From c80a097c6debb9cb63580e7cd9441fb9f9c7b3cc Mon Sep 17 00:00:00 2001 From: attiasas Date: Tue, 28 Jul 2026 12:07:16 +0300 Subject: [PATCH 1/4] Fix XSC suite tests --- .github/workflows/test.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 0d4d9dceb..51a09dbb2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -218,9 +218,12 @@ jobs: steps: # Prepare the environment - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + allow-unsafe-pr-checkout: true + - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' uses: jfrog/boost@v0 From d191ed5a2032479e585ba142aa35c31f5d2968d5 Mon Sep 17 00:00:00 2001 From: attiasas Date: Tue, 28 Jul 2026 12:13:17 +0300 Subject: [PATCH 2/4] Add retries to test suites --- .github/workflows/test.yml | 70 ++++++++++++++++++++++++++++++++------ 1 file changed, 60 insertions(+), 10 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 51a09dbb2..1b7f6c731 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -93,7 +93,12 @@ jobs: # Test and generate code coverage - name: Run tests - run: go test ${{ env.GO_COMMON_TEST_ARGS }} --ci.runId=${{ runner.os }}-sec-test -covermode atomic -coverprofile=cover-unit-tests --test.unit + uses: nick-fields/retry@v4 + with: + timeout_minutes: 45 + max_attempts: 3 + retry_wait_seconds: 30 + command: go test ${{ env.GO_COMMON_TEST_ARGS }} --ci.runId=${{ runner.os }}-sec-test -covermode atomic -coverprofile=cover-unit-tests --test.unit Audit_Command_Integration_Tests: name: "[${{ matrix.os }}] ${{ matrix.suite.name }} Audit Command Integration Tests" @@ -147,7 +152,12 @@ jobs: # Test - name: Run tests - run: go test ${{ env.GO_COMMON_TEST_ARGS }} ${{ matrix.suite.testFlags }} --ci.runId=${{ runner.os }}-sec-test + uses: nick-fields/retry@v4 + with: + timeout_minutes: 45 + max_attempts: 3 + retry_wait_seconds: 30 + command: go test ${{ env.GO_COMMON_TEST_ARGS }} ${{ matrix.suite.testFlags }} --ci.runId=${{ runner.os }}-sec-test Artifactory_Integration_Tests: name: "[${{ matrix.os }}] Artifactory Integration Tests" @@ -177,7 +187,12 @@ jobs: # Test - name: Run tests - run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.artifactory --ci.runId=${{ runner.os }}-sec-test + uses: nick-fields/retry@v4 + with: + timeout_minutes: 45 + max_attempts: 3 + retry_wait_seconds: 30 + command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.artifactory --ci.runId=${{ runner.os }}-sec-test Xray_Commands_Integration_Tests: name: "[${{ matrix.os }}] Xray Commands Integration Tests" @@ -205,7 +220,12 @@ jobs: # Test - name: Run tests - run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.xray --ci.runId=${{ runner.os }}-sec-test + uses: nick-fields/retry@v4 + with: + timeout_minutes: 45 + max_attempts: 3 + retry_wait_seconds: 30 + command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.xray --ci.runId=${{ runner.os }}-sec-test Xsc_Integration_Tests: name: "[${{ matrix.os }}] XSC Integration Tests" @@ -234,7 +254,12 @@ jobs: # Test - name: Run tests - run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.xsc --ci.runId=${{ runner.os }}-sec-test + uses: nick-fields/retry@v4 + with: + timeout_minutes: 45 + max_attempts: 3 + retry_wait_seconds: 30 + command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.xsc --ci.runId=${{ runner.os }}-sec-test Binary_Scan_Command_Integration_Tests: name: "[${{ matrix.os }}] Binary Scan Command Integration Tests" @@ -264,7 +289,12 @@ jobs: # Test - name: Run tests - run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.scan --ci.runId=${{ runner.os }}-sec-test + uses: nick-fields/retry@v4 + with: + timeout_minutes: 45 + max_attempts: 3 + retry_wait_seconds: 30 + command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.scan --ci.runId=${{ runner.os }}-sec-test