XRAY-140550 - Onboarding uv for jf curation-audit

.github/actions/install-and-setup/action.yml

@@ -83,6 +83,10 @@ runs:
     - name: Setup Poetry
       run: python -m pip install poetry
       shell: ${{ runner.os == 'Windows' && 'powershell' || 'bash' }}
+    - name: Setup uv
+      uses: astral-sh/setup-uv@v9.0.0
+      with:
+        version: "0.11.32"
     - name: Setup Conan
       run: |
         python -m pip install conan

_typos.toml

@@ -2,6 +2,7 @@
 testng = "testng"
 afe = "afe"
 Bouned = "Bouned"
+certifi = "certifi"
 
 [files]
 extend-exclude = ["go.mod", "go.sum", "tests/testdata"]

cli/docs/flags.go

@@ -166,6 +166,7 @@ const (
 	LegacyPeerDeps        = "legacy-peer-deps"
 	RunNative             = "run-native"
 	MvnIncludePluginDeps  = "mvn-include-plugin-deps"
+	Script                = "script"
 
 	// Unique git flags
 	gitPrefix       = "git-"
@@ -230,7 +231,7 @@ var commandFlags = map[string][]string{
 		StaticSca, XrayLibPluginBinaryCustomPath, AnalyzerManagerCustomPath, AddSastRules,
 	},
 	CurationAudit: {
-		CurationOutput, WorkingDirs, Threads, RequirementsFile, InsecureTls, useWrapperAudit, UseIncludedBuilds, SolutionPath, DockerImageName, HuggingFaceModel, IncludeCachedPackages, MvnIncludePluginDeps, LegacyPeerDeps, RunNative,
+		CurationOutput, WorkingDirs, Threads, RequirementsFile, InsecureTls, useWrapperAudit, UseIncludedBuilds, SolutionPath, DockerImageName, HuggingFaceModel, IncludeCachedPackages, MvnIncludePluginDeps, LegacyPeerDeps, RunNative, Script,
 	},
 	GitCountContributors: {
 		InputFile, ScmType, ScmApiUrl, Token, Owner, RepoName, Months, DetailedSummary, InsecureTls, GitThreads, CacheValidity,
@@ -356,6 +357,7 @@ var flagsMap = map[string]components.Flag{
 	MvnIncludePluginDeps:          components.NewBoolFlag(MvnIncludePluginDeps, "[Maven] When set to true, Maven build-plugin transitive dependencies are resolved and included in the curation evaluation. By default only project dependencies are scanned."),
 	LegacyPeerDeps:                components.NewBoolFlag(LegacyPeerDeps, "[npm] Pass --legacy-peer-deps to npm install to bypass peer-dependency version conflicts."),
 	RunNative:                     components.NewBoolFlag(RunNative, "[npm] Use the native npm client for dependency resolution. Reads Artifactory URL and repository from the project's .npmrc registry — no 'jf npm-config' required. Respects .npmrc and Volta configuration."),
+	Script:                        components.NewStringFlag(Script, "[uv] Path to a PEP 723 inline-script .py file to audit standalone, instead of scanning the working directory for a pyproject.toml/uv.lock project."),
 	binarySca:                     components.NewBoolFlag(Sca, fmt.Sprintf("Selective scanners mode: Execute SCA (Software Composition Analysis) sub-scan. Use --%s to run both SCA and Contextual Analysis. Use --%s --%s to to run SCA. Can be combined with --%s.", Sca, Sca, WithoutCA, Secrets)),
 	binarySecrets:                 components.NewBoolFlag(Secrets, fmt.Sprintf("Selective scanners mode: Execute Secrets sub-scan. Can be combined with --%s.", Sca)),
 	binaryWithoutCA:               components.NewBoolFlag(WithoutCA, fmt.Sprintf("Selective scanners mode: Disable Contextual Analysis scanner after SCA. Relevant only with --%s flag.", Sca)),

cli/docs/scan/curation/help.go

@@ -24,12 +24,14 @@ Common patterns:
   $ jf curation-audit --requirements-file=requirements-dev.txt
   $ jf curation-audit --docker-image=my-image:tag
   $ HF_ENDPOINT=https://my.jfrog.io/artifactory/api/huggingfaceml/my-hf-repo jf curation-audit --hugging-face-model=org/model:main
+  $ jf ca --script=script.py
 
 Gotchas:
 - The user/token must be entitled for Curation; otherwise the command exits with an entitlement notice.
 - Requires the project's package manager binary on PATH (npm, mvn, etc.).
 - Run from the project root or pass --working-dirs.
 - For Maven multi-module: --use-wrapper if mvnw is used.
+- --script (uv only) audits one PEP 723 inline-script .py file directly; --script and --working-dirs cannot be used together, run separate commands for each.
 
 Related: jf audit, jf rt npm-install, jf rt mvn`
 }

cli/scancommands.go

@@ -728,6 +728,13 @@ func ShouldRunCurationAfterFailure(c *components.Context, tech techutils.Technol
 }
 
 func getCurationCommand(c *components.Context) (*curation.CurationAuditCommand, error) {
+	scriptPath := c.GetStringFlagValue(flags.Script)
+	if scriptPath != "" && c.GetStringFlagValue(flags.WorkingDirs) != "" {
+		return nil, errorutils.CheckErrorf("--script and --working-dirs cannot be used together; run separate curation-audit commands for each")
+	}
+	if scriptPath != "" && c.GetStringFlagValue(flags.DockerImageName) != "" {
+		return nil, errorutils.CheckErrorf("--script and --docker-image cannot be used together; run separate curation-audit commands for each")
+	}
 	threads, err := pluginsCommon.GetThreadsCount(c)
 	if err != nil {
 		return nil, err
@@ -768,6 +775,7 @@ func getCurationCommand(c *components.Context) (*curation.CurationAuditCommand,
 	curationAuditCommand.SetMvnIncludePluginDeps(c.GetBoolFlagValue(flags.MvnIncludePluginDeps))
 	curationAuditCommand.SetLegacyPeerDeps(c.GetBoolFlagValue(flags.LegacyPeerDeps))
 	curationAuditCommand.SetRunNative(c.GetBoolFlagValue(flags.RunNative))
+	curationAuditCommand.SetScriptPath(scriptPath)
 	return curationAuditCommand, nil
 }
 

cli/scancommands_test.go

@@ -167,6 +167,26 @@ func TestCurationAuditCommandFlags_UseWrapperAuditFlag(t *testing.T) {
 	assert.True(t, found, "useWrapperAudit flag should be present in CurationAudit command flags. If this test fails, it means the flag was removed from cli/docs/flags.go")
 }
 
+func TestGetCurationCommandRejectsScriptWithWorkingDirs(t *testing.T) {
+	ctx := &components.Context{}
+	ctx.AddStringFlag(flags.Script, "script.py")
+	ctx.AddStringFlag(flags.WorkingDirs, "dir1,dir2")
+
+	_, err := getCurationCommand(ctx)
+	assert.ErrorContains(t, err, "--script")
+	assert.ErrorContains(t, err, "--working-dirs")
+}
+
+func TestGetCurationCommandRejectsScriptWithDockerImage(t *testing.T) {
+	ctx := &components.Context{}
+	ctx.AddStringFlag(flags.Script, "script.py")
+	ctx.AddStringFlag(flags.DockerImageName, "myimage:latest")
+
+	_, err := getCurationCommand(ctx)
+	assert.ErrorContains(t, err, "--script")
+	assert.ErrorContains(t, err, "--docker-image")
+}
+
 func TestEffectiveIncludeViolations(t *testing.T) {
 	tests := []struct {
 		name            string