sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(matrix): PlcSps as a composite device target (SBOM/CVE/DAST/pentest) [#164] #168

Merged
sharang merged 1 commits from feat/plc-composite-matrix into main 2026-07-16 10:56:36 +00:00
Conversation 0 Commits 1 Files Changed 2
+118 -22
1 Commits
Author SHA1 Message Date
Sharang ParnerkarandClaude Opus 4.8 78cf3237d5 feat(matrix): PlcSps as a composite device target (SBOM/CVE/DAST/pentest)
CI / Check (pull_request) Successful in 5m34s
Details
CI / Detect Changes (pull_request) Has been skipped
Details
CI / Deploy Agent (pull_request) Has been skipped
Details
CI / Deploy Dashboard (pull_request) Has been skipped
Details
CI / Deploy Docs (pull_request) Has been skipped
Details
CI / Deploy MCP (pull_request) Has been skipped
Details 
A PLC/SPS device is two layers — the control application and the device it
runs on (firmware/OS + reachable runtime services). Previously PlcSps offered
only PlcControlLogic, so a CODESYS-on-Yocto device's firmware and network
attack surface was invisible.

- scan_matrix: PlcSps now offers FirmwareStatic + Sbom + Cve (require a firmware
  image) and Dast (require a running endpoint, e.g. WebVisu), and
  supports_pentest(PlcSps) is now true. Control-logic stays default-on; the
  device-level scans are offered but opt-in (default-off) — firmware-image
  SBOM/CVE execution is shared with the firmware families and still landing
  (#151/#128), so they must not silently auto-run.
- orchestrator: the PLC branch no longer early-returns, so a PLC device with a
  reachable endpoint also runs DAST (the wired path) after the control-logic scan.

Part of the CODESYS-on-Yocto coverage tracker (#167). Closes #164.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-16 12:50:24 +02:00