Rename ExploitIQ/Agent morpheus to Exploit Intelligence by TamarW0 · Pull Request #255 · RHEcosystemAppEng/agent-morpheus-client

TamarW0 · 2026-06-23T23:16:22Z

No description provided.

vbelouso · 2026-06-23T23:16:39Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

TamarW0 · 2026-06-24T01:16:19Z

/retest

rhartuv

Hi @TamarW0 👍
There are a lot of changes that could have a broader impact, so a decision is needed: do we revert to the previous name, or do we update many other files and repositories that depend on this code?
Good luck :)

rhartuv · 2026-06-24T08:15:02Z

-morpheus.syft.cache.dir=${SYFT_CACHE_DIR:/work/.cache/syft}
+exploit-intelligence.syft.cache.dir=${SYFT_CACHE_DIR:/work/.cache/syft}

 # Feedback API settings


Revert feedback API hostname change — quarkus.rest-client.feedback-api.url was changed from http://morpheus-feedback-api:5001 to http://exploit-intelligence-feedback-api:5001, but there’s no matching ocp Service rename in this PR (and deploy/agent_morpheus_client.yaml doesn’t override it). In cluster, feedback submit/check will fail on DNS unless infra is renamed in parallel.
For a branding-only PR, keep the old hostname here; rename when the Service is actually renamed.

BUT- It’s worth aligning on this and making a sweeping decision. I’d consult with @zvigrinberg

@zvigrinberg what do you think?
is it worth changing all ocp services names of leave it as it for now?

Good point @rhartuv
@TamarW0 In case you goes for changing the service names here, you better do the service names changes in vulnerability-analysis PR and merge it before this one is get merged. ( in that particular case also in the user-feedback repo)..
Just to be on the safe side, it can be done in a subsequent PR after the other PRs are merged.

I think it is better to do it in a separate PR, and you are right about the order

@TamarW0 If you're doing already in user feedback repository and in the agent repo and they get merged first, then you can do it here.

rhartuv · 2026-06-24T08:26:19Z

 quarkus.rest-client.github.headers.User-Agent=exploit-iq
-quarkus.rest-client.morpheus.url=https://agent-morpheus:8080/generate
-%dev.quarkus.rest-client.morpheus.url=http://localhost:26466/generate
+quarkus.rest-client.exploit-intelligence.url=https://exploit-intelligence:8080/generate


quarkus.rest-client.exploit-intelligence.url was changed from https://agent-morpheus:8080/generate to https://exploit-intelligence:8080/generate, but deploy/infra in this repo still references agent-morpheus (e.g. deploy/agent_morpheus_client.yaml). This will break report submission in cluster unless the ocp Service is renamed in the same rollout.
In my opinion, For branding-only scope, keep the old hostname and only rename the property key if needed.

BUT- It’s worth aligning on this and making a sweeping decision.

I reverted this for now
@zvigrinberg WDTY?

@TamarW0 Make sure it's aligned with agent service name in vulnerability-analysis' deployment base overlay variant, and then it can be merged in that order: agent App -> client App.

rhartuv · 2026-06-24T08:36:09Z

 %test.quarkus.log.category."io.quarkiverse.wiremock.devservice.WireMockServer".level=ERROR
-# Morpheus REST client → WireMock (no real agent in @QuarkusTest); stub is mappings/morpheus-generate.json
-%test.quarkus.rest-client.morpheus.url=http://localhost:${quarkus.wiremock.devservices.port}/generate
+# Exploit Intelligence REST client → WireMock (no real agent in @QuarkusTest); stub is mappings/exploit-intelligence-generate.json


Comment references a file that doesn’t exist - test config comment says mappings/exploit-intelligence-generate.json, but the actual stub is still morpheus-generate.json. fix the comment.