Docker_Scan_Commands_Integration_Tests: name: "[${{ matrix.os }}] Docker Scan Commands Integration Tests" @@ -294,7 +324,12 @@ jobs: # Test - name: Run tests - run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.dockerScan --ci.runId=${{ runner.os }}-sec-test + uses: nick-fields/retry@v4 + with: + timeout_minutes: 45 + max_attempts: 3 + retry_wait_seconds: 30 + command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.dockerScan --ci.runId=${{ runner.os }}-sec-test Other_Commands_Integration_Tests: name: "[${{ matrix.os }}] Other Commands Integration Tests" @@ -324,7 +359,12 @@ jobs: # Test - name: Run tests - run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.curation --test.enrich --test.maliciousScan --ci.runId=${{ runner.os }}-sec-test + uses: nick-fields/retry@v4 + with: + timeout_minutes: 45 + max_attempts: 3 + retry_wait_seconds: 30 + command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.curation --test.enrich --test.maliciousScan --ci.runId=${{ runner.os }}-sec-test Git_Commands_Integration_Tests: name: "[${{ matrix.os }}] Git Commands Integration Tests" @@ -354,7 +394,12 @@ jobs: # Test - name: Run tests - run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.git --ci.runId=${{ runner.os }}-sec-test + uses: nick-fields/retry@v4 + with: + timeout_minutes: 45 + max_attempts: 3 + retry_wait_seconds: 30 + command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.git --ci.runId=${{ runner.os }}-sec-test Remediation_Integration_Tests: name: "[${{ matrix.os }}] Remediation Integration Tests" @@ -384,4 +429,9 @@ jobs: # Test - name: Run tests - run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.remediation --ci.runId=${{ runner.os }}-sec-test \ No newline at end of file + uses: nick-fields/retry@v4 + with: + timeout_minutes: 45 + max_attempts: 3 + retry_wait_seconds: 30 + command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.remediation --ci.runId=${{ runner.os }}-sec-test \ No newline at end of file From 5b15ee910fd00941e91bc8f19374bb2f976db91e Mon Sep 17 00:00:00 2001 From: attiasas Date: Wed, 29 Jul 2026 09:43:30 +0300 Subject: [PATCH 3/4] remove retry --- .github/workflows/test.yml | 73 +++++++------------------------------- 1 file changed, 13 insertions(+), 60 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 1b7f6c731..8c572c757 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -93,12 +93,7 @@ jobs: # Test and generate code coverage - name: Run tests - uses: nick-fields/retry@v4 - with: - timeout_minutes: 45 - max_attempts: 3 - retry_wait_seconds: 30 - command: go test ${{ env.GO_COMMON_TEST_ARGS }} --ci.runId=${{ runner.os }}-sec-test -covermode atomic -coverprofile=cover-unit-tests --test.unit + run: go test ${{ env.GO_COMMON_TEST_ARGS }} --ci.runId=${{ runner.os }}-sec-test -covermode atomic -coverprofile=cover-unit-tests --test.unit Audit_Command_Integration_Tests: name: "[${{ matrix.os }}] ${{ matrix.suite.name }} Audit Command Integration Tests" @@ -152,12 +147,7 @@ jobs: # Test - name: Run tests - uses: nick-fields/retry@v4 - with: - timeout_minutes: 45 - max_attempts: 3 - retry_wait_seconds: 30 - command: go test ${{ env.GO_COMMON_TEST_ARGS }} ${{ matrix.suite.testFlags }} --ci.runId=${{ runner.os }}-sec-test + run: go test ${{ env.GO_COMMON_TEST_ARGS }} ${{ matrix.suite.testFlags }} --ci.runId=${{ runner.os }}-sec-test Artifactory_Integration_Tests: name: "[${{ matrix.os }}] Artifactory Integration Tests" @@ -187,12 +177,7 @@ jobs: # Test - name: Run tests - uses: nick-fields/retry@v4 - with: - timeout_minutes: 45 - max_attempts: 3 - retry_wait_seconds: 30 - command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.artifactory --ci.runId=${{ runner.os }}-sec-test + run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.artifactory --ci.runId=${{ runner.os }}-sec-test Xray_Commands_Integration_Tests: name: "[${{ matrix.os }}] Xray Commands Integration Tests" @@ -210,22 +195,19 @@ jobs: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false allow-unsafe-pr-checkout: true + - name: Start FastCI Optimization if: env.ENABLE_FASTCI_BOOST == 'true' uses: jfrog/boost@v0 with: github_token: ${{secrets.GITHUB_TOKEN}} + - name: Install and Setup Dependencies uses: ./.github/actions/install-and-setup # Test - name: Run tests - uses: nick-fields/retry@v4 - with: - timeout_minutes: 45 - max_attempts: 3 - retry_wait_seconds: 30 - command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.xray --ci.runId=${{ runner.os }}-sec-test + run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.xray --ci.runId=${{ runner.os }}-sec-test Xsc_Integration_Tests: name: "[${{ matrix.os }}] XSC Integration Tests" @@ -249,17 +231,13 @@ jobs: uses: jfrog/boost@v0 with: github_token: ${{secrets.GITHUB_TOKEN}} + - name: Install and Setup Dependencies uses: ./.github/actions/install-and-setup # Test - name: Run tests - uses: nick-fields/retry@v4 - with: - timeout_minutes: 45 - max_attempts: 3 - retry_wait_seconds: 30 - command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.xsc --ci.runId=${{ runner.os }}-sec-test + run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.xsc --ci.runId=${{ runner.os }}-sec-test Binary_Scan_Command_Integration_Tests: name: "[${{ matrix.os }}] Binary Scan Command Integration Tests" @@ -289,12 +267,7 @@ jobs: # Test - name: Run tests - uses: nick-fields/retry@v4 - with: - timeout_minutes: 45 - max_attempts: 3 - retry_wait_seconds: 30 - command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.scan --ci.runId=${{ runner.os }}-sec-test + run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.scan --ci.runId=${{ runner.os }}-sec-test Docker_Scan_Commands_Integration_Tests: name: "[${{ matrix.os }}] Docker Scan Commands Integration Tests" @@ -324,12 +297,7 @@ jobs: # Test - name: Run tests - uses: nick-fields/retry@v4 - with: - timeout_minutes: 45 - max_attempts: 3 - retry_wait_seconds: 30 - command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.dockerScan --ci.runId=${{ runner.os }}-sec-test + run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.dockerScan --ci.runId=${{ runner.os }}-sec-test Other_Commands_Integration_Tests: name: "[${{ matrix.os }}] Other Commands Integration Tests" @@ -359,12 +327,7 @@ jobs: # Test - name: Run tests - uses: nick-fields/retry@v4 - with: - timeout_minutes: 45 - max_attempts: 3 - retry_wait_seconds: 30 - command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.curation --test.enrich --test.maliciousScan --ci.runId=${{ runner.os }}-sec-test + run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.curation --test.enrich --test.maliciousScan --ci.runId=${{ runner.os }}-sec-test Git_Commands_Integration_Tests: name: "[${{ matrix.os }}] Git Commands Integration Tests" @@ -394,12 +357,7 @@ jobs: # Test - name: Run tests - uses: nick-fields/retry@v4 - with: - timeout_minutes: 45 - max_attempts: 3 - retry_wait_seconds: 30 - command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.git --ci.runId=${{ runner.os }}-sec-test + run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.git --ci.runId=${{ runner.os }}-sec-test Remediation_Integration_Tests: name: "[${{ matrix.os }}] Remediation Integration Tests" @@ -429,9 +387,4 @@ jobs: # Test - name: Run tests - uses: nick-fields/retry@v4 - with: - timeout_minutes: 45 - max_attempts: 3 - retry_wait_seconds: 30 - command: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.remediation --ci.runId=${{ runner.os }}-sec-test \ No newline at end of file + run: go test ${{ env.GO_COMMON_TEST_ARGS }} --test.remediation --ci.runId=${{ runner.os }}-sec-test \ No newline at end of file From daebdf3af65e460b72a68535b2b42591c028200e Mon Sep 17 00:00:00 2001 From: attiasas Date: Wed, 29 Jul 2026 09:44:50 +0300 Subject: [PATCH 4/4] Update deps and format --- go.mod | 29 +++++---- go.sum | 64 +++++++++---------- .../huggingface/discovery/python.go | 2 +- .../huggingface/huggingface_test.go | 4 +- 4 files changed, 50 insertions(+), 49 deletions(-) diff --git a/go.mod b/go.mod index 082b032a4..50cc60101 100644 --- a/go.mod +++ b/go.mod @@ -6,21 +6,21 @@ replace github.com/CycloneDX/cyclonedx-go => github.com/CycloneDX/cyclonedx-go v require ( github.com/CycloneDX/cyclonedx-go v0.11.0 - github.com/beevik/etree v1.6.0 + github.com/beevik/etree v1.7.0 github.com/go-git/go-git/v5 v5.19.1 github.com/google/go-github/v56 v56.0.0 github.com/google/uuid v1.6.0 github.com/gookit/color v1.6.1 github.com/hashicorp/go-hclog v1.6.3 github.com/hashicorp/go-plugin v1.6.3 - github.com/jfrog/build-info-go v1.13.1-0.20260713073853-4f3044bf0940 + github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d github.com/jfrog/froggit-go v1.23.1 github.com/jfrog/gofrog v1.7.6 github.com/jfrog/jfrog-apps-config v1.0.1 - github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260722060859-50ee96befe5c - github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260724083402-361ba4a2ecdb - github.com/jfrog/jfrog-client-go v1.55.1-0.20260728084229-b4b7a5c98201 - github.com/magiconair/properties v1.8.10 + github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260728121041-2227ac7420a0 + github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e + github.com/jfrog/jfrog-client-go v1.55.1-0.20260728135425-4a7f34efb305 + github.com/magiconair/properties v1.18.11 github.com/owenrumney/go-sarif/v3 v3.2.3 github.com/package-url/packageurl-go v0.1.3 github.com/spf13/viper v1.21.0 @@ -31,8 +31,8 @@ require ( github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74 golang.org/x/exp v0.0.0-20260527015227-08cc5374adb3 golang.org/x/sync v0.22.0 - golang.org/x/sys v0.45.0 - golang.org/x/text v0.37.0 + golang.org/x/sys v0.47.0 + golang.org/x/text v0.40.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -44,7 +44,7 @@ require ( github.com/VividCortex/ewma v1.2.0 // indirect github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect github.com/andybalholm/brotli v1.2.1 // indirect - github.com/buger/jsonparser v1.2.0 // indirect + github.com/buger/jsonparser v1.3.0 // indirect github.com/c-bata/go-prompt v0.2.6 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/chzyer/readline v1.5.1 // indirect @@ -87,7 +87,7 @@ require ( github.com/hashicorp/go-retryablehttp v0.7.8 // indirect github.com/hashicorp/yamux v0.1.1 // indirect github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect - github.com/jedib0t/go-pretty/v6 v6.7.10 // indirect + github.com/jedib0t/go-pretty/v6 v6.8.3 // indirect github.com/jfrog/archiver/v3 v3.6.3 // indirect github.com/kevinburke/ssh_config v1.6.0 // indirect github.com/klauspost/compress v1.18.6 // indirect @@ -97,7 +97,7 @@ require ( github.com/manifoldco/promptui v0.9.0 // indirect github.com/mattn/go-colorable v0.1.14 // indirect github.com/mattn/go-isatty v0.0.22 // indirect - github.com/mattn/go-runewidth v0.0.23 // indirect + github.com/mattn/go-runewidth v0.0.27 // indirect github.com/mattn/go-tty v0.0.8 // indirect github.com/microsoft/azure-devops-go-api/azuredevops/v7 v7.1.0 // indirect github.com/minio/sha256-simd v1.0.1 // indirect @@ -130,7 +130,8 @@ require ( github.com/tidwall/pretty v1.2.0 // indirect github.com/ulikunitz/xz v0.5.15 // indirect github.com/vbatts/tar-split v0.12.2 // indirect - github.com/vbauerster/mpb/v8 v8.12.1 // indirect + github.com/vbauerster/cupwriter v0.0.4 // indirect + github.com/vbauerster/mpb/v8 v8.14.0 // indirect github.com/xanzy/go-gitlab v0.115.0 // indirect github.com/xanzy/ssh-agent v0.3.3 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect @@ -145,10 +146,10 @@ require ( go.opentelemetry.io/otel/trace v1.42.0 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/crypto v0.52.0 // indirect - golang.org/x/mod v0.36.0 // indirect + golang.org/x/mod v0.37.0 // indirect golang.org/x/net v0.55.