XRAY-162044 - Remove curate-gh-actions, which moves to the gh-actions JFrog CLI plugin by saisdt-stack · Pull Request #917 · jfrog/jfrog-cli-security

saisdt-stack · 2026-10-12T15:06:12Z

The pull request is targeting the dev branch.
The code has been validated to compile successfully by running go vet ./....
The code has been formatted properly using go fmt ./.... (Every file this PR changes is gofmt-clean. go fmt ./... also reformats commands/curation/curationaudit_test.go and sca/bom/buildinfo/technologies/python/python_cvs_fallback_test.go, which are already unformatted on dev and untouched here.)
All static analysis checks passed. (Running.)
All tests have passed. If this feature is not already covered by the tests, new tests have been added. (Needs the safe to test label.)
Updated the Contributing page / ReadMe page / CI Workflow files if needed. (None mention the command.)
All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added. (The command was hidden and never documented.)

Summary

Removes the hidden jf curate-gh-actions command. It moves to a separate JFrog CLI plugin, gh-actions (jf gh-actions curate), installed with jf plugin install gh-actions. The plugin renders and writes its own job summary.

Removed: everything the command added.

the command, its run action, flag key and help;
commands/curation/curationactions.go and the commands/curation/githubactions package;
the report types (formats.CuratedActions and related), utils/formats/markdown.go, and the GitHub Actions Curation section of the security job summary;
their tests and test data.

Every file the command had changed is back to its state before the command was added: utils/formats/summary.go, utils/utils.go and utils/results/output/securityJobSummary.go are byte-identical to their pre-#877 versions. The only remaining difference in cli/docs/flags.go is the later, unrelated xr-status flags.

The command was hidden and had no users, so nothing replaces it here.

Testing

go build ./... and go vet ./... pass.
go test passes for ./cli/..., ./utils/formats/..., ./utils/results/output/... and ./commands/curation/....
- In commands/curation, the gem and Maven subtests of TestDoCurationAudit were skipped locally: they need a dev Artifactory that wasn't reachable. This PR doesn't touch curation-audit.
git grep finds no reference to the removed command, packages or types.

Summary by CodeRabbit

Removed Features
- Removed the GitHub Actions curation command and its related reporting. Scan summaries and generated security reports no longer include GitHub Actions curation results.
- Existing package curation functionality remains available.

coderabbitai · 2026-10-12T15:06:23Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI; Enforced overrides: Organization, Workspace
Review profile: CHILL
Plan: Advanced
Run ID: 27769ba3-85ef-4577-8f50-ab86aef55235

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 508daf76-535c-40e0-b771-cee088a6a65b

📥 Commits

Reviewing files that changed from the base of the PR and between 01bd2c0 and df4442e.

📒 Files selected for processing: 36

cli/docs/flags.go
cli/docs/scan/curationactions/help.go
cli/scancommands.go
commands/curation/curationactions.go
commands/curation/curationactions_test.go
commands/curation/githubactions/decision.go
commands/curation/githubactions/decision_mock.go
commands/curation/githubactions/decision_mock_test.go
commands/curation/githubactions/discovery.go
commands/curation/githubactions/discovery_test.go
commands/curation/githubactions/reporesolver.go
commands/curation/githubactions/reporesolver_mock.go
commands/curation/githubactions/reporesolver_mock_test.go
commands/curation/githubactions/report.go
commands/curation/githubactions/report_test.go
commands/curation/githubactions/workflow.go
commands/curation/githubactions/workflow_test.go
tests/testdata/projects/githubactions/curation-project/.github/workflows/ci.yml
tests/testdata/projects/githubactions/curation-project/_work/_actions/actions/checkout/v4.completed
tests/testdata/projects/githubactions/curation-project/_work/_actions/actions/checkout/v4/action.yml
tests/testdata/projects/githubactions/curation-project/_work/_actions/github/codeql-action/v3.completed
tests/testdata/projects/githubactions/curation-project/_work/_actions/github/codeql-action/v3/action.yml
tests/testdata/projects/githubactions/curation-project/_work/_actions/github/codeql-action/v3/analyze/action.yml
tests/testdata/projects/githubactions/curation-project/_work/_actions/some-org/transitive-action/v1.completed
tests/testdata/projects/githubactions/curation-project/_work/_actions/some-org/transitive-action/v1/action.yml
tests/testdata/projects/githubactions/malformed-project/_work/_actions/actions/checkout/v4.completed
tests/testdata/projects/githubactions/malformed-project/_work/_actions/actions/checkout/v4/action.yml
tests/testdata/projects/githubactions/malformed-project/_work/_actions/actions/stray-file-at-repo-level.txt
tests/testdata/projects/githubactions/malformed-project/_work/_actions/onlyowner/.gitkeep
tests/testdata/projects/githubactions/malformed-project/_work/_actions/stray-file.txt
utils/formats/markdown.go
utils/formats/markdown_test.go
utils/formats/summary.go
utils/results/output/securityJobSummary.go
utils/results/output/securityJobSummary_actions_test.go
utils/utils.go