I fixed that
now the file is mappings/exploit-iq-generate.json and exists

rhartuv · 2026-06-24T08:38:03Z

  <modelVersion>4.0.0</modelVersion>
-  <groupId>com.redhat.ecosystemappeng.morpheus</groupId>
-  <artifactId>agent-morpheus-client</artifactId>
+  <groupId>com.redhat.ecosystemappeng.exploit-intelligence</groupId>


changes agent-morpheus-client → exploit-intelligence while Java packages, paths, image names, and deploy manifests are unchanged. This can break CI/CD, container builds, and downstream references without a coordinated migration.

pathes changed as well

rhartuv · 2026-06-24T08:41:14Z

 # Authentication

-This guide covers authentication configuration for ExploitIQ Client, including OpenShift OAuth, external identity providers, and development setups.
+This guide covers authentication configuration for exploit intelligence, including OpenShift OAuth, external identity providers, and development setups.


docs/authentication.md documents exploit-intelligence-client and exploit-intelligence-* roles, but application.properties and keycloak-realm.json still use exploit-iq-client / exploit-iq-view etc.
Either update the runtime config + realm together, or revert the doc changes to match what the app actually uses today....
It’s worth aligning on this and making a sweeping decision.

zvigrinberg

Hi @TamarW0 ,

There are still a lot of things to do:

a lot of readmes in the docs still referencing old name of morpheus.
Dockerfiles at path src/main/docker/, still referencing old agent morpheus name in the comments explaining how to build the image - please check.
Also i've noticed you deleted and recreated few files while refactoring, this might eliminate git history for files and that's a shame ( unless done with the git mv command).
In the tests i've encountered some reference to morpheus , in particular at src/test/java/com/redhat/ecosystemappeng/exploitiq/rest/RestApiTestFixture.java.
Rest of comments below addresses all others.

zvigrinberg · 2026-06-25T11:31:13Z

 # This ensures credentials survive queue wait before Agent execution

-morpheus.credential-store.encryption-key=${CREDENTIAL_ENCRYPTION_KEY}
+exploit-iq.credential-store.encryption-key=${CREDENTIAL_ENCRYPTION_KEY:build-time-placeholder-32-bytes!}


@TamarW0 In prod profile the property should be without default ( only for dev profile it should have).

zvigrinberg · 2026-06-25T11:41:55Z

-morpheus.syft.cache.dir=${SYFT_CACHE_DIR:/work/.cache/syft}
+exploit-intelligence.syft.cache.dir=${SYFT_CACHE_DIR:/work/.cache/syft}

 # Feedback API settings


Good point @rhartuv
@TamarW0 In case you goes for changing the service names here, you better do the service names changes in vulnerability-analysis PR and merge it before this one is get merged. ( in that particular case also in the user-feedback repo)..
Just to be on the safe side, it can be done in a subsequent PR after the other PRs are merged.

zvigrinberg · 2026-06-25T11:59:01Z

 %dev.quarkus.wiremock.devservices.files-mapping=src/test/resources/devservices/wiremock
 #%dev.quarkus.rest-client.github.url=https://api.github.com
-#%dev.quarkus.rest-client.morpheus.url=http://localhost:${quarkus.wiremock.devservices.port}/morpheus/scan
+#%dev.quarkus.rest-client.exploit-iq.url=http://localhost:${quarkus.wiremock.devservices.port}/exploit-Iq/scan


Suggested change

#%dev.quarkus.rest-client.exploit-iq.url=http://localhost:${quarkus.wiremock.devservices.port}/exploit-Iq/scan

#%dev.quarkus.rest-client.exploit-iq.url=http://localhost:${quarkus.wiremock.devservices.port}/exploit-iq/scan

zvigrinberg · 2026-06-25T12:33:00Z

@TamarW0

Suggested change

* Builds, persists, and submits ExploitIQ report requests for the RPM package checker pipeline.

zvigrinberg · 2026-06-25T12:34:08Z

@TamarW0

Suggested change

/** RPM package identity for ExploitIQ Agent RPM package checker pipeline. */

zvigrinberg · 2026-06-25T12:35:45Z

@TamarW0

Suggested change

"The exploit-iq.repository.reports-path must be a valid directory: " + reportsPath);

zvigrinberg · 2026-06-25T12:39:05Z

@TamarW0

Suggested change

* builds ExploitIQ input with {@link PipelineMode#RPM_PACKAGE_CHECKER}, persists, and submits to the queue.

zvigrinberg · 2026-06-25T12:40:22Z

@TamarW0 At least 3 occurences of Morpheus in this file that should be replace with ExploitIQ.

Co-authored-by: Zvi Grinberg <75700623+zvigrinberg@users.noreply.github.com>

…AppEng/agent-morpheus-client into APPENG-5387-branding

zvigrinberg

@TamarW0 This already looks better than before...
Please see my comments.

zvigrinberg · 2026-06-28T14:03:58Z

  const isProductContext = productId != null && cveId != null;

-  const { status: statusFilterValue, exploitIqStatus: exploitIqStatusApiValue } =
+  const { status: statusFilterValue, exploitIqStatus: ExploitIqStatusApiValue } =


@TamarW0 Please revert to camelCase from UpperCamelCase in all places in this file
As it's variable name

Suggested change

const { status: statusFilterValue, exploitIqStatus: ExploitIqStatusApiValue } =

const { status: statusFilterValue, exploitIqStatus: exploitIqStatusApiValue } =

zvigrinberg · 2026-06-28T14:05:04Z

 * Use {@link withAppTitle} so every tab includes the product name.
 */

-export const DOCUMENT_TITLE_APP_NAME = "Exploit Intelligence";


@TamarW0 What about that?

zvigrinberg · 2026-06-28T14:06:31Z

 The ID column SHALL display `report.id` as a link to the report page (component route: `/reports/component/{cveId}/{report.id}`; product route: `/reports/product/{productId}/{cveId}/{report.id}`). The **Date Requested** column SHALL display `metadata.submitted_at` when present, in the format "DD Month YYYY, HH:MM:SS AM/PM"; when `metadata.submitted_at` is missing, the cell SHALL display "-". The **Date Completed** column SHALL display `report.completedAt` in the same format. All date fields SHALL use the format "DD Month YYYY, HH:MM:SS AM/PM" (e.g., "07 July 2025, 10:14:02 PM").

-The table SHALL display a single **Finding** column (no separate "Analysis state" or "ExploitIQ Status" column). The Finding cell SHALL show, per row: if the report's analysis state is **completed**, the ExploitIQ status (Vulnerable, Not vulnerable, or Uncertain) from the vulnerability justification; if the report's analysis state is **pending**, **queued**, or **sent**, "In progress" using the shared InProgressStatus component (grey outline label, InProgressIcon); if the report's analysis state is **expired** or **failed**, "Failed" using the shared FailedStatus component (grey filled label, ExclamationCircleIcon). Styling SHALL match the Finding column in the reports table for in-progress and failed states.
+The table SHALL display a single **Finding** column (no separate "Analysis state" or "ExploitIQ  Status" column). The Finding cell SHALL show, per row: if the report's analysis state is **completed**, the ExploitIQ  status (Vulnerable, Not vulnerable, or Uncertain) from the vulnerability justification; if the report's analysis state is **pending**, **queued**, or **sent**, "In progress" using the shared InProgressStatus component (grey outline label, InProgressIcon); if the report's analysis state is **expired** or **failed**, "Failed" using the shared FailedStatus component (grey filled label, ExclamationCircleIcon). Styling SHALL match the Finding column in the reports table for in-progress and failed states.


@TamarW0 Redundant one space separator in two words "ExploitIQ Status"

Suggested change

The table SHALL display a single **Finding** column (no separate "Analysis state" or "ExploitIQ Status" column). The Finding cell SHALL show, per row: if the report's analysis state is **completed**, the ExploitIQ status (Vulnerable, Not vulnerable, or Uncertain) from the vulnerability justification; if the report's analysis state is **pending**, **queued**, or **sent**, "In progress" using the shared InProgressStatus component (grey outline label, InProgressIcon); if the report's analysis state is **expired** or **failed**, "Failed" using the shared FailedStatus component (grey filled label, ExclamationCircleIcon). Styling SHALL match the Finding column in the reports table for in-progress and failed states.

