Skip to content

Eclipse Devassist | Ignore revive funtionality (AST-163512) - #272

Merged
cx-aniket-shinde merged 103 commits into
feature/devassist_integrationfrom
feature/Copy-ignore-Revive
Aug 26, 2026
Merged

Eclipse Devassist | Ignore revive funtionality (AST-163512)#272
cx-aniket-shinde merged 103 commits into
feature/devassist_integrationfrom
feature/Copy-ignore-Revive

Conversation

@cx-aniket-shinde

Copy link
Copy Markdown
Collaborator

By submitting a PR to this repository, you agree to the terms within the Checkmarx Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Describe the purpose of this PR along with any background information and the impacts of the proposed change.

References

Include supporting link to GitHub Issue/PR number

Testing

Describe how this change was tested. Be specific about anything not tested and reasons why. If this solution has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

Please include any manual steps for testing end-to-end or functionality not covered by unit/integration tests.

Checklist

  • I have added documentation for new/changed functionality in this PR (if applicable).
  • All active GitHub checks for tests, formatting, and security are passing
  • The correct base branch is being used

cx-aniket-shinde and others added 30 commits August 7, 2026 23:57
- Remove McpInstallService from PreferencesPage (common-lib)
- Create AuthenticationListener in devassist-lib configuration
- Register listener in McpInstallService static block
- Create IProjectLifecycleListener interface in common-lib
- ProjectLifecycleListener implements interface
- Update PluginStartup.getProjectListener() to return interface
- MCP auto-install now triggered by authentication event (devassist-lib)
- Workspace scan triggered after login via interface

Architecture: common-lib has no devassist imports, clean separation.
- Create IAuthenticationSuccessHandler interface in common-lib
- Move welcome dialog logic to AuthenticationSuccessHandler in devassist-lib
- PreferencesPage delegates to handler via Preferences registry
- Removes WelcomeDialog import from common-lib PreferencesPage
- Handlers registered in McpInstallService static block

Architecture: common-lib has NO devassist imports, clean separation.
- Create ISettingsChangeNotifier interface in common-lib
- Create SettingsChangeNotifier implementation in main plugin
- Register notifier in PluginStartup static block
- Remove PluginStartup and PluginUtils imports from common-lib PreferencesPage
- Use notifier instead of direct event broker calls

Architecture: common-lib has NO main plugin imports, clean separation.
devassist-lib should depend on common-lib for JAR access, not duplicate them.
- Remove lib/ references from devassist-lib MANIFEST.MF and build.properties
- Remove lib/ references from devassist-lib .classpath
- devassist-lib Require-Bundle: common-lib provides JAR access
- Revert .gitignore to only track main plugin lib/
Major improvements to HTML rich hover display:
1. Fixed O(n²) duplicate detection using HashSet instead of ArrayList
2. Added performance monitoring to detect slow hover operations (>100ms)
3. Improved error handling with proper exception catching during annotation iteration
4. Centralized HTML escaping to HtmlEscapeUtil utility class
5. Enhanced HTML styling with severity-based colors, proper spacing, and fonts
6. Added visual improvements: separator styling, font sizes, color hierarchy
7. Optimized annotation model access with better error recovery

Performance fixes:
- Replaced O(n) contains() checks with O(1) HashSet lookups
- Added timeout monitoring (logs if hover takes >100ms)
- Proper exception handling without blocking UI thread

HTML/UX improvements:
- Severity colors: Malicious (red), Critical (dark red), High (orange), Medium (yellow), Low (green)
- Better visual hierarchy with font sizes and weights
- Improved spacing and divider styling
- Action links now styled with blue color and cursor pointer indicator
- Font family and size defaults for consistent rendering

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Hover now shows:
- Title (orange/red)
- Description
- Informational action links (Fix, View Details, Ignore, Copy Details)
- Helper text: "Press Ctrl+1 for Quick Fix actions"

The action links are text-only (Eclipse hovers can't capture clicks).
Actual implementations are in Quick Fix system via CheckmarxMarkerResolutionGenerator.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Hover now displays:
- Title (orange) + Description
- Four styled action buttons: Fix with AI, Details, Ignore, Copy
- Buttons are clickable and trigger corresponding actions
- Uses HTML button elements with action: protocol URL handlers
- LocationListener intercepts clicks via reflection on internal Browser

Next: Hook action handlers to actual Quick Fix implementations.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Removed button styling (background, borders, padding)
- Now displays as simple text links: blue + underlined
- Links are clickable via LocationListener on action: protocol URLs
- Simpler, cleaner appearance matching typical hover link styles

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
The HoverControlCreator (small preview) had the action handler set up, but the
PresenterControlCreator (large interactive popup) did not. When the user moved
the mouse into the hover popup, JFace replaced it with the PresenterControlCreator,
which had no LocationListener to intercept action: protocol URLs. Now both control
creators set up the handler, so clicks work on both the preview and the interactive popup.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Changed action links from href-based to onclick-based with window.location
assignment. This ensures LocationListener receives location change events for
action: protocol URLs. Added debug logging to verify LocationListener setup and
invocation.

