Fetch Feature Flag with call to Feature Flag Gateway Api

.circleci/config.yml

@@ -19,7 +19,7 @@ parameters:
   go_version:
     type: string
     # https://go.dev/doc/devel/release
-    default: '1.24.11'
+    default: '1.25.6'
   aws_version:
     type: string
     # https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst

cliv2/.golangci.yaml

@@ -1,3 +1,5 @@
+version: '2'
+
 run:
   build-tags:
     - integration
@@ -115,7 +117,6 @@ linters:
     - gocyclo
     # TODO(godot): revisit
     #- godot
-    - gofmt
     # TODO(gofumpt): revisit
     #- gofumpt
     # TODO(goimports): revisit
@@ -149,7 +150,7 @@ linters:
     # TODO(stylecheck): revisit in a followup; some breaking API changes
     #- stylecheck
     # NOTE: removed tagliatelle as it conflicts too much with existing API wireformats
-    - tenv
+    - usetesting
     # TODO(testpackage): improve open vs closed-box testing in a followup
     #- testpackage
     - thelper
@@ -184,3 +185,7 @@ issues:
   include:
     - EXC0012
     - EXC0014
+
+formatters:
+  enable:
+    - gofmt

cliv2/Makefile

@@ -20,7 +20,7 @@ STATIC_NODE_BINARY = false
 
 # Build tools
 GO_BIN := $(shell pwd)/.bin
-OVERRIDE_GOCI_LINT_V := v1.64.8
+OVERRIDE_GOCI_LINT_V := v2.8.0
 SHELL := env PATH=$(GO_BIN):$(PATH) $(SHELL)
 
 # Make directories per convention

cliv2/cmd/cliv2/debug.go

@@ -64,9 +64,9 @@ func initDebugBuild() {
 
 		for i := range waitTimeInSeconds {
 			value := float64(waitTimeInSeconds-i) / float64(waitTimeInSeconds)
-			progress.UpdateProgress(value)
+			_ = progress.UpdateProgress(value)
 			time.Sleep(1 * time.Second)
 		}
-		progress.Clear()
+		_ = progress.Clear()
 	}
 }

cliv2/cmd/cliv2/main.go

@@ -1,8 +1,6 @@
 package main
 
 // !!! This import needs to be the first import, please do not change this !!!
-import _ "github.com/snyk/go-application-framework/pkg/networking/fips_enable"
-
 import (
 	"context"
 	"encoding/json"
@@ -26,20 +24,20 @@ import (
 	"github.com/snyk/cli-extension-os-flows/pkg/osflows"
 	"github.com/snyk/cli-extension-sbom/pkg/sbom"
 	"github.com/snyk/cli-extension-secrets/pkg/secrets"
+	"github.com/snyk/cli/cliv2/cmd/cliv2/behavior/legacy"
+	"github.com/snyk/cli/cliv2/internal/cliv2"
+	"github.com/snyk/cli/cliv2/internal/constants"
 	"github.com/snyk/container-cli/pkg/container"
 	"github.com/snyk/error-catalog-golang-public/cli"
 	"github.com/snyk/go-application-framework/pkg/analytics"
 	"github.com/snyk/go-application-framework/pkg/app"
 	"github.com/snyk/go-application-framework/pkg/configuration"
 	"github.com/snyk/go-application-framework/pkg/instrumentation"
 	"github.com/snyk/go-application-framework/pkg/logging"
+	_ "github.com/snyk/go-application-framework/pkg/networking/fips_enable"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 
-	"github.com/snyk/cli/cliv2/cmd/cliv2/behavior/legacy"
-	"github.com/snyk/cli/cliv2/internal/cliv2"
-	"github.com/snyk/cli/cliv2/internal/constants"
-
 	cliv2utils "github.com/snyk/cli/cliv2/internal/utils"
 