The table SHALL display a single **Finding** column (no separate "Analysis state" or "ExploitIQ Status" column). The Finding cell SHALL show, per row: if the report's analysis state is **completed**, the ExploitIQ status (Vulnerable, Not vulnerable, or Uncertain) from the vulnerability justification; if the report's analysis state is **pending**, **queued**, or **sent**, "In progress" using the shared InProgressStatus component (grey outline label, InProgressIcon); if the report's analysis state is **expired** or **failed**, "Failed" using the shared FailedStatus component (grey filled label, ExclamationCircleIcon). Styling SHALL match the Finding column in the reports table for in-progress and failed states.

nice you saw this
fixed

zvigrinberg · 2026-06-28T14:08:35Z

-morpheus.syft.cache.dir=${SYFT_CACHE_DIR:/work/.cache/syft}
+exploit-intelligence.syft.cache.dir=${SYFT_CACHE_DIR:/work/.cache/syft}

 # Feedback API settings


@TamarW0 If you're doing already in user feedback repository and in the agent repo and they get merged first, then you can do it here.

zvigrinberg · 2026-06-28T14:11:44Z

 # quarkus.log.category."io.quarkus.oidc".min-level=DEBUG

-%dev.quarkus.log.category."com.redhat.ecosystemappeng.morpheus".level=DEBUG
+%dev.quarkus.log.category."com.redhat.ecosystemappeng.exploit-iq".level=DEBUG


@TamarW0 This should match a java package ,but the dash in exploit-iq is invalid and won't match anything.

Suggested change

%dev.quarkus.log.category."com.redhat.ecosystemappeng.exploit-iq".level=DEBUG

%dev.quarkus.log.category."com.redhat.ecosystemappeng.exploitiq".level=DEBUG

zvigrinberg · 2026-06-28T14:12:24Z

    /**
     * Create analysis request for an RPM package
-     * Accepts RPM name, version, release, architecture, and a CVE id; builds a Morpheus input with pipeline_mode rpm_package_checker and target_package, persists the report, and always submits it for analysis (same queue path as POST /reports/new with submit=true). Validation errors use the same field-mapped JSON shape as POST /products/upload-spdx (object "errors" mapping field names to messages).
+     * Accepts RPM name, version, release, architecture, and a CVE id; builds a ExploitIq input with pipeline_mode rpm_package_checker and target_package, persists the report, and always submits it for analysis (same queue path as POST /reports/new with submit=true). Validation errors use the same field-mapped JSON shape as POST /products/upload-spdx (object "errors" mapping field names to messages).


Suggested change

* Accepts RPM name, version, release, architecture, and a CVE id; builds a ExploitIq input with pipeline_mode rpm_package_checker and target_package, persists the report, and always submits it for analysis (same queue path as POST /reports/new with submit=true). Validation errors use the same field-mapped JSON shape as POST /products/upload-spdx (object "errors" mapping field names to messages).

* Accepts RPM name, version, release, architecture, and a CVE id; builds an ExploitIq input with pipeline_mode rpm_package_checker and target_package, persists the report, and always submits it for analysis (same queue path as POST /reports/new with submit=true). Validation errors use the same field-mapped JSON shape as POST /products/upload-spdx (object "errors" mapping field names to messages).

zvigrinberg · 2026-06-28T14:23:23Z

 import org.eclipse.microprofile.openapi.annotations.media.Schema;

-@Schema(name = "PipelineMode", description = "Morpheus agent pipeline mode")
+@Schema(name = "PipelineMode", description = "ExploitIq pipeline mode")


@TamarW0 This is built into the openapi description for the model

Suggested change

@Schema(name = "PipelineMode", description = "ExploitIq pipeline mode")

@Schema(name = "PipelineMode", description = "ExploitIQ pipeline mode")

zvigrinberg · 2026-06-28T14:24:36Z

    summary = "Create analysis request for an RPM package",
    description = """
-        Accepts RPM name, version, release, architecture, and a CVE id; builds a Morpheus input with \
+        Accepts RPM name, version, release, architecture, and a CVE id; builds a ExploitIq input with \


@TamarW0

Suggested change

Accepts RPM name, version, release, architecture, and a CVE id; builds a ExploitIq input with \

Accepts RPM name, version, release, architecture, and a CVE id; builds an ExploitIQ input with \

zvigrinberg · 2026-06-28T14:24:53Z

  @Operation(
    summary = "Receive analysis report", 
-    description = "Receives a completed analysis report from Morpheus")
+    description = "Receives a completed analysis report from ExploitIq")


