Fetch Feature Flag with call to Feature Flag Gateway Api

[brew42]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (N/A)
• Links to automated tests covering new functionality (N/A)
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (N/A - experimental feature)
• Includes product update to be announced in the next stable release notes (N/A - experimental feature)

What does this PR do?

Adds an interceptor for the registry call to fetch feature flags 'show-maven-build-scope' and ''show-npm-scope' from the gaf configuration
See /cli/cliv2/internal/proxy/interceptor/registryinjector.go

Pass this feature flag to the maven and npm plugins -> Plugin call to feature flag gateway from src/lib/snyk-test/index.js and pass flags to src/lib/plugins/get-single-plugin-result.ts where the mvn plugin is invoked with feature flag.

Where should the reviewer start?

/cli/cliv2/internal/proxy/interceptor/registryinjector.go
New Interceptor

src/lib/snyk-test/index.js
Call Feature Flag Gateway and set flag in featureFlags

src/cli/commands/monitor/index.js
Call Feature Flag Gateway and set flag in featureFlags

src/lib/plugins/get-single-plugin-result.ts
Update to pass feature flag to maven/npm plugin

How should this be manually tested?

-- Maven--
Generate sbom for maven project

Run sbom generation for org with and without the show-maven-build-scope feature flag enabled in flipt.
cli/binary-releases/snyk-macos-arm64 sbom --format cyclonedx1.6+json --debug

Run sbom generation for user authenticated with group service account token. Confirm default organization is passed to feature flag call scope is generated as expected.
cli/binary-releases/snyk-macos-arm64 auth <token>

Flag enabled - sbom output contains scope

{
            "bom-ref": "2-com.someorg.com@2.0.4",
            "type": "library",
            "group": "com.someorg.com",
            "name": "com.someorg.com,
            "version": "2.0.4",
            "purl": "pkg:maven/com.someorg@2.0.4",
            "properties": [
                {
                    "name": "snyk:maven:build_scope",
                    "value": "compile"
                }
            ]
        },

Flag disabled - sbom output does not contain scope

{
            "bom-ref": "2-com.someorg@2.0.4",
            "type": "library",
            "group": "com.someorg",
            "name": "com.someorg",
            "version": "2.0.4",
            "purl": "pkg:maven/com.someorg@2.0.4",
            "properties": [
            ]
        },

-- Npm--
Generate sbom for npm project
cli/binary-releases/snyk-macos-arm64 sbom --format cyclonedx1.6+json --debug

Flag enabled - sbom output contains scope

{
  "bom-ref": "3-accepts@2.0.0",
  "type": "library",
  "name": "accepts",
  "version": "2.0.0",
  "licenses": [
    {
      "expression": "MIT"
    }
  ],
  "purl": "pkg:npm/accepts@2.0.0",
  "properties": [
    {
      "name": "snyk:npm:scope",
      "value": "prod"
    }
  ]
}

Flag disabled - sbom output does not contain scope

{
      "bom-ref": "9-content-type@1.0.5",
      "type": "library",
      "name": "content-type",
      "version": "1.0.5",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:npm/content-type@1.0.5"
    }

Repeat with snyk monitor and test commands.

Further Testing
Verify instrumentation correctly record show scope flag information. Data written to analytics -> extension
Analytics data for sbom
"sbom::show-maven-build-scope":true,"sbom::show-npm-scope":true

Analytics data for monitor
"monitor::show-maven-build-scope":true,"monitor::show-npm-scope":true

Analytics data for test
"test::show-maven-build-scope":true,"test::show-npm-scope":true

What's the product update that needs to be communicated to CLI users?

Sbom generated output will contain maven scope information for those organizations with the 'show-maven-build-scope' feature flag enabled

Sbom generated output will contain npm scope information for those organizations with the 'show-npm-scope' feature flag enabled

Associated PRs to cli-extensions and gaf

Sbom
snyk/cli-extension-sbom#169
snyk/cli-extension-sbom#164

OS Flow
snyk/cli-extension-os-flows#201

GAF
snyk/go-application-framework#520
snyk/go-application-framework#525

[brew42]

@PeterSchafer added unit test to verify flags are passed in set to plugin call

[PeterSchafer]

Question: Is the golang upgrade this intentional?