Fetch Feature Flag with call to Feature Flag Gateway Api #6398

brew42 · 2025-12-18T18:10:37Z

Pull Request Submission Checklist

Follows CONTRIBUTING guidelines
Commit messages
are release-note ready, emphasizing
what was changed, not how.
Includes detailed description of changes
Contains risk assessment (Low | Medium | High)
Highlights breaking API changes (if applicable)
Links to automated tests covering new functionality
Includes manual testing instructions (if necessary)
Updates relevant GitBook documentation (PR link: ___)
Includes product update to be announced in the next stable release notes

What does this PR do?

Adds a call to feature flag gateway api to fetch the 'show-maven-build-scope'
Pass this feature flag to the maven plugin -> Plugin call to feature flag gateway from src/lib/snyk-test/index.js and pass flags to src/lib/plugins/get-single-plugin-result.ts where the mvn plugin is invoked with feature flag.

Added Feature Flag Gateway server to cliv2 in order to fetch the feature flag for otel.

Where should the reviewer start?

src/lib/feature-flag-gateway/index.ts
Implement post call to feature flag gateway and added wrapper
Company id is fetched from config (getOrganizationId) and not from options.

src/lib/snyk-test/index.js
Call Feature Flag Gateway and set flag in featureFlags

src/lib/plugins/get-single-plugin-result.ts
Update to pass feature flag to maven plugin

cliv2/cmd/cliv2/main.go
Added call to feature flag gateway service to fetch the 'show-maven-build-scope' flag

cliv2/internal/feature-flag-gateway
Implement service to call the feature flag gateway evaluate api

How should this be manually tested?

Run sbom generation for org with and without the show-maven-build-scope feature flag enabled in flipt.
cli/binary-releases/snyk-macos-arm64 sbom --format cyclonedx1.6+json --debug

Run sbom generation for user authenticated with group service account token. Confirm default organization is passed to feature flag call scope is generated as expected.
cli/binary-releases/snyk-macos-arm64 auth <token>

Flag enabled - sbom output contains scope

{
            "bom-ref": "2-com.jpmorgan.snykcode:moneta-commons@2.0.4",
            "type": "library",
            "group": "com.jpmorgan.snykcode",
            "name": "com.jpmorgan.snykcode:moneta-commons",
            "version": "2.0.4",
            "purl": "pkg:maven/com.jpmorgan.snykcode/moneta-commons@2.0.4",
            "properties": [
                {
                    "name": "snyk:maven:build_scope",
                    "value": "compile"
                }
            ]
        },

Flag disabled - sbom output does not contain scope

{
            "bom-ref": "2-com.jpmorgan.snykcode:moneta-commons@2.0.4",
            "type": "library",
            "group": "com.jpmorgan.snykcode",
            "name": "com.jpmorgan.snykcode:moneta-commons",
            "version": "2.0.4",
            "purl": "pkg:maven/com.jpmorgan.snykcode/moneta-commons@2.0.4",
            "properties": [
            ]
        },

What's the product update that needs to be communicated to CLI users?

Sbom generated output will contain maven scope information for those organizations with the 'show-maven-build-scope' feature flag enabled

snyk-abedonik · 2025-12-30T09:59:11Z

cliv2/internal/feature-flag-gateway/model.go

+package featureflaggateway
+
+// FeatureFlagRequest request body for feature flag request.
+type FeatureFlagRequest struct {


We should consider moving these classes to the pkg folder in the feature-flag-gateway repo so they can be reused wherever this service is used.

chore:[CSENG-68] correct ffg path in fake server chore:[CSENG-68] update ffg hidden end point chore: [CSENG-68] plug in ffg call chore: [CSENG-68] update package chore: [CSENG-68] correct org chore: code tidy for CSENG-68 chore: update to use makeRequest chore: update tap tests [CSENG-68] chore: remove status check for CSENG-68 chore: implement ffg for otel [CSENG-68] chore: correct go mod [CSENG-68] chore: revert to standard http client lib [CSENG-68] chore: correct ffg unit test [CSENG-68] chore: lint service [CSENG-68] chore: update fake server end point

PeterSchafer · 2026-01-05T15:51:34Z

cliv2/cmd/cliv2/main.go

 package main

 // !!! This import needs to be the first import, please do not change this !!!
-import _ "github.com/snyk/go-application-framework/pkg/networking/fips_enable"


Issue: Please watch out for this import. It must remain the first import.