@TamarW0

Suggested change

description = "Receives a completed analysis report from ExploitIq")

description = "Receives a completed analysis report from ExploitIQ")

zvigrinberg · 2026-06-28T14:25:33Z

 }

-/** RPM NEVRA persisted under Morpheus `input.image.target_package`. */
+/** RPM NEVRA persisted under ExploitIq `input.image.target_package`. */


@TamarW0

Suggested change

/** RPM NEVRA persisted under ExploitIq `input.image.target_package`. */

/** RPM NEVRA persisted under ExploitIQ `input.image.target_package`. */

zvigrinberg

@TamarW0 Thank you, almost there, please see my comments.

zvigrinberg · 2026-06-30T05:51:33Z

+      String[] ExploitIqStatusValues = exploitIqStatus.split(",");
      List<Bson> exploitIqStatusFilters = new ArrayList<>();

-      for (String statusValue : exploitIqStatusValues) {
+      for (String statusValue : ExploitIqStatusValues) {


@TamarW0 Convert var reference to camelCase

Suggested change

String[] ExploitIqStatusValues = exploitIqStatus.split(",");

List<Bson> exploitIqStatusFilters = new ArrayList<>();

for (String statusValue : exploitIqStatusValues) {

for (String statusValue : ExploitIqStatusValues) {

String[] exploitIqStatusValues = exploitIqStatus.split(",");

List<Bson> exploitIqStatusFilters = new ArrayList<>();

for (String statusValue : exploitIqStatusValues) {

zvigrinberg · 2026-06-30T05:52:18Z

      },
      "PipelineMode": {
-        "description": "Morpheus agent pipeline mode",
+        "description": "ExploitIq pipeline mode",


Suggested change

"description": "ExploitIq pipeline mode",

"description": "ExploitIQ pipeline mode",

zvigrinberg · 2026-06-30T05:52:39Z

      "post": {
        "summary": "Receive analysis report",
-        "description": "Receives a completed analysis report from Morpheus",
+        "description": "Receives a completed analysis report from ExploitIq",


@TamarW0

Suggested change

"description": "Receives a completed analysis report from ExploitIq",

"description": "Receives a completed analysis report from ExploitIQ",

zvigrinberg · 2026-06-30T05:53:06Z

      "post": {
        "summary": "Create analysis request for an RPM package",
-        "description": "Accepts RPM name, version, release, architecture, and a CVE id; builds a Morpheus input with pipeline_mode rpm_package_checker and target_package, persists the report, and always submits it for analysis (same queue path as POST /reports/new with submit=true). Validation errors use the same field-mapped JSON shape as POST /products/upload-spdx (object \"errors\" mapping field names to messages).",
+        "description": "Accepts RPM name, version, release, architecture, and a CVE id; builds a ExploitIq input with pipeline_mode rpm_package_checker and target_package, persists the report, and always submits it for analysis (same queue path as POST /reports/new with submit=true). Validation errors use the same field-mapped JSON shape as POST /products/upload-spdx (object \"errors\" mapping field names to messages).",


@TamarW0

Suggested change

"description": "Accepts RPM name, version, release, architecture, and a CVE id; builds a ExploitIq input with pipeline_mode rpm_package_checker and target_package, persists the report, and always submits it for analysis (same queue path as POST /reports/new with submit=true). Validation errors use the same field-mapped JSON shape as POST /products/upload-spdx (object \"errors\" mapping field names to messages).",

"description": "Accepts RPM name, version, release, architecture, and a CVE id; builds an ExploitIQ input with pipeline_mode rpm_package_checker and target_package, persists the report, and always submits it for analysis (same queue path as POST /reports/new with submit=true). Validation errors use the same field-mapped JSON shape as POST /products/upload-spdx (object \"errors\" mapping field names to messages).",

zvigrinberg · 2026-06-30T06:00:16Z

-# Default timeout for async SPDX processing wait in REST tests.
-%test.morpheus.rest-test.spdx-timeout=10m
+# Default timeout for async SPDX processing wait in REST tests (test-only config, not part of exploit-iq namespace).
+%test.test.rest.spdx-timeout=10m


@TamarW0 Should be aligned with the rename you have made:

Suggested change

%test.test.rest.spdx-timeout=10m

%test.exploit-iq.rest-test.spdx-timeout=10m

@zvigrinberg why "rest-test"?

