feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE #145

2026-07-12T21:25:04Z

sharang commented

2026-07-12 21:25:04 +00:00

Closes #133. The finale — makes onboarded targets actually scan. Two parts on this branch:

Part 1 — scan-plan builder (`pipeline/plan.rs`)

build_scan_plan(target) turns an OnboardedTarget into the ordered set of scans, each bound to the artifact it consumes: matrix defaults (applicable_scans) ∩ scan_config enable/disable overrides.

Part 2 — unified execution

AgentConfig.unified_pipeline (env UNIFIED_PIPELINE, default off). agent.run_scan dispatches to run_target when set, else the legacy run().
orchestrator::run_target loads the target from onboarded_targets, creates a ScanRun, and runs run_target_pipeline, which builds the scan plan and — for a code (git) artifact — reuses the entire proven legacy pipeline (clone → SAST umbrella → graph → LLM triage → dedup/persist findings → tracker issues → DAST) via a TrackedRepository view, then syncs findings_count + the git watermark back onto the target. URL-only targets attempt DAST; firmware/PLC/mobile static scanners are follow-ups (#128/#129/#130).
repo_view_from_target is the _id-preserving inverse of the migration's repo_to_target.

Safety

Fully additive + flag-gated — the legacy repository pipeline is untouched and remains the default, so nothing changes until UNIFIED_PIPELINE=1. Unit tests cover repo_view_from_target (the critical inverse mapping) and build_scan_plan. Passes fmt + clippy -D warnings across agent, dashboard (server + web), and mcp.

How to test end-to-end

Set UNIFIED_PIPELINE=1 on the agent, onboard a web/backend target (git repo, optionally a live URL) via the wizard / API, trigger a scan, and confirm findings appear against the target id and the scan run completes.

Refs #118.

Closes #133. The finale — makes onboarded targets actually scan. Two parts on this branch: ## Part 1 — scan-plan builder (`pipeline/plan.rs`) `build_scan_plan(target)` turns an `OnboardedTarget` into the ordered set of scans, each bound to the artifact it consumes: matrix defaults (`applicable_scans`) ∩ `scan_config` enable/disable overrides. ## Part 2 — unified execution - **`AgentConfig.unified_pipeline`** (env **`UNIFIED_PIPELINE`**, default off). `agent.run_scan` dispatches to `run_target` when set, else the legacy `run()`. - **`orchestrator::run_target`** loads the target from `onboarded_targets`, creates a `ScanRun`, and runs `run_target_pipeline`, which builds the scan plan and — for a **code (git) artifact** — reuses the *entire* proven legacy pipeline (clone → SAST umbrella → graph → LLM triage → dedup/persist findings → tracker issues → DAST) via a `TrackedRepository` **view**, then syncs `findings_count` + the git watermark back onto the target. URL-only targets attempt DAST; firmware/PLC/mobile static scanners are follow-ups (#128/#129/#130). - **`repo_view_from_target`** is the `_id`-preserving inverse of the migration's `repo_to_target`. ## Safety Fully **additive + flag-gated** — the legacy repository pipeline is untouched and remains the default, so nothing changes until `UNIFIED_PIPELINE=1`. Unit tests cover `repo_view_from_target` (the critical inverse mapping) and `build_scan_plan`. Passes fmt + clippy `-D warnings` across agent, dashboard (server + web), and mcp. ## How to test end-to-end Set `UNIFIED_PIPELINE=1` on the agent, onboard a web/backend target (git repo, optionally a live URL) via the wizard / API, trigger a scan, and confirm findings appear against the target id and the scan run completes. Refs #118.

sharang added this to the Onboarding v1 milestone 2026-07-12 21:25:04 +00:00

sharang added the onboarding enhancement labels 2026-07-12 21:25:04 +00:00

sharang added 2 commits 2026-07-12 21:25:05 +00:00

feat(pipeline): scan-plan builder for the unified pipeline (#133 part 1) 27d20ed11c

build_scan_plan(target) turns an OnboardedTarget into the ordered set of scans to
run, each bound to the artifact it consumes: matrix defaults (applicable_scans)
intersected with the target's scan_config enable/disable overrides. Pure and
fully unit-tested; the decision engine that run_target will execute next.

Refs #133.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#133 part 2)

CI / Deploy Agent (pull_request) Has been skipped

Details

CI / Deploy Dashboard (pull_request) Has been skipped

Details

CI / Deploy Docs (pull_request) Has been skipped

Details

CI / Deploy MCP (pull_request) Has been skipped

Details

CI / Check (pull_request) Successful in 5m27s

Details

CI / Detect Changes (pull_request) Has been skipped

Details

cbe07261b1

Wire the scan-plan builder into a runnable pipeline that scans an OnboardedTarget:
- AgentConfig.unified_pipeline (env UNIFIED_PIPELINE, default off). agent.run_scan
  dispatches to run_target when set, else the legacy run().
- orchestrator::run_target: loads the target from onboarded_targets, creates a
  ScanRun, and runs run_target_pipeline; run_target_pipeline builds the scan plan
  and, for a code (git) artifact, reuses the full legacy pipeline via a
  TrackedRepository view (clone → SAST umbrella → triage → persist → issues →
  DAST) then syncs findings_count + the git watermark back to the target.
  Firmware/PLC/mobile scanners are follow-ups (#128/#129/#130); URL-only targets
  attempt DAST.
- repo_view_from_target: inverse of the migration's repo_to_target, _id-preserving.

Additive + flag-gated: the legacy path is unchanged and default. Unit tests for
repo_view_from_target (+ the part-1 build_scan_plan tests). Full E2E verification
is via UNIFIED_PIPELINE=1 on a running instance.

Closes #133.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit c6a02f0ac3 into main

2026-07-12 21:31:22 +00:00

sharang referenced this pull request

2026-07-12 21:43:15 +00:00

fix(ci): authenticate tramiton fetch in dashboard + mcp image builds #147

sharang referenced this issue from a commit

2026-07-12 21:43:16 +00:00

fix(ci): authenticate tramiton fetch in dashboard + mcp image builds

Sign in to join this conversation.