💤 Files with no reviewable changes: 31

tests/testdata/projects/githubactions/curation-project/_work/_actions/github/codeql-action/v3.completed
tests/testdata/projects/githubactions/curation-project/_work/_actions/github/codeql-action/v3/analyze/action.yml
tests/testdata/projects/githubactions/curation-project/_work/_actions/actions/checkout/v4.completed
commands/curation/githubactions/discovery_test.go
tests/testdata/projects/githubactions/curation-project/_work/_actions/github/codeql-action/v3/action.yml
cli/docs/flags.go
commands/curation/githubactions/decision_mock_test.go
commands/curation/githubactions/workflow_test.go
commands/curation/githubactions/reporesolver_mock_test.go
tests/testdata/projects/githubactions/curation-project/_work/_actions/actions/checkout/v4/action.yml
tests/testdata/projects/githubactions/curation-project/_work/_actions/some-org/transitive-action/v1.completed
utils/results/output/securityJobSummary_actions_test.go
tests/testdata/projects/githubactions/malformed-project/_work/_actions/actions/checkout/v4.completed
tests/testdata/projects/githubactions/malformed-project/_work/_actions/actions/checkout/v4/action.yml
utils/formats/markdown_test.go
tests/testdata/projects/githubactions/curation-project/.github/workflows/ci.yml
commands/curation/curationactions_test.go
commands/curation/githubactions/report_test.go
cli/scancommands.go
commands/curation/githubactions/decision_mock.go
commands/curation/githubactions/discovery.go
commands/curation/githubactions/reporesolver.go
commands/curation/githubactions/decision.go
cli/docs/scan/curationactions/help.go
commands/curation/githubactions/workflow.go
commands/curation/githubactions/report.go
tests/testdata/projects/githubactions/curation-project/_work/_actions/some-org/transitive-action/v1/action.yml
commands/curation/githubactions/reporesolver_mock.go
commands/curation/curationactions.go
utils/formats/markdown.go
utils/formats/summary.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The PR removes the GitHub Actions curation command and its CLI registration, processing APIs, summary data and rendering, documentation, tests, and test fixtures.

Changes: GitHub Actions curation removal

Layer / File(s)	Summary
Remove the CLI command surface `cli/docs/...`, `cli/scancommands.go`, `utils/utils.go`	The `curate-gh-actions` command registration, handler, flags, help documentation, and command type are removed.
Remove curation processing and tests `commands/curation/...`, `tests/testdata/projects/githubactions/...`	Action discovery, workflow parsing, repository resolution, decision and report APIs, mocks, tests, and GitHub Actions fixtures are deleted.
Remove curation summary output `utils/formats/...`, `utils/results/output/...`	Curated-actions summary types, formatting helpers, output rendering, and related tests are removed.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Other

Suggested reviewers: attiasas

Merge Risk: Minimal · up to df444

This change removes the hidden curate-gh-actions command, which now lives in the gh-actions plugin. No concrete merge-blocking risk was identified, so it is ready to merge once normal CI passes.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and specifically describes the primary change: removing `curate-gh-actions` because the functionality is moving to the `gh-actions` JFrog CLI plugin.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

saisdt-stack · 2026-10-13T00:28:33Z

@coderabbitai full review

coderabbitai · 2026-10-13T00:28:41Z

✅ Action performed

Full review finished.

saisdt-stack · 2026-10-16T06:40:07Z

@coderabbitai help

coderabbitai · 2026-10-16T06:40:16Z

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

CodeRabbit commands

These commands are invoked using PR/Issue comments.

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai review --preview-config to test the unmerged CodeRabbit configuration on a draft PR. The requester must have repository write access; preview results are non-authoritative.
@coderabbitai rate limit to show your current review rate limit status.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai track in a human-authored review thread to track the original finding until CodeRabbit verifies it is fixed.
@coderabbitai fixed in a tracked review thread to verify the current code against the original finding.
@coderabbitai evaluate custom pre-merge check --instructions <custom-checks-instructions> --name <custom-checks-title> [--mode <error|warning>] to validate the custom pre-merge checks instructions. Defaults to error when --mode is omitted.
@coderabbitai ignore pre-merge checks to override pre-merge checks and get an approval on PR.
@coderabbitai run pre-merge checks to run pre-merge checks on the pull request.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai emit path instructions to emit generated path-specific review instructions for this repository.
@coderabbitai generate project vocabulary to list vocabulary that is specific to this repository.
@coderabbitai autofix (alias: @coderabbitai autopilot) to enable Autofix to fix CodeRabbit findings and required CI, and resolve merge conflicts.
@coderabbitai autofix resume to resume Autofix for this PR.
@coderabbitai autofix stop to stop Autofix for this PR.
@coderabbitai resolve to resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai generate configuration to create a PR that adds the current resolved configuration as .coderabbit.yaml (or show it if already present).
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit configuration file (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
You can also validate your configuration using the online YAML validator.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, support, documentation and community

Visit our status page to check the current availability of CodeRabbit.
Create a ticket on our support page for assistance with any issues or questions.
Visit our documentation site for detailed information on how to use CodeRabbit.
Join our Discord community to connect with other users and get help from the community.
Follow us on X/Twitter for updates and announcements.

saisdt-stack · 2026-10-16T06:40:33Z

@coderabbitai full review

coderabbitai · 2026-10-16T06:41:12Z

✅ Action performed

Full review finished.

