Remove frogbot-config.yml functionality - use only environment variables

eyalk007 · eyalk007 · commit 555d703995aa · 2025-11-03T15:44:32.000+02:00
diff --git a/docs/templates/jfrog-pipelines/pipelines-dotnet.yml b/docs/templates/jfrog-pipelines/pipelines-dotnet.yml
@@ -95,8 +95,7 @@ pipelines:
             # JF_AVOID_EXTRA_MESSAGES: "TRUE"
 
             ###########################################################################
-            ##   If your project uses a 'frogbot-config.yml' file, you should define ##
-            ##   the following variables inside the file, instead of here.           ##
+            ##   All configuration is now done via environment variables             ##
             ###########################################################################
 
             # [Mandatory]
@@ -109,7 +108,7 @@ pipelines:
 
             # [Mandatory if the two conditions below are met]
             # 1. The project uses yarn 2, NuGet or .NET Core to download its dependencies
-            # 2. The `installCommand` variable isn't set in your frogbot-config.yml file.
+            # 2. The `installCommand` variable isn't set via the JF_INSTALL_DEPS_CMD environment variable.
             #
             # The command that installs the project dependencies (e.g "nuget restore")
             # JF_INSTALL_DEPS_CMD: ""
@@ -144,8 +143,7 @@ pipelines:
 
             # [Optional]
             # Frogbot will download the project dependencies if they're not cached locally. To download the
-            # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no
-            # need to set this value, if it is set in the frogbot-config.yml file.
+            # dependencies from a virtual repository in Artifactory, set the name of the repository.
             # JF_DEPS_REPO: ""
 
             # [Optional]
diff --git a/docs/templates/jfrog-pipelines/pipelines-go.yml b/docs/templates/jfrog-pipelines/pipelines-go.yml
@@ -95,8 +95,7 @@ pipelines:
             # JF_AVOID_EXTRA_MESSAGES: "TRUE"
 
             ###########################################################################
-            ##   If your project uses a 'frogbot-config.yml' file, you should define ##
-            ##   the following variables inside the file, instead of here.           ##
+            ##   All configuration is now done via environment variables             ##
             ###########################################################################
 
             # [Mandatory]
@@ -137,8 +136,7 @@ pipelines:
 
             # [Optional]
             # Frogbot will download the project dependencies if they're not cached locally. To download the
-            # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no
-            # need to set this value, if it is set in the frogbot-config.yml file.
+            # dependencies from a virtual repository in Artifactory, set the name of the repository.
             # JF_DEPS_REPO: ""
 
             # [Optional, default: "."]
diff --git a/docs/templates/jfrog-pipelines/pipelines-gradle.yml b/docs/templates/jfrog-pipelines/pipelines-gradle.yml
@@ -95,8 +95,7 @@ pipelines:
             # JF_AVOID_EXTRA_MESSAGES: "TRUE"
 
             ###########################################################################
-            ##   If your project uses a 'frogbot-config.yml' file, you should define ##
-            ##   the following variables inside the file, instead of here.           ##
+            ##   All configuration is now done via environment variables             ##
             ###########################################################################
 
             # [Mandatory]
@@ -133,8 +132,7 @@ pipelines:
 
             # [Optional]
             # Frogbot will download the project dependencies if they're not cached locally. To download the
-            # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no
-            # need to set this value, if it is set in the frogbot-config.yml file.
+            # dependencies from a virtual repository in Artifactory, set the name of the repository.
             # JF_DEPS_REPO: ""
 
             # [Optional, default: "."]
diff --git a/docs/templates/jfrog-pipelines/pipelines-maven.yml b/docs/templates/jfrog-pipelines/pipelines-maven.yml
@@ -95,8 +95,7 @@ pipelines:
             # JF_AVOID_EXTRA_MESSAGES: "TRUE"
 
             ###########################################################################
-            ##   If your project uses a 'frogbot-config.yml' file, you should define ##
-            ##   the following variables inside the file, instead of here.           ##
+            ##   All configuration is now done via environment variables             ##
             ###########################################################################
 
             # [Mandatory]
@@ -117,8 +116,7 @@ pipelines:
 
             # [Optional]
             # Frogbot will download the project dependencies if they're not cached locally. To download the
-            # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no
-            # need to set this value, if it is set in the frogbot-config.yml file.
+            # dependencies from a virtual repository in Artifactory, set the name of the repository.
             # JF_DEPS_REPO: ""
 
             # [Optional, default: "."]
diff --git a/docs/templates/jfrog-pipelines/pipelines-npm.yml b/docs/templates/jfrog-pipelines/pipelines-npm.yml
@@ -95,8 +95,7 @@ pipelines:
             # JF_AVOID_EXTRA_MESSAGES: "TRUE"
 