Fixes: Links now trigger handleHoverAction() when clicked on both preview and
interactive popups.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Changed from custom protocol (action:) to URL fragment (#action:).
SWT Browser navigates to about:blank#action:fix on link click, and
LocationListener can now parse the fragment to extract the action name.

Fixes: Clicks on action links now trigger handleHoverAction() correctly.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
cx-aniket-shinde and others added 4 commits August 25, 2026 19:26
Added a total count label that displays the number of ignored findings,
similar to how the main Findings window shows total entries in the tree.

Changes:
- Added 'Ignored Findings (N)' label at the top of the ignored findings list
- Label is bold and only visible when there are entries (hidden when 0)
- Count updates dynamically when entries are added/revived
- Font properly disposed on view disposal to prevent memory leaks

Example display:
- 0 entries: No label shown (clean empty state)
- 5 entries: 'Ignored Findings (5)' displayed in bold above the list

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Moved the ignored findings count to the tab title itself, matching the
'Checkmarx One Assist Findings 19' pattern, instead of showing it as a
label in the view content.

Changes:
- Removed label from view content area
- Updated setPartName() in refreshTable() to show count in tab title
- Display format: 'Ignored Findings (N)' when entries exist
- Display format: 'Ignored Findings' when count is 0
- Count updates dynamically when entries are added/revived

Example:
- Tab shows: 'Ignored Findings (1)' instead of 'Ignored Findings'

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
The Welcome dialog was cutting off the last feature statement
'Triage fix issues directly in the editor' because the dialog height
was too small to accommodate all 4 main feature bullets plus the
feature card and scanner image.

Changes:
- Increased DIALOG_HEIGHT from 530 to 620 pixels
- Now all 4 main feature statements are visible:
  1. Run SAST, SCA, IaC, Containers and Secrets scans.
  2. Create a new Checkmarx branch from your local workspace.
  3. Preview or rescan before committing.
  4. Triage fix issues directly in the editor.

The dialog remains non-resizable to ensure consistent presentation.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
@cx-aniket-shinde cx-aniket-shinde changed the title Feature/copy ignore revive Eclipse Devassist | Ignore revive funtionality (AST-163512) Aug 25, 2026
Comment thread common-lib/src/com/checkmarx/eclipse/common/runner/Authenticator.java Outdated
Comment thread compile_errors.txt Outdated
Comment thread devassist-lib/plugin.xml Outdated
Comment thread devassist-lib/src/com/checkmarx/eclipse/devassist/utils/DateFormatUtil.java Outdated
Comment thread devassist-lib/src/com/checkmarx/eclipse/devassist/utils/DevAssistUtils.java Outdated
Signed-off-by: Anand Nandeshwar <73646287+cx-anand-nandeshwar@users.noreply.github.com>
@cx-anand-nandeshwar
cx-anand-nandeshwar force-pushed the feature/Copy-ignore-Revive branch from 1ceea88 to be6890d Compare August 25, 2026 19:04
cx-aniket-shinde and others added 11 commits August 26, 2026 08:45
When a project opened before user authentication, ProjectLifecycleListener
would skip initialization, leaving ProblemHolderService null. Later, when
real-time scans ran after authentication, ResultPublisher couldn't publish
results because the service wasn't available.

RealTimeScanJob now lazily initializes ProblemHolderService on first scan,
matching the pattern already used for ScannerRegistry and DevAssistScanStateHolder.

This ensures scan results are properly published to the Findings window.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
@stepsecurity-app

Copy link
Copy Markdown
Contributor

Security Policy Alert: Secret Policy Violation

This workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch.

Secret references detected:

  • secrets.AST_RND_SCANS_BASE_URI at line 20
  • secrets.AST_RND_SCANS_TENANT at line 21
  • secrets.AST_RND_SCANS_CLIENT_ID at line 22
  • secrets.AST_RND_SCANS_CLIENT_SECRET at line 23

To approve this workflow, please add the workflows-approved label to this PR.

Note: The label must be added by someone other than the PR author (cx-aniket-shinde) or automation bots to ensure proper security review.

After the label is added, you can re-run the blocked workflow to proceed.

This workflow will be automatically approved once merged into the default branch.

For more information, see StepSecurity's Secret Exfiltration Policy documentation.

@cx-anand-nandeshwar cx-anand-nandeshwar left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good

@cx-aniket-shinde
cx-aniket-shinde merged commit be3f09c into feature/devassist_integration Aug 26, 2026
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants