Wire the built-but-unused classification + DAST paths into the unified scan so
onboarded targets are actually detected and dynamically scanned:
- classify_and_store: ingests the target's artifacts and runs classify_target
(tramiton-core in-process for firmware/RTOS/Yocto + MCU/board; heuristics for
the rest), storing the Classification on the target. Best-effort — never fails
a scan. This is what makes firmware detection real during a scan.
- ensure_dast_target: when DAST is planned and the target has a LiveUrl artifact,
provisions a DastTarget (repo_id = target id) so the existing DAST trigger
fires for wizard-created targets, not just migrated ones. Idempotent.
Both run inside run_target (behind UNIFIED_PIPELINE), before the code pipeline.
Note: classification ingest currently clones the git repo separately from the
scan pipeline's clone (double-clone) — a perf follow-up, not a correctness issue.
Refs #133, #135, #118.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add repo_id, finding_id, and filter fields to tracing::instrument attributes
for better trace correlation in SigNoz. Replace all silently swallowed errors
(Err(_) => Vec::new()) with tracing::warn! logging across mod.rs, dast.rs,
graph.rs handlers. Add stage-level spans with .instrument() to pipeline
orchestrator for visibility into scan phases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add DAST scanning and code knowledge graph features across the stack:
- compliance-dast and compliance-graph workspace crates
- Agent API handlers and routes for DAST targets/scans and graph builds
- Core models and traits for DAST and graph domains
- Dashboard pages for DAST targets/findings/overview and graph explorer/impact
- Toast notification system with auto-dismiss for async action feedback
- Button click animations and disabled states for better UX
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Run cargo fmt on all crates
- Fix regex patterns using unsupported lookahead in patterns.rs
- Replace unwrap() calls with compile_regex() helper
- Fix never type fallback in GitHub tracker
- Fix redundant field name in findings page
- Allow enum_variant_names for Dioxus Route enum
- Fix &mut Vec -> &mut [T] clippy lint in sbom.rs
- Mark unused-but-intended APIs with #[allow(dead_code)]
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sharang