             ###########################################################################
-            ##   If your project uses a 'frogbot-config.yml' file, you should define ##
-            ##   the following variables inside the file, instead of here.           ##
+            ##   All configuration is now done via environment variables             ##
             ###########################################################################
 
             # [Mandatory]
@@ -109,7 +108,7 @@ pipelines:
 
             # [Mandatory if the two conditions below are met]
             # 1. The project uses yarn 2, NuGet or .NET Core to download its dependencies
-            # 2. The `installCommand` variable isn't set in your frogbot-config.yml file.
+            # 2. The `installCommand` variable isn't set via the JF_INSTALL_DEPS_CMD environment variable.
             #
             # The command that installs the project dependencies (e.g "nuget restore")
             # JF_INSTALL_DEPS_CMD: ""
@@ -144,8 +143,7 @@ pipelines:
 
             # [Optional]
             # Frogbot will download the project dependencies if they're not cached locally. To download the
-            # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no
-            # need to set this value, if it is set in the frogbot-config.yml file.
+            # dependencies from a virtual repository in Artifactory, set the name of the repository.
             # JF_DEPS_REPO: ""
 
             # [Optional, default: "."]
diff --git a/docs/templates/jfrog-pipelines/pipelines-pip.yml b/docs/templates/jfrog-pipelines/pipelines-pip.yml
@@ -34,7 +34,7 @@ pipelines:
           environmentVariables:
             # [Mandatory if the two conditions below are met]
             # 1. The project uses yarn 2, NuGet or .NET Core to download its dependencies
-            # 2. The `installCommand` variable isn't set in your frogbot-config.yml file.
+            # 2. The `installCommand` variable isn't set via the JF_INSTALL_DEPS_CMD environment variable.
             #
             # The command that installs the project dependencies (e.g "nuget restore")
             # JF_INSTALL_DEPS_CMD: ""
@@ -102,8 +102,7 @@ pipelines:
             # JF_AVOID_EXTRA_MESSAGES: "TRUE"
 
             ###########################################################################
-            ##   If your project uses a 'frogbot-config.yml' file, you should define ##
-            ##   the following variables inside the file, instead of here.           ##
+            ##   All configuration is now done via environment variables             ##
             ###########################################################################
 
             # [Mandatory]
@@ -120,8 +119,7 @@ pipelines:
 
             # [Optional]
             # Frogbot will download the project dependencies if they're not cached locally. To download the
-            # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no
-            # need to set this value, if it is set in the frogbot-config.yml file.
+            # dependencies from a virtual repository in Artifactory, set the name of the repository.
             # JF_DEPS_REPO: ""
 
             # [Optional, default: "."]
diff --git a/docs/templates/jfrog-pipelines/pipelines-pipenv.yml b/docs/templates/jfrog-pipelines/pipelines-pipenv.yml
@@ -95,8 +95,7 @@ pipelines:
             # JF_AVOID_EXTRA_MESSAGES: "TRUE"
 
             ###########################################################################
-            ##   If your project uses a 'frogbot-config.yml' file, you should define ##
-            ##   the following variables inside the file, instead of here.           ##
+            ##   All configuration is now done via environment variables             ##
             ###########################################################################
 
             # [Mandatory]
@@ -125,8 +124,7 @@ pipelines:
 
             # [Optional]
             # Frogbot will download the project dependencies if they're not cached locally. To download the
-            # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no
-            # need to set this value, if it is set in the frogbot-config.yml file.
+            # dependencies from a virtual repository in Artifactory, set the name of the repository.
             # JF_DEPS_REPO: ""
 
             # [Optional, default: "FALSE"]
diff --git a/docs/templates/jfrog-pipelines/pipelines-poetry.yml b/docs/templates/jfrog-pipelines/pipelines-poetry.yml
@@ -95,8 +95,7 @@ pipelines:
             # JF_AVOID_EXTRA_MESSAGES: "TRUE"
 
             ###########################################################################
-            ##   If your project uses a 'frogbot-config.yml' file, you should define ##
-            ##   the following variables inside the file, instead of here.           ##
+            ##   All configuration is now done via environment variables             ##
             ###########################################################################
 
             # [Mandatory]
@@ -113,8 +112,7 @@ pipelines:
 
             # [Optional]
             # Frogbot will download the project dependencies if they're not cached locally. To download the
-            # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no
-            # need to set this value, if it is set in the frogbot-config.yml file.
+            # dependencies from a virtual repository in Artifactory, set the name of the repository.
             # JF_DEPS_REPO: ""
 
