ONB-15 · Unified scan-pipeline rewrite (feature-flagged run_target path) #133

New Issue

2026-07-10T09:02:05Z

sharang commented

2026-07-10 09:02:05 +00:00

Part of #118. New scope introduced by the full-unification decision (replace TrackedRepository + DastTarget with OnboardedTarget end-to-end), which the original #119–#132 set did not cover.

Context

Once the unified OnboardedTarget model (ONB-01) exists, the scan pipeline must run off a target + its artifacts instead of a TrackedRepository. Phase selection becomes driven by the scan-applicability matrix (ONB-04) intersected with the artifacts actually present.

Scope

New compliance-agent/src/pipeline/plan.rs: build_scan_plan(target) -> ScanPlan — intersect applicable_scans(target) (default-on, unblocked) with scan_config.enabled/disabled, bind each scan to the artifact it consumes.
orchestrator::run_target / run_target_pipeline(target, scan_run_id) operating on an OnboardedTarget + IngestSet: SAST umbrella over the code artifact, FirmwareStatic over the firmware blob, DAST only if a LiveUrl artifact exists, PLC over the PLC project, etc.
agent.run_scan dispatches to the unified path behind AgentConfig.unified_pipeline (env UNIFIED_PIPELINE); the legacy path is retained until cutover.
Keep the Scanner trait unchanged (repo_path = artifact working path, repo_id = target id).
Per-git-artifact last_scanned_commit tracking (positional array update); change-detection skip when unchanged.

Acceptance criteria

With UNIFIED_PIPELINE=1, a WebApp target (git + live URL) runs SAST + DAST end-to-end; findings/SBOM/CVE persist keyed by target id.
With the flag off, existing pipeline integration tests stay green.
Firmware/PLC/mobile targets dispatch to their scanners (stubs until those land); DAST is skipped with a recorded reason when no LiveUrl artifact is present.

Depends on

ONB-01 (#119), ONB-02 (#120), ONB-04 (#122), scanner stubs (#128/#129/#130). Precedes migration (#132) verification and API repoint (#131).

Part of #118. New scope introduced by the **full-unification** decision (replace `TrackedRepository` + `DastTarget` with `OnboardedTarget` end-to-end), which the original #119–#132 set did not cover. ## Context Once the unified `OnboardedTarget` model (ONB-01) exists, the scan pipeline must run off a target + its artifacts instead of a `TrackedRepository`. Phase selection becomes driven by the scan-applicability matrix (ONB-04) intersected with the artifacts actually present. ## Scope - New `compliance-agent/src/pipeline/plan.rs`: `build_scan_plan(target) -> ScanPlan` — intersect `applicable_scans(target)` (default-on, unblocked) with `scan_config.enabled/disabled`, bind each scan to the artifact it consumes. - `orchestrator::run_target` / `run_target_pipeline(target, scan_run_id)` operating on an `OnboardedTarget` + `IngestSet`: SAST umbrella over the code artifact, FirmwareStatic over the firmware blob, DAST only if a LiveUrl artifact exists, PLC over the PLC project, etc. - `agent.run_scan` dispatches to the unified path **behind `AgentConfig.unified_pipeline` (env `UNIFIED_PIPELINE`)**; the legacy path is retained until cutover. - Keep the `Scanner` trait unchanged (repo_path = artifact working path, repo_id = target id). - Per-git-artifact `last_scanned_commit` tracking (positional array update); change-detection skip when unchanged. ## Acceptance criteria - With `UNIFIED_PIPELINE=1`, a WebApp target (git + live URL) runs SAST + DAST end-to-end; findings/SBOM/CVE persist keyed by target id. - With the flag off, existing pipeline integration tests stay green. - Firmware/PLC/mobile targets dispatch to their scanners (stubs until those land); DAST is skipped with a recorded reason when no LiveUrl artifact is present. ## Depends on ONB-01 (#119), ONB-02 (#120), ONB-04 (#122), scanner stubs (#128/#129/#130). Precedes migration (#132) verification and API repoint (#131).

sharang added this to the Onboarding v1 milestone 2026-07-10 09:02:05 +00:00

sharang added the enhancement onboarding labels 2026-07-10 09:02:05 +00:00

sharang referenced this issue

2026-07-10 10:24:23 +00:00

feat(onboarding): unified multi-target model + scan matrix foundation #134

sharang referenced this issue

2026-07-10 10:53:11 +00:00

feat(onboarding): artifact ingest + classifier + suite-integration seams #138

sharang referenced this issue from a commit

2026-07-10 16:09:53 +00:00

feat(pipeline): scan-plan builder for the unified pipeline (#133 part 1)

sharang referenced this issue