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/term v0.43.0 // indirect + golang.org/x/term v0.45.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect google.golang.org/grpc v1.79.3 // indirect diff --git a/go.sum b/go.sum index c315bcf3a..ff78e6031 100644 --- a/go.sum +++ b/go.sum @@ -21,14 +21,14 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFI github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/beevik/etree v1.6.0 h1:u8Kwy8pp9D9XeITj2Z0XtA5qqZEmtJtuXZRQi+j03eE= -github.com/beevik/etree v1.6.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc= +github.com/beevik/etree v1.7.0 h1:xjBk9O4p4x7D1YajePjfLzdaFC4/uYUENA7P0pv6gXA= +github.com/beevik/etree v1.7.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc= github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M= github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0= github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA= github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8= -github.com/buger/jsonparser v1.2.0 h1:4EFcvK1kD4jyj6YqNK6skK6w+y7FHHBR+XBCtxwu/6g= -github.com/buger/jsonparser v1.2.0/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0= +github.com/buger/jsonparser v1.3.0 h1:2RJHo4G3vFBQSYwwEAOfHNRlKIameh/HdbhPJ/zY/0A= +github.com/buger/jsonparser v1.3.0/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0= github.com/c-bata/go-prompt v0.2.6 h1:POP+nrHE+DfLYx370bedwNhsqmpCUynWPxuHi0C5vZI= github.com/c-bata/go-prompt v0.2.6/go.mod h1:/LMAke8wD2FsNu9EXNdHxNLbd9MedkPnCdfpU9wwHfY= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= @@ -157,26 +157,24 @@ github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ= github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A= github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo= -github.com/jedib0t/go-pretty/v6 v6.7.10 h1:B/2qW2Bkv2L6n14PP8o1kx75kWzHOQ3YTluWzg9icac= -github.com/jedib0t/go-pretty/v6 v6.7.10/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU= +github.com/jedib0t/go-pretty/v6 v6.8.3 h1:yVSk5aemoYHCvcrtqyXklwqcgHQIQzmy/oUzFlmffSQ= +github.com/jedib0t/go-pretty/v6 v6.8.3/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU= github.com/jfrog/archiver/v3 v3.6.3 h1:hkAmPjBw393tPmQ07JknLNWFNZjXdy2xFEnOW9wwOxI= github.com/jfrog/archiver/v3 v3.6.3/go.mod h1:5V9l+Fte30Y4qe9dUOAd3yNTf8lmtVNuhKNrvI8PMhg= -github.com/jfrog/build-info-go v1.13.1-0.20260713073853-4f3044bf0940 h1:LthrPDN8YjDKrDNzOWS/w9NLFyeebdnWkmp8vhma0qo= -github.com/jfrog/build-info-go v1.13.1-0.20260713073853-4f3044bf0940/go.mod h1:CYRUCvLKfyARjoJXLWAxce1qNUxTEtbRKAARkV42vpE= +github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d h1:Yqbx+/9cIiZJmpyIkWDyC9Qjh4OaVeGWutADFaUzHr0= +github.com/jfrog/build-info-go v1.13.1-0.20260728083052-16a97012811d/go.mod h1:CYRUCvLKfyARjoJXLWAxce1qNUxTEtbRKAARkV42vpE= github.com/jfrog/froggit-go v1.23.1 h1:4wmaHeuptxVINbovMaeITzVhi3+VQoc/FFIjF4axzu0= github.com/jfrog/froggit-go v1.23.1/go.mod h1:wRDryqyp3oe+eHgME2mpnEQmO8XBECIPagFwj0nHmdI= github.com/jfrog/gofrog v1.7.6 h1:QmfAiRzVyaI7JYGsB7cxfAJePAZTzFz0gRWZSE27c6s= github.com/jfrog/gofrog v1.7.6/go.mod h1:ntr1txqNOZtHplmaNd7rS4f8jpA5Apx8em70oYEe7+4= github.com/jfrog/jfrog-apps-config v1.0.1 h1:mtv6k7g8A8BVhlHGlSveapqf4mJfonwvXYLipdsOFMY= github.com/jfrog/jfrog-apps-config