 	localworkflows "github.com/snyk/go-application-framework/pkg/local_workflows"
@@ -214,7 +212,7 @@ func sendAnalytics(analytics analytics.Analytics, debugLogger *zerolog.Logger) {
 		debugLogger.Err(err).Msg("Failed to send Analytics")
 		return
 	}
-	defer res.Body.Close()
+	defer func() { _ = res.Body.Close() }()
 
 	successfullySend := 200 <= res.StatusCode && res.StatusCode < 300
 	if successfullySend {
@@ -387,18 +385,19 @@ func createCommandsForWorkflows(rootCommand *cobra.Command, engine workflow.Engi
 		parentCommand.DisableFlagParsing = false
 
 		// special case for snyk code test
-		if currentCommandString == "code test" {
+		switch currentCommandString {
+		case "code test":
 			// to preserve backwards compatibility we will need to relax flag validation
 			parentCommand.FParseErrWhitelist.UnknownFlags = true
 
 			// use the special run command to ensure that the non-standard behavior of the command can be kept
 			parentCommand.RunE = runCodeTestCommand
-		} else if currentCommandString == "secrets test" {
+		case "secrets test":
 			// use the special run command to ensure that the non-standard behavior of the command can be kept
 			parentCommand.RunE = runSecretsTestCommand
-		} else if currentCommandString == "test" || currentCommandString == "monitor" {
+		case "test", "monitor":
 			legacy.SetupTestMonitorCommand(parentCommand)
-		} else if currentCommandString == "auth" {
+		case "auth":
 			parentCommand.RunE = runAuthCommand
 		}
 	}
@@ -479,7 +478,7 @@ func displayError(err error, userInterface ui.UserInterface, config configuratio
 			}
 
 			jsonErrorBuffer, _ := json.MarshalIndent(jsonError, "", "  ")
-			userInterface.Output(string(jsonErrorBuffer))
+			_ = userInterface.Output(string(jsonErrorBuffer))
 		} else {
 			if errors.Is(err, context.DeadlineExceeded) {
 				err = fmt.Errorf("command timed out")
@@ -632,19 +631,24 @@ func MainWithErrorCode() int {
 
 	// fallback to the legacy cli or show help
 	handleErrorResult := handleError(err)
-	if handleErrorResult == handleErrorFallbackToLegacyCLI {
+	switch handleErrorResult {
+	case handleErrorFallbackToLegacyCLI:
 		// when falling back to TS cli, make sure the
 		_ = rootCommand.ParseFlags(os.Args)
-		globalConfiguration.AddFlagSet(rootCommand.LocalFlags())
+		if err := globalConfiguration.AddFlagSet(rootCommand.LocalFlags()); err != nil {
+			globalLogger.Printf("failed to add flagset: %v", err)
+		}
 
 		globalLogger.Printf("Using Legacy CLI to serve the command. (reason: %v)", err)
 		err = defaultCmd(os.Args[1:])
-	} else if handleErrorResult == handleErrorShowHelp {
+	case handleErrorShowHelp:
 		err = help(nil, []string{})
+	case handleErrorUnhandled:
+		// no-op: leave err as-is so normal error handling happens
 	}
 
 	if err != nil {
-		err, errorList = processError(err, errorList)
+		errorList, err = processError(err, errorList)
 
 		for _, tempError := range errorList {
 			if tempError != nil {
@@ -679,7 +683,7 @@ func MainWithErrorCode() int {
 	return exitCode
 }
 
-func processError(err error, errorList []error) (error, []error) {
+func processError(err error, errorList []error) ([]error, error) {
 	// ensure to use generic fallback error catalog error if no other is available
 	err = decorateError(err)
 
