil
+}
+
 func GenerateFrogbotSarifReport(extendedResults *results.SecurityCommandResults, allowedLicenses []string) (string, error) {
 	convertor := conversion.NewCommandResultsConvertor(conversion.ResultConvertParams{
 		IncludeVulnerabilities: extendedResults.IncludesVulnerabilities(),