v1.0.1/go.mod h1:8AIIr1oY9JuH5dylz2S6f8Ym2MaadPLR6noCBO4C22w= -github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260722060859-50ee96befe5c h1:eFpR1Wz6py0OrCn53cLwbYgGEKa2qKOOyAXaIdDq3/k= -github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260722060859-50ee96befe5c/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260724083402-361ba4a2ecdb h1:OW2W8ryV0FiCq1DKfRXPLwuB8OB+1wWebVG/sQPaF3Y= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260724083402-361ba4a2ecdb/go.mod h1:9R90mhbczGXwW5EGlDs7F08ejQU/xdoDhYHMvzBiqgE= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260727112535-8cb0c8e8dc62 h1:jWeSXS9RKvouJa+SaQQLNGGmzjmgpq51J999rFxg5DE= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260727112535-8cb0c8e8dc62/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260728084229-b4b7a5c98201 h1:1LdE+OGPcTJkVIJLEWjRFx8WRnfcuFwDxxEqkWI3GCY= -github.com/jfrog/jfrog-client-go v1.55.1-0.20260728084229-b4b7a5c98201/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= +github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260728121041-2227ac7420a0 h1:DVEYAyGJDn9ywGyBSa/MC3oWZsGC2DmPihv++/EDsJs= +github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260728121041-2227ac7420a0/go.mod h1:1vxzqW7jHBSuTNqO2vxEnhbniwq4dj5wveDuCMJX7Yo= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e h1:K0IK3w5a5h6SIi9yoOJ6a7DL+kuFjs5acypOxKyT2OM= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260728123939-34b27f070f2e/go.mod h1:MygQx8pekgPCXyXnejIAVG9S4ImGcDFmcfRPUug/0d0= +github.com/jfrog/jfrog-client-go v1.55.1-0.20260728135425-4a7f34efb305 h1:D86yACKH94D9sJ0XcBK4ioOVSHDec667y22rXondYN0= +github.com/jfrog/jfrog-client-go v1.55.1-0.20260728135425-4a7f34efb305/go.mod h1:FHpjN1nTDoj96xd6obe27EOgGErqzU0rQgC96L3Ch9E= github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo= github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY= @@ -198,8 +196,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/ktrysmt/go-bitbucket v0.9.88 h1:XBjYui83tW2puG7f2GvYSAMMKIPfhpeoLCVfEJx3KVM= github.com/ktrysmt/go-bitbucket v0.9.88/go.mod h1:fx6zdyKEyiNfR9VW0npWD6ugoSUsp8JLXGyqna8bHkc= -github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE= -github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= +github.com/magiconair/properties v1.18.11 h1:j5ozYZl0zCjG7ahMDH0GWIobOvvUzT0BdAguG0ViKy0= +github.com/magiconair/properties v1.18.11/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= github.com/manifoldco/promptui v0.9.0 h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA= github.com/manifoldco/promptui v0.9.0/go.mod h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg= github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= @@ -216,8 +214,8 @@ github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= github.com/mattn/go-runewidth v0.0.6/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= -github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw= -github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= +github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhVlIR0= +github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8= github.com/mattn/go-tty v0.0.3/go.mod h1:ihxohKRERHTVzN+aSVRwACLCeqIoZAWpoICkkvrWyR0= github.com/mattn/go-tty v0.0.8 h1:yxtc0Ye17/1ne/bjy993YUoyP8bJJFa9n5M9XTdwoZQ= github.com/mattn/go-tty v0.0.8/go.mod h1:f2i5ZOvXBU/tCABmLmOfzLz9azMo5wdAaElRNnJKr+k= @@ -322,8 +320,10 @@ github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ= github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo= github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4= github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA= -github.com/vbauerster/mpb/v8 v8.12.1 h1:pyj3yQ2ZGQJgUXm4h17QpR+eERaNz5OQ1ftPSEE/sMM= -github.com/vbauerster/mpb/v8 