@zvigrinberg why "rest-test"?

Should be aligned with usages in the tests.

see https://github.com/RHEcosystemAppEng/agent-morpheus-client/pull/255/changes#r3496736063

actually changing that is failing the tests, it expect test.rest.spdx-timeout=10m

zvigrinberg · 2026-06-30T06:04:18Z

    "specversion": "1.0",
    "id": "",
-    "source": "agent.morpheus.client",
+    "source": "exploit-iq.client",


@TamarW0 This change might affect integration with exploitiq-component-syncer.
Although currently not being activated and not incorporated into product scan analysis, please coordinate that with @vbelouso So he will update the source name accordingly in the component syncer' event payload.

https://github.com/RHEcosystemAppEng/exploitiq-component-syncer/blob/main/events/event_single.json#L4

@vbelouso will update accordingly

zvigrinberg · 2026-06-30T06:55:09Z

-    public static final String CONFIG_KEY_EXTERNAL_BASE_URL = "morpheus.rest-test.external-base-url";
-    public static final String CONFIG_KEY_SPDX_TIMEOUT = "morpheus.rest-test.spdx-timeout";
+    public static final String CONFIG_KEY_EXTERNAL_BASE_URL = "exploit-iq.rest-test.external-base-url";
+    public static final String CONFIG_KEY_SPDX_TIMEOUT = "exploit-iq.rest-test.spdx-timeout";


@TamarW0 Here

here I didnt add the suffix "-test" but I guess it was missing .
fixed that

Rename ExploitIQ/Agent morpheus to Exploit Intelligence

358b3c6

TamarW0 requested review from IlonaShishov, rhartuv, vbelouso and zvigrinberg as code owners June 23, 2026 23:16

