feat: custom-sanitizer discovery via --discover-sanitisers on code test - #159
Draft
NasAmin wants to merge 2 commits into
Draft
feat: custom-sanitizer discovery via --discover-sanitisers on code test#159NasAmin wants to merge 2 commits into
NasAmin wants to merge 2 commits into
Conversation
The native implementation was explicitly disabled for SCLE orgs. Three things were missing for it to work; this commit addresses all of them. 1. URL: codeClientConfig.SnykCodeApi now returns localCodeEngine.url from the cached SAST settings when SCLE is enabled, instead of the naive api->deeproxy string replacement that ignored it. 2. Auth: register the local engine URL in AUTHENTICATION_ADDITIONAL_URLS so the networking stack attaches credentials (including OAuth2 tokens) to the custom SCLE host, which otherwise matches neither the API host nor the "deeproxy" subdomain and would be called unauthenticated. 3. API surface: SCLE implements the old deeproxy API, not the new test service. Route SCLE scans through the legacy scanner (UploadAndAnalyzeLegacy / RunLegacyTest) instead of UploadAndAnalyze, which the local engine does not implement. --report is not supported for SCLE (reporting goes through the test service); it now errors early instead of silently using the test-service path. Also drop the '&& !scleEnabled' guard so SCLE flows use the native path when the native/consistent-ignores feature flags are on, and centralize the SAST settings / SLCE config keys in the code_workflow package. This is the functional-parity prerequisite for removing the TypeScript @snyk/code-client dependency from the CLI, and closes the OAuth2-on-SCLE failure tracked in CLI-589. Refs: COIN-2539, CLI-589
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
|
NasAmin
changed the title
NasAmin
changed the title
Wire the flag through the native workflow and test-service poll path; surface Appendix-A candidates as human or JSON output. Reject SCLE and --report combinations (test-service-only features). Share poll/create helpers with the standard scan path.
NasAmin
force-pushed
the
feat/discover-candidates-model
branch
from
June 22, 2026 11:53
c9780b8 to
7b0174d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
snyk code test --discover-sanitisers(ML-1952): upload a bundle, run a discovery test via the existing test-service async pipeline, and surface Appendix-A custom-sanitizer candidates (not vulnerability findings).Wiring follows the same pattern as
--report: flag → helper →UploadAndDiscover→analysis.RunDiscoverTest.What changed
internal/analysis/sanitizers/) — PRD Appendix A document; JSON, human, minimal SARIF output.--discover-sanitisersflag — registered inpkg/code/code.go; native workflow branches to discovery path.internal/analysis/analysis.go) —RunDiscoverTestreuses create → poll → components → fetch (mirrors SARIF analysis).scan.go) —UploadAndDiscover(parallel toUploadAndAnalyzeWithOptions).custom_sanitizer_discoveryresult type,sanitizer_discoveryscanner,custom-sanitizer-discoverycomponent document type;WithDiscoverScanConfig()helper.sanitizers.Orchestratorseam and local gRPC hack; discovery transport lives inanalysisonly.Dependencies
E2E requires test-service + orchestration + code-gateway to emit the discovery component. Until then, create-test may return 4xx or poll may fail with component-not-found — expected until backend PRs land.
snyk/cli — no code change; picks up the flag via
code-client-goversion bump.Test plan
go test ./internal/analysis/... ./internal/commands/code_workflow/... ./pkg/code/...snyk code test --discover-sanitisersagainst org with backend wired--discover-sanitisers+--reportrejected--json/--sarifoutput shapes