v8.12.1/go.mod h1:XLXRfStkw/6i5k0aQltijDHT1Z93fD1DVwmIdcFUp6k= +github.com/vbauerster/cupwriter v0.0.4 h1:9sBPe0uXWLZuWQU5lqVbhyFlxX6c09asST/YfatFAys= +github.com/vbauerster/cupwriter v0.0.4/go.mod h1:IFyzS6Xis5dnBH/rdAhrnuzg3c+KkUqEN6yE8lhJlDw= +github.com/vbauerster/mpb/v8 v8.14.0 h1:55SR80dptMfASxIG/oCEkBXgBhxeSu4GrVsjl16oKmA= +github.com/vbauerster/mpb/v8 v8.14.0/go.mod h1:HgpQPKfcWe3kbuGGPmi+jatHreMase5C3Fp5dpdAy0Q= github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74 h1:JwtAtbp7r/7QSyGz8mKUbYJBg2+6Cd7OjM8o/GNOcVo= github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74/go.mod h1:RmMWU37GKR2s6pgrIEB4ixgpVCt/cf7dnJv3fuH1J1c= github.com/xanzy/go-gitlab v0.115.0 h1:6DmtItNcVe+At/liXSgfE/DZNZrGfalQmBRmOcJjOn8= @@ -371,8 +371,8 @@ golang.org/x/exp v0.0.0-20260527015227-08cc5374adb3 h1:VHEvKbpgPXcPXn40t9cDTGK3J golang.org/x/exp v0.0.0-20260527015227-08cc5374adb3/go.mod h1:d2fgXJLVs4dYDHUk5lwMIfzRzSrWCfGZb0ZqeLa/Vcw= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4= -golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ= +golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= +golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -421,16 +421,16 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= -golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58= -golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4= -golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= @@ -438,16 +438,16 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= -golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8= -golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0= +golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= +golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= diff --git a/sca/bom/buildinfo/technologies/huggingface/discovery/python.go b/sca/bom/buildinfo/technologies/huggingface/discovery/python.go index 941dd7cc5..64cd0cb28 100644 --- a/sca/bom/buildinfo/technologies/huggingface/discovery/python.go +++ b/sca/bom/buildinfo/technologies/huggingface/discovery/python.go @@ -610,7 +610,7 @@ func hasUnescapedByte(s string, target byte) bool { } // unquotePythonString extracts the value from a Python string literal token, -// including triple-quoted """...""" and '''...''' forms. Rejects tokens that only +// including triple-quoted """...""" and ”'...”' forms. Rejects tokens that only // look like a single literal at the boundaries but aren't — e.g. Python's implicit // adjacent-literal concatenation ("org/" "model") or explicit "+"-concatenation // ("org/" + "model") both start and end with '"', but the unescaped '"' in the diff --git a/sca/bom/buildinfo/technologies/huggingface/huggingface_test.go b/sca/bom/buildinfo/technologies/huggingface/huggingface_test.go index 3d436d05f..432916e5c 100644 --- a/sca/bom/buildinfo/technologies/huggingface/huggingface_test.go +++ b/sca/bom/buildinfo/technologies/huggingface/huggingface_test.go @@ -226,7 +226,7 @@ func TestBuildDependencyTree_MultiValueAndAdditive(t *testing.T) { params := technologies.BuildInfoBomGeneratorParams{ // Two explicit flag models; source file has a third model that must NOT appear. - HuggingFaceModel: "org/flag-model-a:main, org/flag-model-b:v2", + HuggingFaceModel: "org/flag-model-a:main, org/flag-model-b:v2", HFWorkingDirectory: dir, } trees, uniqueDeps, warnings, err := BuildDependencyTree(params) @@ -248,7 +248,7 @@ func TestBuildDependencyTree_AutoDiscovery(t *testing.T) { dir+"/app.py", []byte(`from_pretrained("org/discovered-model", revision="v1")`), 0644)) params := technologies.BuildInfoBomGeneratorParams{ - HuggingFaceModel: "", + HuggingFaceModel: "", HFWorkingDirectory: dir, } trees, uniqueDeps, _, err := BuildDependencyTree(params)