@@ -704,7 +708,7 @@ func processError(err error, errorList []error) (error, []error) {
 	if exitCode := mapErrorToExitCode(err); exitCode != unsetExitCode {
 		err = createErrorWithExitCode(exitCode, err)
 	}
-	return err, errorList
+	return errorList, err
 }
 
 func setTimeout(config configuration.Configuration, onTimeout func()) {
@@ -716,7 +720,7 @@ func setTimeout(config configuration.Configuration, onTimeout func()) {
 	go func() {
 		const gracePeriodForSubProcesses = 3
 		<-time.After(time.Duration(timeout+gracePeriodForSubProcesses) * time.Second)
-		fmt.Fprintf(os.Stdout, "command timed out")
+		_, _ = fmt.Fprintf(os.Stdout, "command timed out")
 		onTimeout()
 	}()
 }

cliv2/go.mod

@@ -1,6 +1,6 @@
 module github.com/snyk/cli/cliv2
 
-go 1.24.4
+go 1.25.6
 
 require (
 	github.com/elazarl/goproxy v1.7.2
@@ -15,8 +15,8 @@ require (
 	github.com/snyk/cli-extension-iac v0.0.0-20260115084339-e0c36e4dffdf
 	github.com/snyk/cli-extension-iac-rules v0.0.0-20260115114457-a8ac3358ec57
 	github.com/snyk/cli-extension-mcp-scan v0.0.0-20260205184045-13a21a9b38c4
-	github.com/snyk/cli-extension-os-flows v0.0.0-20260202092920-2b2a978a1e44
-	github.com/snyk/cli-extension-sbom v0.0.0-20260123101300-130043bcdc06
+	github.com/snyk/cli-extension-os-flows v0.0.0-20260204163905-d454493d2360
+	github.com/snyk/cli-extension-sbom v0.0.0-20260205142136-30a08077bfe3
 	github.com/snyk/cli-extension-secrets v0.0.0-20260203145315-1a9eb913d2f0
 	github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7
 	github.com/snyk/error-catalog-golang-public v0.0.0-20260205094614-116c03822905
@@ -287,4 +287,6 @@ replace github.com/mattn/go-localereader v0.0.1 => github.com/mattn/go-localerea
 
 // replace github.com/snyk/cli-extension-mcp-scan => ../../cli-extension-mcp-scan
 
+// replace github.com/snyk/cli-extension-sbom => ../../cli-extension-sbom
+
 // replace github.com/snyk/cli-extension-secrets => ../../cli-extension-secrets

cliv2/go.sum

@@ -541,10 +541,10 @@ github.com/snyk/cli-extension-iac-rules v0.0.0-20260115114457-a8ac3358ec57 h1:8A
 github.com/snyk/cli-extension-iac-rules v0.0.0-20260115114457-a8ac3358ec57/go.mod h1:AFto63ozNmCXtKb5oTTD3Qz1jEl/HCqCVwpZCfTpSIE=
 github.com/snyk/cli-extension-mcp-scan v0.0.0-20260205184045-13a21a9b38c4 h1:NLo25mu6h56KX0bgYAhvrzvMOzxz/L/whqZhiptZfEU=
 github.com/snyk/cli-extension-mcp-scan v0.0.0-20260205184045-13a21a9b38c4/go.mod h1:i/EDskKxg68MtWaIOWFyataAMtcXOb/DQPLxT5jtLRE=
-github.com/snyk/cli-extension-os-flows v0.0.0-20260202092920-2b2a978a1e44 h1:TSnn2lDTtKxqm5JQrjVO5UTlDHCj3MQSP44dZlW2ulQ=
-github.com/snyk/cli-extension-os-flows v0.0.0-20260202092920-2b2a978a1e44/go.mod h1:s3HX7yjdyP5PYe+ZTMyrJA5wv6hCnmfGdh7Nk5la6tY=
-github.com/snyk/cli-extension-sbom v0.0.0-20260123101300-130043bcdc06 h1:qXcnwF3v9IobQzfEpUMTvm/+qlW6I/6QuTjf2o008G4=
-github.com/snyk/cli-extension-sbom v0.0.0-20260123101300-130043bcdc06/go.mod h1:nP8zYxLD7/dfbmfeVt+QJRjOK9LJ9+fKieY/Ph/iYb4=
+github.com/snyk/cli-extension-os-flows v0.0.0-20260204163905-d454493d2360 h1:R5Nu0PJvABfphPQAvZua8wvmSZdVHtLc5rDTtY2+kUY=
+github.com/snyk/cli-extension-os-flows v0.0.0-20260204163905-d454493d2360/go.mod h1:+fWqxiaIYf/fkszK5Iao+9sVf3KZUvmHIG7gtSb6eo0=
+github.com/snyk/cli-extension-sbom v0.0.0-20260205142136-30a08077bfe3 h1:+ZSmTRtr5WtzqixwxaGwGxx/MjbMOhq6WEydPXZocAk=
+github.com/snyk/cli-extension-sbom v0.0.0-20260205142136-30a08077bfe3/go.mod h1:Z8V+mh2Rrji1oM3rBlpSGFBuybF/a+JSHZNMTztasaU=
 github.com/snyk/cli-extension-secrets v0.0.0-20260203145315-1a9eb913d2f0 h1:LjYHZ+MnBJ9IT/zgU2qCq8+YS2qJFrKJMejOdFC6vCA=
 github.com/snyk/cli-extension-secrets v0.0.0-20260203145315-1a9eb913d2f0/go.mod h1:vj0PtB7L3tdiVLFDJtMuklDIjOBQdzoKQulnMv8/M/c=
 github.com/snyk/code-client-go v1.25.0 h1:1lcg6asMpMWwpaZLKVDdci3OrAv6rRoCsCcT8Ci/fUI=

