Onboard a PLC/SPS target with a git repo (or source archive) of exported control
logic and get the same results as an upload — the natural way CODESYS projects are
version-controlled, so each scan is a git pull rather than a blob re-upload.
- scan_matrix: the PLC control-logic requirement is satisfied by a PlcProject
*or* a code artifact (git repo / source archive).
- plan: resolve_artifact binds the PLC scan to the PlcProject if present, else the
code artifact.
- orchestrator: a PLC/SPS target routes to the control-logic scanner over the
clone (not the SAST/semgrep pipeline), then still runs DAST for a reachable
device.
- plc::sbom::collect_sbom: the control-app SBOM now also comes from any
`.projectarchive` committed inside the working tree (a git repo / extracted
archive), in addition to an uploaded archive.
Docs: new guide page "PLC / SPS (CODESYS)" documenting the best-case git repo
layout (commit PLCopen XML exports for SAST + the .projectarchive for the SBOM;
don't commit only the binary .project). UI: onboarding wizard shows the same
guidance for PLC/SPS targets.
Implements the git-ingest follow-up from #166 / #165. Tracker #167.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New `compliance-mcp` crate providing a Model Context Protocol server
with 7 tools: list/get/summarize findings, list SBOM packages, SBOM
vulnerability report, list DAST findings, and DAST scan summary.
Supports stdio (local dev) and Streamable HTTP (deployment via MCP_PORT).
Includes Dockerfile, CI clippy check, and Coolify deploy job.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com>
Reviewed-on: #5
sharang