feat(pipeline): run tramiton classification + provision DAST in run_target #146

2026-07-12T21:35:56Z

sharang commented

2026-07-12 21:35:56 +00:00

Wires the built-but-unused classification and DAST paths into the unified scan (run_target, behind UNIFIED_PIPELINE), so onboarded targets are actually detected and dynamically scanned.

classify_and_store — ingests the target's artifacts and runs classify_target (tramiton-core in-process for firmware/RTOS/Yocto + MCU/board; heuristics otherwise), storing the Classification on the target. Best-effort. This makes firmware detection real during a scan (previously the classifier was built + unit-tested but never invoked with real cloned paths).
ensure_dast_target — when DAST is planned and the target has a LiveUrl artifact, provisions a DastTarget (repo_id = target id) so the existing DAST trigger fires for wizard-created targets, not just migrated ones. Idempotent.

Both run before the code pipeline. Passes fmt + clippy -D warnings.

Known follow-up: classification ingest clones the git repo separately from the scan pipeline's clone (double-clone) — a perf optimization, not a correctness issue.

Refs #133, #135, #118.

Wires the built-but-unused **classification** and **DAST** paths into the unified scan (`run_target`, behind `UNIFIED_PIPELINE`), so onboarded targets are actually detected and dynamically scanned. - **`classify_and_store`** — ingests the target's artifacts and runs `classify_target` (**tramiton-core in-process** for firmware/RTOS/Yocto + MCU/board; heuristics otherwise), storing the `Classification` on the target. Best-effort. **This makes firmware detection real during a scan** (previously the classifier was built + unit-tested but never invoked with real cloned paths). - **`ensure_dast_target`** — when DAST is planned and the target has a `LiveUrl` artifact, provisions a `DastTarget` (`repo_id` = target id) so the existing DAST trigger fires for **wizard-created** targets, not just migrated ones. Idempotent. Both run before the code pipeline. Passes fmt + clippy `-D warnings`. **Known follow-up:** classification ingest clones the git repo separately from the scan pipeline's clone (double-clone) — a perf optimization, not a correctness issue. Refs #133, #135, #118.

sharang added this to the Onboarding v1 milestone 2026-07-12 21:35:56 +00:00

sharang added the onboarding enhancement labels 2026-07-12 21:35:56 +00:00

sharang added 1 commit 2026-07-12 21:35:57 +00:00

feat(pipeline): run ingest+classify (tramiton) and provision DAST in run_target

CI / Check (pull_request) Successful in 5m34s

Details

CI / Detect Changes (pull_request) Has been skipped

Details

CI / Deploy Agent (pull_request) Has been skipped

Details

CI / Deploy Dashboard (pull_request) Has been skipped

Details

CI / Deploy Docs (pull_request) Has been skipped

Details

CI / Deploy MCP (pull_request) Has been skipped

Details

1ab443457e

Wire the built-but-unused classification + DAST paths into the unified scan so
onboarded targets are actually detected and dynamically scanned:
- classify_and_store: ingests the target's artifacts and runs classify_target
  (tramiton-core in-process for firmware/RTOS/Yocto + MCU/board; heuristics for
  the rest), storing the Classification on the target. Best-effort — never fails
  a scan. This is what makes firmware detection real during a scan.
- ensure_dast_target: when DAST is planned and the target has a LiveUrl artifact,
  provisions a DastTarget (repo_id = target id) so the existing DAST trigger
  fires for wizard-created targets, not just migrated ones. Idempotent.

Both run inside run_target (behind UNIFIED_PIPELINE), before the code pipeline.
Note: classification ingest currently clones the git repo separately from the
scan pipeline's clone (double-clone) — a perf follow-up, not a correctness issue.

Refs #133, #135, #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit 0e57c2d7a7 into main

2026-07-12 21:49:23 +00:00

sharang referenced this pull request

2026-07-12 21:59:12 +00:00

ci: don't cancel-in-progress for main-branch runs (only pull_request) #152

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#146