fod sast-scan start: Add --in-progress-action and --entitlement-preference options#1015
Open
gilseara wants to merge 2 commits into
Open
fod sast-scan start: Add --in-progress-action and --entitlement-preference options#1015gilseara wants to merge 2 commits into
fod sast-scan start: Add --in-progress-action and --entitlement-preference options#1015gilseara wants to merge 2 commits into
Conversation
added 2 commits
May 20, 2026 13:44
…ntitlement-preference` options Routes the scan start through the FoD `start-scan-advanced` endpoint when either option is specified, allowing control over the in-progress scan action and entitlement preference. Existing callers that pass neither option continue to use `start-scan-with-defaults`, preserving previous behavior. When the advanced path is used and `--in-progress-action` is not explicitly set, fcli defaults it to `Queue` rather than FoD's `DoNotStartScan`.
…PI for cancel action FoD's `start-scan-advanced` endpoint expects `CancelInProgressScan` rather than the value used by the shared `InProgressScanActionType` enum (`CancelScanInProgress`). Translate at the SAST command boundary; the helper now forwards the request's string value directly so a wire-specific value can be supplied. DAST behavior is unchanged.
Contributor
|
@kadraman Can you please review this enhancement? For example, does it make sense to dynamically switch between |
There was a problem hiding this comment.
Pull request overview
This PR extends the FoD SAST scan start command (fcli fod sast-scan start) to expose additional FoD start-scan-advanced capabilities while keeping existing callers backward-compatible by continuing to use start-scan-with-defaults unless one of the new options is provided.
Changes:
- Adds
--in-progress-actionand--entitlement-preferenceoptions tofod sast-scan start. - Introduces a conditional “advanced” execution path that defaults
--in-progress-actiontoQueuewhen advanced mode is triggered. - Adjusts the SAST advanced-start helper to allow sending API-correct
inProgressScanActionTypevalues (notablyCancelInProgressScan) as a raw string.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| fcli-core/fcli-fod/src/main/resources/com/fortify/cli/fod/i18n/FoDMessages.properties | Adds help text for the new --in-progress-action option. |
| fcli-core/fcli-fod/src/main/java/com/fortify/cli/fod/sast_scan/cli/cmd/FoDSastScanStartCommand.java | Adds new CLI options and routes to advanced vs defaults start endpoints based on option usage (with API-value translation for cancel). |
| fcli-core/fcli-fod/src/main/java/com/fortify/cli/fod/_common/scan/helper/sast/FoDScanSastHelper.java | Updates advanced start request construction to pass inProgressScanActionType through without enum parsing. |
|
|
||
| FoDScanSastStartRequest startScanRequest = FoDScanSastStartRequest.builder() | ||
| .isRemediationScan(isRemediation) | ||
| FoDEnums.RemediationScanPreferenceType remediationPref = remediationScanType.getRemediationScanPreferenceType(); |
Comment on lines
+61
to
+75
| boolean useAdvanced = entitlementPreferenceType != null || inProgressScanActionType != null; | ||
|
|
||
| FoDScanSastStartRequest.FoDScanSastStartRequestBuilder requestBuilder = FoDScanSastStartRequest.builder() | ||
| .scanMethodType("Other") | ||
| .notes(notes != null && !notes.isEmpty() ? notes : "") | ||
| .scanTool(FcliBuildProperties.INSTANCE.getFcliProjectName()) | ||
| .scanToolVersion(FcliBuildProperties.INSTANCE.getFcliVersion()) | ||
| .build(); | ||
| .scanToolVersion(FcliBuildProperties.INSTANCE.getFcliVersion()); | ||
|
|
||
| try (IProgressWriter progressWriter = progressWriterFactory.create()) { | ||
| if (useAdvanced) { | ||
| FoDEnums.InProgressScanActionType inProgressAction = inProgressScanActionType != null | ||
| ? inProgressScanActionType : FoDEnums.InProgressScanActionType.Queue; | ||
| // FoD's start-scan-advanced expects 'CancelInProgressScan' rather than the enum's 'CancelScanInProgress' | ||
| String inProgressApiValue = inProgressAction == FoDEnums.InProgressScanActionType.CancelScanInProgress | ||
| ? "CancelInProgressScan" : inProgressAction.name(); |
kadraman
requested changes
Jun 10, 2026
kadraman
left a comment
kadraman
left a comment
Contributor
There was a problem hiding this comment.
The in-progress-action DoNotStarScan is exiting with FcliException if a scan is in progress - this is the API response and not very good - but shouldn't we intercept and display a nicer message here:
>java -jar .\build\libs\fcli.jar fod sast-scan start -f ..\fortify-demo-app\fortifypackage.zip --release "Fortify Demo App:klee2_dev" --in-progress-action DoNotStartScan
FcliSimpleException: Error uploading file
at com.fortify.cli.fod._common.rest.helper.FoDFileTransferHelper.uploadChunked(FoDFileTransferHelper.java:101)
Caused by: com.fortify.cli.common.rest.unirest.UnexpectedHttpResponseException:
Request: POST https://api.emea.fortify.com/api/v3/releases/191706/static-scans/start-scan-advanced?entitlementPreferenceType=SubscriptionFirstThenSingleScan&purchaseEntitlement=false&remdiationScanPreferenceType=NonRemediationScanOnly&inProgressScanActionType=DoNotStartScan&scanTool=fcli&scanToolVersion=0.20260610.141015&scanMethodType=Other&fragNo=0&offset=0:
Reason: HTTP 422 Unprocessable Entity
Body:
{"errors":[{"errorCode":2001,"message":"Cannot start scan as another scan is in progress"}]}
----
at com.fortify.cli.common.rest.unirest.config.UnirestUnexpectedHttpResponseConfigurer$UnexpectedHttpResponseInterceptor.onResponse(UnirestUnexpectedHttpResponseConfigurer.java:36)
at kong.unirest.CompoundInterceptor.lambda$onResponse$1(CompoundInterceptor.java:48)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--in-progress-actionand--entitlement-preferenceoptions tofcli fod sast-scan start, exposing thestart-scan-advancedendpoint'sinProgressScanActionTypeparameter (DoNotStartScan|CancelScanInProgress|Queue) andentitlementPreferenceTypeparameter.start-scan-with-defaults(no behavior change for existing callers, including the bundledfod ciaction).--in-progress-actionis not explicitly set, fcli defaults it toQueueinstead of FoD'sDoNotStartScan.CancelInProgressScanover the wire (FoD'sstart-scan-advancedrejectsCancelScanInProgress); the existing sharedInProgressScanActionTypeenum keeps its current name so DAST behavior is unaffected — translation happens only at the SAST command boundary.Test plan
fcli fod sast-scan start --rel <app:rel> -f <pkg.zip>— verify it still hitsstart-scan-with-defaults(no regression).fcli fod sast-scan start --rel <app:rel> -f <pkg.zip> --in-progress-action=Queue— verify request goes tostart-scan-advancedwithinProgressScanActionType=Queue.fcli fod sast-scan start ... --in-progress-action=CancelScanInProgress— verify the API receivesCancelInProgressScanand the scan-in-progress is cancelled.fcli fod sast-scan start ... --in-progress-action=DoNotStartScan— verify FoD rejects/skips when a scan is already running.fcli fod sast-scan start ... --entitlement-preference=SubscriptionOnly— verify the entitlement preference is honored and--in-progress-actionsilently defaults toQueue.fcli fod sast-scan start --help— verify both new options show with the correct help text and completion candidates.fcli fod dast-scan start --help— confirm DAST still showsCancelScanInProgressas a valid value (unchanged).