             # [Optional, default: "."]
diff --git a/docs/templates/jfrog-pipelines/pipelines-yarn2.yml b/docs/templates/jfrog-pipelines/pipelines-yarn2.yml
@@ -34,7 +34,7 @@ pipelines:
           environmentVariables:
             # [Mandatory if the two conditions below are met]
             # 1. The project uses yarn 2, NuGet or .NET Core to download its dependencies
-            # 2. The `installCommand` variable isn't set in your frogbot-config.yml file.
+            # 2. The `installCommand` variable isn't set via the JF_INSTALL_DEPS_CMD environment variable.
             #
             # The command that installs the project dependencies (e.g "nuget restore")
             # JF_INSTALL_DEPS_CMD: ""
@@ -102,8 +102,7 @@ pipelines:
             # JF_AVOID_EXTRA_MESSAGES: "TRUE"
 
             ###########################################################################
-            ##   If your project uses a 'frogbot-config.yml' file, you should define ##
-            ##   the following variables inside the file, instead of here.           ##
+            ##   All configuration is now done via environment variables             ##
             ###########################################################################
 
             # [Mandatory]
@@ -120,8 +119,7 @@ pipelines:
 
             # [Optional]
             # Frogbot will download the project dependencies if they're not cached locally. To download the
-            # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no
-            # need to set this value, if it is set in the frogbot-config.yml file.
+            # dependencies from a virtual repository in Artifactory, set the name of the repository.
             # JF_DEPS_REPO: ""
 
             # [Optional, default: "."]
diff --git a/go.mod b/go.mod
@@ -20,7 +20,6 @@ require (
 	github.com/urfave/cli/v2 v2.27.4
 	github.com/xeipuuv/gojsonschema v1.2.0
 	golang.org/x/exp v0.0.0-20250911091902-df9299821621
-	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
diff --git a/go.sum b/go.sum
@@ -430,7 +430,6 @@ gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/scanpullrequest/scanpullrequest.go b/scanpullrequest/scanpullrequest.go
@@ -24,8 +24,8 @@ import (
 
 const (
 	SecurityIssueFoundErr = "issues were detected by Frogbot\n" +
-		"You can avoid marking the Frogbot scan as failed by setting failOnSecurityIssues to false in the " + utils.FrogbotConfigFile + " file or by setting the " + utils.FailOnSecurityIssuesEnv + " environment variable to false\n" +
-		"Note that even if failOnSecurityIssues/" + utils.FailOnSecurityIssuesEnv + " are set to false, but a security violation with 'fail-pull-request' rule is found, Frogbot scan will fail as well"
+		"You can avoid marking the Frogbot scan as failed by setting the " + utils.FailOnSecurityIssuesEnv + " environment variable to false\n" +
+		"Note that even if " + utils.FailOnSecurityIssuesEnv + " is set to false, but a security violation with 'fail-pull-request' rule is found, Frogbot scan will fail as well"
 	noGitHubEnvErr                       = "frogbot did not scan this PR, because a GitHub Environment named 'frogbot' does not exist. Please refer to the Frogbot documentation for instructions on how to create the Environment"
 	noGitHubEnvReviewersErr              = "frogbot did not scan this PR, because the existing GitHub Environment named 'frogbot' doesn't have reviewers selected. Please refer to the Frogbot documentation for instructions on how to create the Environment"
 	analyticsScanPrScanType              = "PR"
diff --git a/scanpullrequest/scanpullrequest_test.go b/scanpullrequest/scanpullrequest_test.go
@@ -346,9 +346,7 @@ func prepareConfigAndClient(t *testing.T, xrayVersion, xscVersion, configPath st
 	client, err := vcsclient.NewClientBuilder(vcsutils.GitLab).ApiEndpoint(server.URL).Token("123456").Build()
 	assert.NoError(t, err)
 
-	configData, err := utils.ReadConfigFromFileSystem(configPath)
-	assert.NoError(t, err)
-	configAggregator, err := utils.BuildRepoAggregator(xrayVersion, xscVersion, client, configData, gitTestParams, &serverParams, utils.ScanPullRequest)
+	configAggregator, err := utils.BuildRepoAggregator(xrayVersion, xscVersion, client, gitTestParams, &serverParams, utils.ScanPullRequest)
 	assert.NoError(t, err)
 
 	return configAggregator, client
diff --git a/scanrepository/scanmultiplerepositories_test.go b/scanrepository/scanmultiplerepositories_test.go
@@ -52,17 +52,14 @@ func TestScanAndFixRepos(t *testing.T) {
 		},
 	}
 