cliv2/internal/cliv2/cliv2.go

@@ -112,7 +112,7 @@ func (c *CLI) Init() (err error) {
 		if _, err = os.Stat(c.CacheDirectory); os.IsNotExist(err) {
 			err = os.MkdirAll(c.CacheDirectory, utils.DIR_PERMISSION)
 			if err != nil {
-				return fmt.Errorf("Cache directory path is invalid: %w", err)
+				return fmt.Errorf("Cache directory path is invalid: %w", err) //nolint:staticcheck // user-facing error message
 			}
 		}
 	}
@@ -244,7 +244,8 @@ func (c *CLI) printVersion() {
 
 func (c *CLI) commandVersion(passthroughArgs []string) error {
 	if utils.Contains(passthroughArgs, "--json-file-output") {
-		return fmt.Errorf("The following option combination is not currently supported: version + json-file-output")
+		return fmt.Errorf("The following option combination is not currently supported: version + json-file-output") //nolint:staticcheck
+		// user-facing error message
 	} else {
 		c.printVersion()
 		return nil
@@ -317,7 +318,7 @@ func PrepareV1EnvironmentVariables(
 	if !integrationNameExists && !integrationVersionExists {
 		inputAsMap[constants.SNYK_INTEGRATION_NAME_ENV] = integrationName
 		inputAsMap[constants.SNYK_INTEGRATION_VERSION_ENV] = integrationVersion
-	} else if !(integrationNameExists && integrationVersionExists) {
+	} else if !integrationNameExists || !integrationVersionExists {
 		err = EnvironmentWarning{message: fmt.Sprintf("Partially defined environment, please ensure to provide both %s and %s together!", constants.SNYK_INTEGRATION_NAME_ENV, constants.SNYK_INTEGRATION_VERSION_ENV)}
 	}
 
@@ -528,12 +529,12 @@ func (c *CLI) Execute(proxyInfo *proxy.ProxyInfo, passThroughArgs []string) erro
 	var err error
 	handler := determineHandler(passThroughArgs)
 
-	switch {
-	case handler == V2_VERSION:
+	switch handler {
+	case V2_VERSION:
 		err = c.commandVersion(passThroughArgs)
-	case handler == V2_ABOUT:
+	case V2_ABOUT:
 		err = c.commandAbout(proxyInfo, passThroughArgs)
-	default:
+	case V1_DEFAULT:
 		err = c.executeV1Default(proxyInfo, passThroughArgs)
 	}
 
