feat(integration-jfrog): add run --dry-run preview and cursor reset - #49
Merged
Conversation
SafeDep Report Summary
No dependency changes detected. Nothing to scan. This report is generated by SafeDep GitHub App |
KunalSin9h
force-pushed
the
feat/jfrog-dry-run-reset-cursor
branch
2 times, most recently
from
August 25, 2026 10:41
bcc71f8 to
faee768
Compare
Add two operator-facing commands on top of the ThreatIntel Feed migration. run --dry-run previews the feed without sending to JFrog. The JFrog client is now a port (xrayClient): jfrogClient is the real adapter, printClient is the dry-run adapter that reuses buildEvent to show the exact event a real push would build, then prints instead of sending. It needs no JFrog credentials. Everything else runs as-is, the same feed and the same persistent per-profile cursor, so a dry-run tests the whole pipeline and differs only in the destination. Because a dry-run advances the same saved cursor, run cursor reset before the first real run so it re-processes what the preview consumed. This is documented on both commands. cursor reset clears the saved feed cursor for the active profile so the next run starts fresh. Shaped as a cursor noun with a reset verb to satisfy the cobra convention lints. Adds reset to the verb allow-list: reset returns a resource to its initial state without destroying it, distinct from delete. Drop SAFEDEP_INTEGRATION_JFROG_BACKFILL: backfill is a one-time first-run window, not a secret, so the flag alone is enough. --backfill resolves identically for real and dry runs (default 0, fresh from now). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
KunalSin9h
force-pushed
the
feat/jfrog-dry-run-reset-cursor
branch
from
August 25, 2026 10:56
faee768 to
42f537c
Compare
KunalSin9h
commented
Aug 25, 2026
Review feedback: printClient embedded jfrogClient only to reuse buildEvent and issueID, which promoted the whole method set and carried an unused http.Client. Make buildEvent and issueID package functions instead, drop issueID from the xrayClient port (the service calls the package function), and make printClient a standalone struct with no jfrogClient dependency. No behaviour change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
Keep the dry-run preview to the "Would push" line and the JFrog issue id. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
Review feedback: there was no way to position the cursor, only clear it, and "reset" was really a remove. Replace the single cursor reset verb with two: - cursor set <timestamp>: set the cursor to an RFC3339 time so the next run processes reports updated after it. A precise alternative to --backfill. - cursor remove: clear the cursor so the next run starts fresh. Drop the reset entry from the verb allow-list; set and remove are already allowed. Rename the store method reset to remove. Docs and README updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
The xrayClient port is the parent of both adapters, so it belongs with the real client rather than in printclient.go. Each file keeps its own compile-time assertion. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
abhisek
reviewed
Aug 25, 2026
- Drop the self-explanatory dryRun field comment in cmdConfig (its second sentence was stale after dry-run moved to the persistent cursor). - Replace a semicolon sentence-join in the cursor remove doc with two sentences per ASD-STE100. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y
abhisek
approved these changes
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small additions to the JFrog XRay integration, on top of the merged feed migration (#47).
run --dry-runPreview the feed without sending to JFrog. Prints each finding as
Would push:.The JFrog client is a port (
xrayClient).jfrogClientis the real adapter;printClientis the dry-run one, it reuses the sharedbuildEventso the preview is the exact event a real push would build, then prints. So a dry-run tests the whole pipeline as-is and differs only in the destination.--backfillworks the same as a real run (default0).cursor removebefore the first real run.cursor set/cursor removeManage the saved feed cursor for the active profile:
cursor set <timestamp>sets the cursor to an RFC3339 time so the next run processes reports updated after it. A precise alternative to--backfill.cursor removeclears the cursor so the next run starts fresh.A
cursornoun withset/removeverbs (noun/verb, no hyphens per the cobra lints). Both verbs are already in the allow-list.Also
Dropped
SAFEDEP_INTEGRATION_JFROG_BACKFILL. Backfill is a one-time first-run window, not a secret, so the flag is enough.Tests
printClientnever sends and needs no creds;cursorStore.removeclears and is a safe no-op;resolveConfigdry-run cases; command-tree conventions.go build,go test ./..., gofmt, and convention lints are green.🤖 Generated with Claude Code
https://claude.ai/code/session_01RS4e9U1L2dP4H5XXeGPe6y