Tamar Weisskopf added 5 commits June 24, 2026 02:39

Rename ExploitIQ/Agent morpheus to Exploit Intelligence

ac7dee5

Rename ExploitIQ/Agent morpheus to Exploit Intelligence

159df22

Rename ExploitIQ/Agent morpheus to Exploit Intelligence

1785ccd

Rename ExploitIQ/Agent morpheus to Exploit Intelligence

62b54fc

Rename ExploitIQ/Agent morpheus to Exploit Intelligence

a35cc30

remane files and folders

e8d5f4d

rhartuv requested changes Jun 24, 2026

View reviewed changes

TamarW0 added the WIP label Jun 24, 2026

Tamar Weisskopf added 8 commits June 24, 2026 13:39

revert exploit intelligence

a5efc98

revert exploit intelligence

121064f

revert exploit intelligence

a6d603b

revert exploit intelligence

deef087

revert exploit intelligence

5deaa5c

Add defaults

8dbea24

Merge branch 'main' into APPENG-5387-branding

0717144

Remove unrelated changes

5bcd705

TamarW0 removed the WIP label Jun 25, 2026

zvigrinberg requested changes Jun 25, 2026

View reviewed changes

TamarW0 and others added 5 commits June 25, 2026 16:47

Update pom.xml

4be6d49

Co-authored-by: Zvi Grinberg <75700623+zvigrinberg@users.noreply.github.com>

Update docs/authentication.md

a160163

Co-authored-by: Zvi Grinberg <75700623+zvigrinberg@users.noreply.github.com>

Rename Agent morpheus to ExploitIQ

bff802b

Merge branch 'APPENG-5387-branding' of https://github.com/RHEcosystem…

b114ac0

…AppEng/agent-morpheus-client into APPENG-5387-branding

align exploit-iq configuration

0995989

Tamar Weisskopf added 22 commits June 28, 2026 05:49

revert this commit after fixing quay authentication

1c88a2d

revert this commit after fixing quay authentication

f35526e

revert deleted file

570fb28

revert deleted file

c46ee28

revert deleted file

46cc968

revert deleted file

1acd274

revert deleted file

5882e65

revert deleted file

1d84898

revert deleted file

db2da18

revert deleted file

e0b3c01

revert deleted file

444eb05

revert deleted file

4552480

fix

bf037cc

fix

9e79583

fix

cdc23cc

fix

3a0cf0e

fix

fb657dc

fix

0d52ac2

fix

4889faa

delete not relevant

7f507c4

correct image path

224dfbf

fix image path

0961f99

zvigrinberg requested changes Jun 28, 2026

View reviewed changes

Tamar Weisskopf added 2 commits June 28, 2026 18:01

fixes after review

e1a69be

fix for ui

550b8c5

zvigrinberg requested changes Jun 30, 2026

View reviewed changes

few review fixes

19bb637

zvigrinberg reviewed Jun 30, 2026

View reviewed changes

Tamar Weisskopf added 2 commits June 30, 2026 10:40

few review fixes

8773b7d

revert wrong fix

70fcf31

	#%dev.quarkus.rest-client.exploit-iq.url=http://localhost:${quarkus.wiremock.devservices.port}/exploit-Iq/scan
	#%dev.quarkus.rest-client.exploit-iq.url=http://localhost:${quarkus.wiremock.devservices.port}/exploit-iq/scan


	* Builds, persists, and submits ExploitIQ report requests for the RPM package checker pipeline.


	/** RPM package identity for ExploitIQ Agent RPM package checker pipeline. */


	"The exploit-iq.repository.reports-path must be a valid directory: " + reportsPath);


	* builds ExploitIQ input with {@link PipelineMode#RPM_PACKAGE_CHECKER}, persists, and submits to the queue.

	const { status: statusFilterValue, exploitIqStatus: ExploitIqStatusApiValue } =
	const { status: statusFilterValue, exploitIqStatus: exploitIqStatusApiValue } =

	%dev.quarkus.log.category."com.redhat.ecosystemappeng.exploit-iq".level=DEBUG
	%dev.quarkus.log.category."com.redhat.ecosystemappeng.exploitiq".level=DEBUG

	* Accepts RPM name, version, release, architecture, and a CVE id; builds a ExploitIq input with pipeline_mode rpm_package_checker and target_package, persists the report, and always submits it for analysis (same queue path as POST /reports/new with submit=true). Validation errors use the same field-mapped JSON shape as POST /products/upload-spdx (object "errors" mapping field names to messages).
	* Accepts RPM name, version, release, architecture, and a CVE id; builds an ExploitIq input with pipeline_mode rpm_package_checker and target_package, persists the report, and always submits it for analysis (same queue path as POST /reports/new with submit=true). Validation errors use the same field-mapped JSON shape as POST /products/upload-spdx (object "errors" mapping field names to messages).

	@Schema(name = "PipelineMode", description = "ExploitIq pipeline mode")
	@Schema(name = "PipelineMode", description = "ExploitIQ pipeline mode")

	Accepts RPM name, version, release, architecture, and a CVE id; builds a ExploitIq input with \
	Accepts RPM name, version, release, architecture, and a CVE id; builds an ExploitIQ input with \

	description = "Receives a completed analysis report from ExploitIq")
	description = "Receives a completed analysis report from ExploitIQ")

	/** RPM NEVRA persisted under ExploitIq `input.image.target_package`. */
	/** RPM NEVRA persisted under ExploitIQ `input.image.target_package`. */

	"description": "ExploitIq pipeline mode",
	"description": "ExploitIQ pipeline mode",

	"description": "Receives a completed analysis report from ExploitIq",
	"description": "Receives a completed analysis report from ExploitIQ",

	%test.test.rest.spdx-timeout=10m
	%test.exploit-iq.rest-test.spdx-timeout=10m

Uh oh!

Conversation

TamarW0 commented Jun 23, 2026

Uh oh!

vbelouso commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

TamarW0 commented Jun 24, 2026

Uh oh!

rhartuv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rhartuv Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zvigrinberg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zvigrinberg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vbelouso commented Jun 23, 2026 •

edited

Loading

rhartuv Jun 24, 2026 •

edited

Loading