@@ -594,10 +595,7 @@ func GetErrorDisplayStatus(config configuration.Configuration) bool {
 	useSTDIO := config.GetBool(configuration.WORKFLOW_USE_STDIO)
 	jsonEnabled := config.GetBool(output_workflow.OUTPUT_CONFIG_KEY_JSON)
 
-	hasBeenDisplayed := false
-	if useSTDIO && jsonEnabled {
-		hasBeenDisplayed = true
-	}
+	hasBeenDisplayed := useSTDIO && jsonEnabled
 
 	return hasBeenDisplayed
 }

cliv2/internal/proxy/interceptor/legacyfeatureflaginterceptor.go

@@ -0,0 +1,78 @@
+package interceptor
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"regexp"
+
+	"github.com/elazarl/goproxy"
+	"github.com/snyk/go-application-framework/pkg/workflow"
+)
+
+const FeatureFlagShowMavenBuildScope = "internal_snyk_show_maven_scope_enabled"
+const FeatureFlagShowNpmBuildScope = "internal_snyk_show_npm_scope_enabled"
+
+type legacyFeatureFlagInterceptor struct {
+	requestCondition goproxy.ReqCondition
+	invocationCtx    workflow.InvocationContext
+}
+
+type featureFlagResponse struct {
+	OK bool `json:"ok"`
+}
+
+func (ni legacyFeatureFlagInterceptor) GetCondition() goproxy.ReqCondition {
+	return ni.requestCondition
+}
+
+// GetHandler for legacyFeatureFlagInterceptor will re-route all registry requests from the proxy to the configured feature flag values.
+// This ensures that we can control feature flag values for the legacy CLI from the CLIv2 configuration.
+// Currently, only the "show-maven-build-scope" and "show-npm-scope" feature flags are supported.
+func (ni legacyFeatureFlagInterceptor) GetHandler() goproxy.FuncReqHandler {
+	return func(req *http.Request, proxyCtx *goproxy.ProxyCtx) (*http.Request, *http.Response) {
+		ni.invocationCtx.GetEnhancedLogger().Printf("legacyFeatureFlagInterceptor handling request for %s", req.URL.Path)
+		var configKey string
+		switch req.URL.Path {
+		case "/v1/cli-config/feature-flags/show-maven-build-scope":
+			configKey = FeatureFlagShowMavenBuildScope
+		case "/v1/cli-config/feature-flags/show-npm-scope":
+			configKey = FeatureFlagShowNpmBuildScope
+		default:
+			return req, nil
+		}
+
+		enabled := ni.invocationCtx.
+			GetConfiguration().
+			GetBool(configKey)
+
+		payload := featureFlagResponse{OK: enabled}
+		b, err := json.Marshal(payload)
+		if err != nil {
+			return req, nil
+		}
+
+		resp := &http.Response{
+			StatusCode: http.StatusOK,
+			Status:     "200 OK",
+			Header:     make(http.Header),
+			Body:       io.NopCloser(bytes.NewReader(b)),
+			Request:    req,
+		}
+		resp.Header.Set("Content-Type", "application/json")
+		ni.invocationCtx.GetEnhancedLogger().Printf("legacyFeatureFlagInterceptor response for %s is %v", configKey, enabled)
+
+		return req, resp
+	}
+}
+
+func NewLegacyFeatureFlagInterceptor(invocationCtx workflow.InvocationContext) Interceptor {
+	i := legacyFeatureFlagInterceptor{
+		requestCondition: goproxy.UrlMatches(
+			regexp.MustCompile(`/cli-config/feature-flags/(show-maven-build-scope|show-npm-scope)/?(?:\?.*)?$`),
+		),
+		invocationCtx: invocationCtx,
+	}
+	return i
+}