sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(plc): ingest CODESYS projects from a git repo (SAST + SBOM) + docs/UI #171

Merged
sharang merged 1 commits from feat/plc-git-ingest into main 2026-07-16 15:47:05 +00:00
Conversation 0 Commits 1 Files Changed 7
+241 -25
sharang commented 2026-07-16 15:41:07 +00:00
Owner
Copy Link
Copy Source

The git-ingest follow-up from #165/#166 (tracker #167). Onboard a PLC/SPS target
with a git repo (or source archive) of exported control logic and get the same
results as an upload — the natural CODESYS version-control workflow, so each scan is
a git pull instead of re-uploading a blob.

Changes (A + B)

  • A — routing:
    • scan_matrix: the PLC control-logic requirement is satisfied by a PlcProject
      or a code artifact (git repo / source archive).
    • plan: resolve_artifact binds the PLC scan to the PlcProject if present, else
      the code artifact.
    • orchestrator: a PLC/SPS target routes to the control-logic scanner over the
      clone       (not the SAST/semgrep pipeline), then still runs DAST for a reachable device.
  • B — SBOM discovery: plc::sbom::collect_sbom sources the control-app SBOM from
    an uploaded archive and any .projectarchive committed inside the working tree.

Docs + UI

  • New guide page PLC / SPS (CODESYS) documenting the best-case git repo layout:
    commit PLCopen XML exports (SAST) + the .projectarchive (library SBOM); don't
    commit only the binary .project.
  • Onboarding wizard shows the same guidance for PLC/SPS targets.

Tests

  • scan_matrix: plc_control_logic_is_satisfied_by_a_git_repo.
  • plan: plc_control_logic_binds_to_a_git_repo.
  • plc::sbom: collect_sbom_finds_a_projectarchive_committed_in_a_git_tree.
  • Full core+agent lib suites green; fmt + clippy (agent/mcp) clean; dashboard builds
    under both server + web features.

🤖 Generated with Claude Code

The git-ingest follow-up from #165/#166 (tracker **#167**). Onboard a PLC/SPS target with a **git repo** (or source archive) of exported control logic and get the same results as an upload — the natural CODESYS version-control workflow, so each scan is a `git pull` instead of re-uploading a blob. ## Changes (A + B) - **A — routing:** - `scan_matrix`: the PLC control-logic requirement is satisfied by a `PlcProject` **or** a code artifact (git repo / source archive). - `plan`: `resolve_artifact` binds the PLC scan to the PlcProject if present, else the code artifact. - `orchestrator`: a PLC/SPS target routes to the **control-logic scanner over the clone** (not the SAST/semgrep pipeline), then still runs DAST for a reachable device. - **B — SBOM discovery:** `plc::sbom::collect_sbom` sources the control-app SBOM from an uploaded archive **and** any `.projectarchive` committed inside the working tree. ## Docs + UI - New guide page **PLC / SPS (CODESYS)** documenting the **best-case git repo layout**: commit PLCopen XML exports (SAST) + the `.projectarchive` (library SBOM); don't commit only the binary `.project`. - Onboarding wizard shows the same guidance for PLC/SPS targets. ## Tests - `scan_matrix`: `plc_control_logic_is_satisfied_by_a_git_repo`. - `plan`: `plc_control_logic_binds_to_a_git_repo`. - `plc::sbom`: `collect_sbom_finds_a_projectarchive_committed_in_a_git_tree`. - Full core+agent lib suites green; fmt + clippy (agent/mcp) clean; dashboard builds under both server + web features. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
sharang added 1 commit 2026-07-16 15:41:08 +00:00
feat(plc): ingest CODESYS projects from a git repo (SAST + SBOM)
CI / Check (pull_request) Successful in 5m47s
Details
CI / Detect Changes (pull_request) Has been skipped
Details
CI / Deploy Agent (pull_request) Has been skipped
Details
CI / Deploy Dashboard (pull_request) Has been skipped
Details
CI / Deploy Docs (pull_request) Has been skipped
Details
CI / Deploy MCP (pull_request) Has been skipped
Details
1a8a6e5149 
Onboard a PLC/SPS target with a git repo (or source archive) of exported control
logic and get the same results as an upload — the natural way CODESYS projects are
version-controlled, so each scan is a git pull rather than a blob re-upload.

- scan_matrix: the PLC control-logic requirement is satisfied by a PlcProject
  *or* a code artifact (git repo / source archive).
- plan: resolve_artifact binds the PLC scan to the PlcProject if present, else the
  code artifact.
- orchestrator: a PLC/SPS target routes to the control-logic scanner over the
  clone (not the SAST/semgrep pipeline), then still runs DAST for a reachable
  device.
- plc::sbom::collect_sbom: the control-app SBOM now also comes from any
  `.projectarchive` committed inside the working tree (a git repo / extracted
  archive), in addition to an uploaded archive.

Docs: new guide page "PLC / SPS (CODESYS)" documenting the best-case git repo
layout (commit PLCopen XML exports for SAST + the .projectarchive for the SBOM;
don't commit only the binary .project). UI: onboarding wizard shows the same
guidance for PLC/SPS targets.

Implements the git-ingest follow-up from #166 / #165. Tracker #167.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sharang merged commit a3f3f1d4f5 into main 2026-07-16 15:47:05 +00:00
sharang deleted branch feat/plc-git-ingest 2026-07-16 15:47:05 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#171