sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

ONB-04 · Scan-applicability matrix (target type × artifacts → SAST/DAST/pentest) #122

New Issue
Open
opened 2026-07-10 08:34:43 +00:00 by sharang · 0 comments
sharang commented 2026-07-10 08:34:43 +00:00
Owner
Copy Link
Copy Source

Part of #118.

Context

Which scans are possible depends on the target type and which artifacts are present: SAST needs code/artifact, DAST needs a runtime or binary, active pentest needs a reachable running target.

Scope

  • Encode the applicability matrix (TargetType × artifacts present) → applicable {SAST sub-scans, DAST, Pentest} as a table-driven registry (one row per target type), each cell carrying a short rationale string.
  • SAST umbrella = existing sub-scans (SBOM, CVE, secrets, patterns, lint, code-review, graph) + firmware-static (EMBA/binwalk/cve-bin-tool) + PLC control-logic rules, gated by artifact availability.
  • Expose a function applicable_scans(target) -> Vec<ScanOption { scan, enabled_by_default, rationale, blocked_reason }> for the wizard to render.

Acceptance criteria

  • Matrix covers all 9 target types.
  • A web app with git+URL offers SAST+DAST+pentest; a PLC project offers SAST(control-logic) only; firmware image offers SAST(firmware) + SBOM/CVE.
  • Each offered/blocked scan carries a human-readable rationale.

Depends on

ONB-01. Informs ONB-08.

Part of #118. ## Context Which scans are possible depends on the target type and which artifacts are present: SAST needs code/artifact, DAST needs a runtime or binary, active pentest needs a reachable running target. ## Scope - Encode the applicability matrix `(TargetType × artifacts present) → applicable {SAST sub-scans, DAST, Pentest}` as a table-driven registry (one row per target type), each cell carrying a short rationale string. - SAST umbrella = existing sub-scans (SBOM, CVE, secrets, patterns, lint, code-review, graph) + firmware-static (EMBA/binwalk/cve-bin-tool) + PLC control-logic rules, gated by artifact availability. - Expose a function `applicable_scans(target) -> Vec<ScanOption { scan, enabled_by_default, rationale, blocked_reason }>` for the wizard to render. ## Acceptance criteria - Matrix covers all 9 target types. - A web app with git+URL offers SAST+DAST+pentest; a PLC project offers SAST(control-logic) only; firmware image offers SAST(firmware) + SBOM/CVE. - Each offered/blocked scan carries a human-readable rationale. ## Depends on ONB-01. Informs ONB-08.
sharang added this to the Onboarding v1 milestone 2026-07-10 08:34:43 +00:00
sharang added the enhancementonboarding labels 2026-07-10 08:34:43 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels enhancement onboarding
Milestone
No items
No Milestone Onboarding v1
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#122