feat(plc): ingest CODESYS projects from a git repo (SAST + SBOM) (#171)

compliance-core/src/scan_matrix.rs

@@ -294,7 +294,12 @@ fn requirement_satisfied(req: ArtifactRequirement, target: &OnboardedTarget) ->
         ArtifactRequirement::Code => target.code_artifact().is_some(),
         ArtifactRequirement::RunningUrl => target.has(ArtifactKind::LiveUrl),
         ArtifactRequirement::Firmware => target.has(ArtifactKind::FirmwareImage),
-        ArtifactRequirement::Plc => target.has(ArtifactKind::PlcProject),
+        // A PLC project artifact, or a code artifact (git repo / source archive)
+        // holding the control logic as PLCopen XML / ST exports — the common way
+        // CODESYS projects are version-controlled.
+        ArtifactRequirement::Plc => {
+            target.has(ArtifactKind::PlcProject) || target.code_artifact().is_some()
+        }
         ArtifactRequirement::Mobile => target.has(ArtifactKind::MobilePackage),
         ArtifactRequirement::Container => target.has(ArtifactKind::ContainerImage),
         ArtifactRequirement::Any => true,
@@ -406,6 +411,19 @@ mod tests {
         assert!(dast.blocked_reason.is_some());
     }
 
+    #[test]
+    fn plc_control_logic_is_satisfied_by_a_git_repo() {
+        // A CODESYS project version-controlled in git (PLCopen XML / ST exports),
+        // no uploaded PlcProject artifact.
+        let t = target_with(TargetType::PlcSps, vec![Artifact::git_repo("u", "main")]);
+        let opts = applicable_scans(&t);
+        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
+        assert!(
+            plc.default_on && plc.blocked_reason.is_none(),
+            "a git repo should satisfy PLC control-logic"
+        );
+    }
+
     #[test]
     fn plc_composite_lights_up_device_scans_with_firmware_and_url() {
         // A CODESYS-on-Yocto device: PLC project + firmware image + WebVisu URL.