-	configData, err := utils.ReadConfigFromFileSystem(testScanMultipleRepositoriesConfigPath)
-	assert.NoError(t, err)
-
 	testDir, cleanup := utils.CopyTestdataProjectsToTemp(t, "scanmultiplerepositories")
 	defer func() {
 		assert.NoError(t, os.Chdir(baseWd))
 		cleanup()
 	}()
 
 	utils.CreateDotGitWithCommit(t, testDir, port, testRepositories...)
-	configAggregator, err := utils.BuildRepoAggregator(xrayVersion, xscVersion, client, configData, &gitTestParams, &serverParams, utils.ScanMultipleRepositories)
+	configAggregator, err := utils.BuildRepoAggregator(xrayVersion, xscVersion, client, &gitTestParams, &serverParams, utils.ScanMultipleRepositories)
 	assert.NoError(t, err)
 
 	var cmd = ScanMultipleRepositories{dryRun: true, dryRunRepoPath: testDir}
diff --git a/scanrepository/scanrepository_test.go b/scanrepository/scanrepository_test.go
@@ -192,19 +192,11 @@ func TestScanRepositoryCmd_Run(t *testing.T) {
 			client, err := vcsclient.NewClientBuilder(vcsutils.GitHub).ApiEndpoint(server.URL).Token("123456").Build()
 			assert.NoError(t, err)
 
-			// Read config or resolve to default
-			var configData []byte
-			if test.configPath != "" {
-				configData, err = utils.ReadConfigFromFileSystem(test.configPath)
-				assert.NoError(t, err)
-			} else {
-				configData = []byte{}
-				// Manual set of "JF_GIT_BASE_BRANCH"
-				gitTestParams.Branches = []string{"master"}
-			}
+			// Manual set of "JF_GIT_BASE_BRANCH"
+			gitTestParams.Branches = []string{"master"}
 
 			utils.CreateDotGitWithCommit(t, testDir, port, test.testName)
-			configAggregator, err := utils.BuildRepoAggregator(xrayVersion, xscVersion, client, configData, &gitTestParams, &serverParams, utils.ScanRepository)
+			configAggregator, err := utils.BuildRepoAggregator(xrayVersion, xscVersion, client, &gitTestParams, &serverParams, utils.ScanRepository)
 			assert.NoError(t, err)
 			// Run
 			var cmd = ScanRepositoryCmd{XrayVersion: xrayVersion, XscVersion: xscVersion, dryRun: true, dryRunRepoPath: testDir}
@@ -335,9 +327,8 @@ pr body
 			client, err := vcsclient.NewClientBuilder(vcsutils.GitHub).ApiEndpoint(server.URL).Token("123456").Build()
 			assert.NoError(t, err)
 			// Load default configurations
-			var configData []byte
 			gitTestParams.Branches = []string{"master"}
-			configAggregator, err := utils.BuildRepoAggregator(xrayVersion, xscVersion, client, configData, gitTestParams, &serverParams, utils.ScanRepository)
+			configAggregator, err := utils.BuildRepoAggregator(xrayVersion, xscVersion, client, gitTestParams, &serverParams, utils.ScanRepository)
 			assert.NoError(t, err)
 			// Run
 			var cmd = ScanRepositoryCmd{dryRun: true, dryRunRepoPath: testDir}
diff --git a/schema/schemas_test.go b/schema/schemas_test.go
@@ -27,8 +27,7 @@ func TestFrogbotSchema(t *testing.T) {
 	assert.NoError(t, err)
 	schemaLoader := gojsonschema.NewBytesLoader(schema)
 
-	// Validate config in this repository
-	validateYamlSchema(t, schemaLoader, filepath.Join("..", ".frogbot", "frogbot-config.yml"), "")
+	// Config files are no longer used - skip repository config validation
 
 	// Validate all frogbot configs in commands/testdata/config
 	validateYamlsInDirectory(t, filepath.Join("..", "testdata", "config"), schemaLoader)
diff --git a/utils/consts.go b/utils/consts.go
@@ -55,7 +55,7 @@ const (
 	//#nosec G101 -- not a secret
 	PullRequestSecretCommentsEnv = "JF_PR_SHOW_SECRETS_COMMENTS"
 
-	// Repository environment variables - Ignored if the frogbot-config.yml file is used
+	// Repository environment variables
 	InstallCommandEnv   = "JF_INSTALL_DEPS_CMD"
 	MaxPnpmTreeDepthEnv = "JF_PNPM_MAX_TREE_DEPTH"
 	RequirementsFileEnv = "JF_REQUIREMENTS_FILE"
diff --git a/utils/params.go b/utils/params.go
diff --git a/utils/params_test.go b/utils/params_test.go
diff --git a/utils/utils.go b/utils/utils.go

Original file line number	Diff line number	Diff line change
`@@ -20,7 +20,6 @@ require (`
`20`	`20`	`github.com/urfave/cli/v2 v2.27.4`
`21`	`21`	`github.com/xeipuuv/gojsonschema v1.2.0`
`22`	`22`	`golang.org/x/exp v0.0.0-20250911091902-df9299821621`
`23`		`- gopkg.in/yaml.v2 v2.4.0`
`24`	`23`	`gopkg.in/yaml.v3 v3.0.1`
`25`	`24`	`)`
`26`	`25`