PeterSchafer · 2026-01-05T15:54:56Z

cliv2/cmd/cliv2/main.go

+	disable_analytics_flag  string = "DISABLE_ANALYTICS"
+	debug_level_flag        string = "log-level"
+	integrationNameFlag     string = "integration-name"
+	showMavenBuildScopeFlag string = "show-maven-build-scope"


Issue: The CLI tries to enforce a separation of concerns between the application and product lines. This means that feature flag like this, which is SCA related should live in the related extension.

PeterSchafer · 2026-01-05T15:55:40Z

cliv2/cmd/cliv2/main.go

+		globalLogger.Print("Failed to fetch feature flags", err)
+		return constants.SNYK_EXIT_CODE_ERROR
+	}
+	apiToken := globalConfiguration.GetString(configuration.AUTHENTICATION_TOKEN)


Issue: This should not be required. Authentication is handled by the network stack.

PeterSchafer · 2026-01-05T15:56:51Z

cliv2/cmd/cliv2/main.go

 	cliAnalytics.GetInstrumentation().SetCategory(instrumentation.DetermineCategory(os.Args, globalEngine))
 	cliAnalytics.GetInstrumentation().SetStage(instrumentation.DetermineStage(cliAnalytics.IsCiEnvironment()))
 	cliAnalytics.GetInstrumentation().SetStatus(analytics.Success)
+	cliAnalytics.GetInstrumentation().AddExtension(showMavenBuildScopeFlag,


Similar to the previous comment, something like this should live in the Extension.

PeterSchafer · 2026-01-05T16:01:49Z

cliv2/cmd/cliv2/main.go

 	return exitCode
 }

+func IsFeatureEnabled(


Suggestion: This function and the associated service implementation should live in GAF. Please take a look at the existing helper. The API clients should be generated based on the OpenAPI Spec and placed here.

PeterSchafer · 2026-01-05T16:03:18Z

cliv2/internal/feature-flag-gateway/service.go

+		return nil, fmt.Errorf("base URL is nil")
+	}
+
+	client := &http.Client{


Issue: Please use the GAF network stack it will take care of authentication, user-agent ...

brew42 self-assigned this Dec 18, 2025

brew42 requested review from a team as code owners December 18, 2025 18:10

brew42 marked this pull request as draft December 18, 2025 18:10

brew42 force-pushed the feature/CSENG-68_AddFFG branch 8 times, most recently from ee6339b to 0583fce Compare December 24, 2025 10:48

brew42 marked this pull request as ready for review December 24, 2025 11:12

brew42 force-pushed the feature/CSENG-68_AddFFG branch 6 times, most recently from 980cd8c to 7102dbb Compare December 29, 2025 09:54

brew42 changed the title ~~chore:[CSENG-68] add ffg call~~ Fetch Feature Flag with call to Feature Flag Gateway Api Dec 29, 2025

brew42 force-pushed the feature/CSENG-68_AddFFG branch from 7102dbb to 08bcc34 Compare December 29, 2025 09:57

snyk-abedonik reviewed Dec 30, 2025

View reviewed changes

snyk-abedonik approved these changes Dec 30, 2025

View reviewed changes

brew42 force-pushed the feature/CSENG-68_AddFFG branch from 08bcc34 to 70dbb05 Compare December 31, 2025 12:38

PeterSchafer reviewed Jan 5, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fetch Feature Flag with call to Feature Flag Gateway Api #6398

Fetch Feature Flag with call to Feature Flag Gateway Api #6398

Uh oh!

brew42 commented Dec 18, 2025 •

edited

Loading

Uh oh!

snyk-abedonik Dec 30, 2025

Uh oh!

PeterSchafer Jan 5, 2026

Uh oh!

PeterSchafer Jan 5, 2026

Uh oh!

PeterSchafer Jan 5, 2026

Uh oh!

PeterSchafer Jan 5, 2026

Uh oh!

PeterSchafer Jan 5, 2026

Uh oh!

PeterSchafer Jan 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Fetch Feature Flag with call to Feature Flag Gateway Api #6398

Are you sure you want to change the base?

Fetch Feature Flag with call to Feature Flag Gateway Api #6398

Uh oh!

Conversation

brew42 commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Submission Checklist

What does this PR do?

Where should the reviewer start?

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

Uh oh!

snyk-abedonik Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

PeterSchafer Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

brew42 commented Dec 18, 2025 •

edited

Loading