Merge branch 'dev'

.github/workflows/analysis.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.20.x
+          go-version: 1.22.x
           cache: false
 
       - name: Static Code Analysis
@@ -35,7 +35,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.20.x
+          go-version: 1.22.x
           cache: false
 
       - name: Run Gosec Security Scanner

.github/workflows/frogbot-scan-pull-request.yml

@@ -12,6 +12,12 @@ jobs:
     # "frogbot" GitHub environment can approve the pull request to be scanned.
     environment: frogbot
     steps:
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.22.x
+          cache: false
+
       - uses: jfrog/frogbot@v2
         env:
           JFROG_CLI_LOG_LEVEL: "DEBUG"

.github/workflows/frogbot-scan-repository.yml

@@ -16,6 +16,12 @@ jobs:
         # The repository scanning will be triggered periodically on the following branches.
         branch: [ "dev" ]
     steps:
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.22.x
+          cache: false
+
       - uses: jfrog/frogbot@v2
         env:
           JFROG_CLI_LOG_LEVEL: "DEBUG"

.github/workflows/test.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.20.x
+          go-version: 1.22.x
           cache: false
 
       - name: Install NuGet

artifactory/commands/golang/go.go

@@ -153,14 +153,12 @@ func (gc *GoCommand) run() (err error) {
 	if err != nil {
 		return
 	}
-	repoUrl, err := goutils.GetArtifactoryRemoteRepoUrl(resolverDetails, gc.resolverParams.TargetRepo())
+	// If noFallback=false, missing packages will be fetched directly from VCS
+	repoUrl, err := goutils.GetArtifactoryRemoteRepoUrl(resolverDetails, gc.resolverParams.TargetRepo(), goutils.GoProxyUrlParams{Direct: !gc.noFallback})
 	if err != nil {
 		return
 	}
-	// If noFallback=false, missing packages will be fetched directly from VCS
-	if !gc.noFallback {
-		repoUrl += "|direct"
-	}
+
 	err = biutils.RunGo(gc.goArg, repoUrl)
 	if errorutils.CheckError(err) != nil {
 		err = coreutils.ConvertExitCodeError(err)
@@ -330,19 +328,21 @@ func buildPackageVersionRequest(name, branchName string) string {
 	return path.Join(packageVersionRequest, "latest.info")
 }
 
-func SetArtifactoryAsResolutionServer(serverDetails *config.ServerDetails, depsRepo string) (err error) {
-	err = setGoProxy(serverDetails, depsRepo)
-	if err != nil {
+func SetArtifactoryAsResolutionServer(serverDetails *config.ServerDetails, depsRepo string, goProxyParams goutils.GoProxyUrlParams) (err error) {
+	if err = setGoProxy(serverDetails, depsRepo, goProxyParams); err != nil {
 		err = fmt.Errorf("failed while setting Artifactory as a dependencies resolution registry: %s", err.Error())
 	}
 	return
 }
 
-func setGoProxy(server *config.ServerDetails, remoteGoRepo string) error {
-	repoUrl, err := goutils.GetArtifactoryRemoteRepoUrl(server, remoteGoRepo)
+func setGoProxy(server *config.ServerDetails, remoteGoRepo string, goProxyParams goutils.GoProxyUrlParams) error {
+	repoUrl, err := goutils.GetArtifactoryRemoteRepoUrl(server, remoteGoRepo, goProxyParams)
 	if err != nil {
 		return err
 	}
-	repoUrl += "|direct"
 	return os.Setenv("GOPROXY", repoUrl)
 }
+
+func SetGoModCache(cacheFolder string) error {
+	return os.Setenv("GOMODCACHE", cacheFolder)
+}

artifactory/commands/golang/go_test.go

@@ -3,6 +3,7 @@ package golang
 import (
 	"fmt"
 	"github.com/jfrog/jfrog-cli-core/v2/utils/config"
+	"github.com/jfrog/jfrog-cli-core/v2/utils/coreutils"
 	goutils "github.com/jfrog/jfrog-cli-core/v2/utils/golang"
 	testsutils "github.com/jfrog/jfrog-client-go/utils/tests"
 	"github.com/stretchr/testify/assert"
@@ -60,9 +61,18 @@ func TestSetArtifactoryAsResolutionServer(t *testing.T) {
 	cleanup := testsutils.SetEnvWithCallbackAndAssert(t, "GOPROXY", "")
 	defer cleanup()
 
-	assert.NoError(t, SetArtifactoryAsResolutionServer(server, repo))
+	assert.NoError(t, SetArtifactoryAsResolutionServer(server, repo, goutils.GoProxyUrlParams{Direct: true}))
 
 	serverUrlWithoutHttp := strings.TrimPrefix(server.ArtifactoryUrl, "http://")
 	expectedGoProxy := fmt.Sprintf("http://%s:%s@%sapi/go/%s|direct", server.User, server.Password, serverUrlWithoutHttp, repo)
 	assert.Equal(t, expectedGoProxy, os.Getenv("GOPROXY"))
+
+	// Verify that the EndpointPrefix value is correctly added to the GOPROXY.
+	// In this test case, the endpoint prefix is set to api/curation/audit/.
+	// This parameter allows downloading dependencies from a custom API instead of the default one.
+	assert.NoError(t, SetArtifactoryAsResolutionServer(server, repo, goutils.GoProxyUrlParams{Direct: true, EndpointPrefix: coreutils.CurationPassThroughApi}))
+
+	serverUrlWithoutHttp = strings.TrimPrefix(server.ArtifactoryUrl, "http://")
+	expectedGoProxy = fmt.Sprintf("http://%s:%s@%sapi/curation/audit/api/go/%s|direct", server.User, server.Password, serverUrlWithoutHttp, repo)
+	assert.Equal(t, expectedGoProxy, os.Getenv("GOPROXY"))
 }

artifactory/utils/utils.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	ioutils "github.com/jfrog/gofrog/io"
+	"github.com/jfrog/jfrog-client-go/evidence"
 	"io"
 	"net/http"
 	"net/url"
@@ -214,6 +215,27 @@ func CreateLifecycleServiceManager(serviceDetails *config.ServerDetails, isDryRu
 	return lifecycle.New(serviceConfig)
 }
 
+func CreateEvidenceServiceManager(serviceDetails *config.ServerDetails, isDryRun bool) (*evidence.EvidenceServicesManager, error) {
+	certsPath, err := coreutils.GetJfrogCertsDir()
+	if err != nil {
+		return nil, err
+	}
+	evdAuth, err := serviceDetails.CreateEvidenceAuthConfig()
+	if err != nil {
+		return nil, err
+	}
+	serviceConfig, err := clientConfig.NewConfigBuilder().
+		SetServiceDetails(evdAuth).
+		SetCertificatesPath(certsPath).
+		SetInsecureTls(serviceDetails.InsecureTls).
+		SetDryRun(isDryRun).
+		Build()
+	if err != nil {
+		return nil, err
+	}
+	return evidence.New(serviceConfig)
+}
+
 // This error indicates that the build was scanned by Xray, but Xray found issues with the build.
 // If Xray failed to scan the build, for example due to a networking issue, a regular error should be returned.
 var errBuildScan = errors.New("issues found during xray build scan")