… JFrog CLI plugin Everything the command added is removed: the command, its packages, help, flag key, report types, report rendering, its section of the security job summary, and their tests and test data. Every file the command had changed is back to its state before the command was added. The plugin renders and writes its own job summary.

github-actions · 2026-10-26T06:45:16Z

🐸 JFrog Frogbot

saisdt-stack requested a deployment to frogbot October 12, 2026 15:06 — with GitHub Actions Waiting

saisdt-stack changed the title ~~XRAY-162044 - Remove curate-gh-actions, which moves to the gh-actions JFrog CLI plugin~~ XRAY-162044 - Remove curate-gh-actions outdated logic Oct 12, 2026

saisdt-stack force-pushed the feature/XRAY-162044-remove-curate-gh-actions branch from 43329cc to ddcc8fa Compare October 12, 2026 15:43

saisdt-stack requested a deployment to frogbot October 12, 2026 15:43 — with GitHub Actions Waiting

saisdt-stack changed the title ~~XRAY-162044 - Remove curate-gh-actions outdated logic~~ XRAY-162044 - Remove curate-gh-actions, which moves to the gh-actions JFrog CLI plugin Oct 12, 2026

saisdt-stack force-pushed the feature/XRAY-162044-remove-curate-gh-actions branch from ddcc8fa to 757ddd2 Compare October 12, 2026 15:57

saisdt-stack deployed to frogbot October 12, 2026 15:57 — with GitHub Actions Active

gauriy-tech added the safe to test Approve running integration tests on a pull request label Oct 13, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Oct 13, 2026

saisdt-stack force-pushed the feature/XRAY-162044-remove-curate-gh-actions branch from 757ddd2 to df4442e Compare October 16, 2026 06:19

saisdt-stack deployed to frogbot October 16, 2026 06:19 — with GitHub Actions Active

gauriy-tech added the safe to test Approve running integration tests on a pull request label Oct 16, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Oct 16, 2026

Phavya-jfrog added the safe to test Approve running integration tests on a pull request label Oct 16, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Oct 16, 2026

Phavya-jfrog added the safe to test Approve running integration tests on a pull request label Oct 16, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Oct 16, 2026

saisdt-stack force-pushed the feature/XRAY-162044-remove-curate-gh-actions branch from df4442e to 9439c4c Compare October 26, 2026 06:32

saisdt-stack deployed to frogbot October 26, 2026 06:32 — with GitHub Actions Active

Phavya-jfrog added the safe to test Approve running integration tests on a pull request label Oct 26, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Oct 26, 2026

gauriy-tech approved these changes Oct 26, 2026

View reviewed changes

gauriy-tech merged commit 9e60b1b into jfrog:dev Oct 26, 2026
122 of 123 checks passed

gauriy-tech added the ignore for release Automatically generated release notes label Oct 26, 2026

Navigation Menu

Repository navigation

XRAY-162044 - Remove curate-gh-actions, which moves to the gh-actions JFrog CLI plugin - #917

XRAY-162044 - Remove curate-gh-actions, which moves to the gh-actions JFrog CLI plugin#917
gauriy-tech merged 1 commit into
jfrog:devfrom
saisdt-stack:feature/XRAY-162044-remove-curate-gh-actions

saisdt-stack commented Oct 12, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

Review skipped

Uh oh!

saisdt-stack commented Oct 13, 2026

Uh oh!

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

saisdt-stack commented Oct 16, 2026

Uh oh!

coderabbitai Bot commented Oct 16, 2026

Uh oh!

saisdt-stack commented Oct 16, 2026

Uh oh!

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

saisdt-stack commented Oct 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

saisdt-stack commented Oct 13, 2026

Uh oh!

coderabbitai Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

saisdt-stack commented Oct 16, 2026

Uh oh!

coderabbitai Bot commented Oct 16, 2026

Chat

CodeRabbit commands

Other keywords and placeholders

CodeRabbit configuration file (.coderabbit.yaml)

Status, support, documentation and community

Uh oh!

saisdt-stack commented Oct 16, 2026

Uh oh!

coderabbitai Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

saisdt-stack commented Oct 12, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

CodeRabbit configuration file (`.coderabbit.yaml`)

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading