Project Ignite Phase I - Forking Jetbrains Plugin (AST-131708) by cx-atish-jadhav · Pull Request #409 · Checkmarx/ast-jetbrains-plugin

cx-atish-jadhav · 2026-02-17T07:17:11Z

By submitting a PR to this repository, you agree to the terms within the Checkmarx Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Forked the existing Checkmarx One JetBrains plugin to create a separate Checkmarx Developer Assist plugin for Project Ignite, enabling a focused developer experience without enterprise features.

What Changed

New Plugin Module Created

Module: plugin-checkmarx-devassist
Name: Checkmarx Developer Assist
New plugin ID: com.checkmarx.devassist-jetbrains-plugin
Separate marketplace identity with distinct branding

Removed Enterprise Features

❌ Scan Results panel and tree view
❌ Project/Branch management UI
❌ Server URL configuration
❌ All "Checkmarx One" text references
❌ Enterprise-only commands and settings

Simplified Authentication

✅ API key authentication only (no server URL)
✅ Portal-managed social login support
✅ Removed OAuth callback complexity

Focused Settings UI

CxDevAssistSettingsComponent - Main authentication settings
RealtimeScannersSettingsComponent - Scanner configuration panel
- Individual toggles for ASCA, OSS, Secrets, Containers, IaC
- MCP (Model Context Protocol) installation & status
- Container tool selection (Docker/Podman)
- User preferences persistence
IgniteWelcomeDialog - First-run onboarding experience

Code Refactoring

Moved shared code to common-lib (auth, settings, utils)
Extracted DevAssist logic to devassist-lib (MCP integration)
Preserved plugin-checkmarx-ast without regression
Added PluginContext for plugin-specific behavior

Impact

Plugin Users:

✅ Separate plugin listing in JetBrains Marketplace
✅ Clean, focused developer experience
✅ No confusion with enterprise features
✅ Simplified onboarding flow

Existing Checkmarx One Plugin:

✅ No changes or regressions
✅ Continues with all enterprise features
✅ Existing users unaffected

Codebase:

✅ Clean separation with shared libraries
✅ Maintainable architecture for both plugins
✅ Reduced code duplication via common-lib
✅ Independent versioning and releases

References

Epic: CxOne Plugin | Jetbrains | Project Ignite Phase I - AST-131708

Confluence: https://checkmarx.atlassian.net/wiki/x/AgDTMAI

Branch: feature/project_ignite_AST-131708

Testing

Test Coverage Added

96 unit tests with ~90% coverage
Tests follow McpConfigurationTest pattern (Mockito static mocking)
Coverage reports: build/reports/jacoco/test/html/index.html

Manual Testing Performed

✅ Plugin installs independently from Checkmarx One plugin
✅ API key authentication works without server URL
✅ Settings pages display correctly (DevAssist + Realtime Scanners)
✅ Welcome dialog shows on first launch
✅ Real-time scanners can be enabled/disabled
✅ MCP installation flow works correctly
✅ No Checkmarx One features visible in UI
✅ No regression in existing plugin-checkmarx-ast

Checklist

I have added documentation for new/changed functionality in this PR (if applicable).
All active GitHub checks for tests, formatting, and security are passing
The correct base branch is being used

…-132334)

… per Figma design

…brains-plugin into other/ui_fixes

- Removed main src folder

…alues - Configure common dependencies on global level

- Migrated required classes to plugin-ignite and checkmarx-ast plugin AST-133069 - Added test cases

… AST-133069 - Added icons to common-lib - Added test cases

…ST-133376, AST-133638

…m/Checkmarx/ast-jetbrains-plugin into feature/project_ignite_AST-131708 # Conflicts: # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/commands/Project.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/commands/Scan.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/commands/Triage.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/inspections/CxInspection.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/inspections/CxVisitor.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/CxToolWindowFactory.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/CxToolWindowPanel.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/CancelScanAction.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/OpenSettingsAction.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/filter/CustomStateFilter.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/filter/DynamicFilterActionGroup.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/filter/FilterBaseAction.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/group/by/GroupByBaseAction.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/group/by/GroupByDirectDependency.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/group/by/GroupByFileAction.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/group/by/GroupByPackageAction.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/group/by/GroupBySeverityAction.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/group/by/GroupByStateAction.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/group/by/GroupByVulnerabilityTypeAction.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/selection/BranchSelectionGroup.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/selection/ProjectSelectionGroup.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/selection/RootGroup.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/actions/selection/ScanSelectionGroup.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/results/tree/ResultsTreeFactory.java # plugin-checkmarx-ast/src/main/java/com/checkmarx/intellij/ast/window/results/tree/nodes/ResultNode.java # plugin-checkmarx-ast/src/main/resources/META-INF/plugin.xml # plugin-ignite/src/main/java/com/checkmarx/intellij/ignite/ui/actions/IgnoredFindingsToolbarActions.java # plugin-ignite/src/main/java/com/checkmarx/intellij/ignite/ui/actions/VulnerabilityFilterBaseAction.java # plugin-ignite/src/main/java/com/checkmarx/intellij/ignite/ui/actions/VulnerabilityFilterState.java # plugin-ignite/src/main/java/com/checkmarx/intellij/ignite/window/IgniteToolWindowFactory.java # plugin-ignite/src/main/resources/META-INF/plugin.xml

…ST-133376, AST-133638

…AST-133403

…marx-ast

…plugin ignite AST-133784

…m/Checkmarx/ast-jetbrains-plugin into feature/project_ignite_AST-131708

…omponents

gitguardian · 2026-02-17T07:17:56Z

⚠️ GitGuardian has uncovered 3 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
11482443	Triggered	Generic Password	`ed38b63`	plugin-checkmarx-ast/src/test/java/com/checkmarx/intellij/integration/standard/data/python-vul-file.py	View secret
11482444	Triggered	Username Password	`ed38b63`	plugin-checkmarx-ast/src/test/java/com/checkmarx/intellij/integration/standard/data/python-vul-file.py	View secret
11482451	Triggered	Generic Password	`ed38b63`	plugin-checkmarx-ast/src/test/java/com/checkmarx/intellij/integration/standard/data/python-vul-file.py	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

cx-umesh-waghode · 2026-02-17T08:58:52Z

common-lib/src/main/java/com/checkmarx/intellij/common/context/PluginContext.java

What is the significance of such a message?

this i have added for testing purpose, this is not needed now..

Changes: kept only debug log to identify plugin during initialization as its used by both the plugin

LOGGER.debug(format("PluginContext: Setting plugin name: %s", pluginName));

cx-umesh-waghode · 2026-02-17T08:59:06Z

common-lib/src/main/java/com/checkmarx/intellij/common/context/PluginContext.java

+ * </pre>
+ */
+@Service(Service.Level.APP)
+public final class PluginContext {


is this class thread-safe?

This is app level singleton service created on initialization of the plugin. we are doing write only once on plugin initialization, so we dont need to implement explicit thread safety for this class .
Note: This class used by at a time one plugin only so thread safety not required

cx-umesh-waghode · 2026-02-17T09:00:05Z

common-lib/src/main/java/com/checkmarx/intellij/common/context/PluginContext.java

Log messages at Info level only when it makes sense at that level.

Changed to debug log, to track, if unnecessary reset called

cx-umesh-waghode · 2026-02-17T09:00:55Z

common-lib/src/main/java/com/checkmarx/intellij/common/resources/CxIcons.java

Let's avoid the word ignite in the code.

Changed to DEVASSIST_WELCOME_AI_ERROR

cx-umesh-waghode · 2026-02-17T09:01:21Z

common-lib/src/main/java/com/checkmarx/intellij/common/resources/Resource.java

Avoid use of Ignite word.

Changed IGNITE to DEVASSIST

cx-umesh-waghode · 2026-02-17T09:06:12Z

...-lib/src/main/java/com/checkmarx/intellij/common/startup/LicenseFlagSyncStartupActivity.java

If we are adding log message, it should have significance.

Changed log to : LOGGER.debug("LicenseSyncStartupActivity: License changed for the tenant, publishing event to reset the plugin UI.");

- Changes for review comments

…8' into feature/project_ignite_AST-131708

github-actions · 2026-02-17T10:57:05Z

Checkmarx One – Scan Summary & Details – 239c6497-ff45-4647-8425-a2b8345a752b

New Issues (1)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Log_Forging	/plugin-checkmarx-devassist/src/main/java/com/checkmarx/intellij/cxdevassist/settings/CxDevAssistSettingsComponent.java: 180	details Method at line 180 of /plugin-checkmarx-devassist/src/main/java/com/checkmarx/intellij/cxdevassist/settings/CxDevAssistSettingsComponent.java g... Attack Vector

commit 45a8e4f Author: atishj99 <141334503+cx-atish-jadhav@users.noreply.github.com> Date: Wed Feb 18 14:31:35 2026 +0530 adding logging for tests modules commit 8c1fc8a Author: atishj99 <141334503+cx-atish-jadhav@users.noreply.github.com> Date: Wed Feb 18 13:52:32 2026 +0530 Added jacoc test report for module devassist-lib and devassist-deploy commit f40c22d Author: atishj99 <141334503+cx-atish-jadhav@users.noreply.github.com> Date: Wed Feb 18 12:12:34 2026 +0530 Reverted aggregated jacoco test report changes commit 42c7e00 Author: atishj99 <141334503+cx-atish-jadhav@users.noreply.github.com> Date: Wed Feb 18 10:43:25 2026 +0530 Fix: Use string task names for finalizedBy to avoid CI evaluation errors commit 29e8f74 Author: atishj99 <141334503+cx-atish-jadhav@users.noreply.github.com> Date: Wed Feb 18 09:48:33 2026 +0530 Changes for worfkflow

cx-aniket-shinde and others added 30 commits January 22, 2026 13:34

Resolved failing Unit Test Cases

aabe91f

Resolved failing Unit Test Cases

08bb095

fixed the alignments of values in last updated and actions columns

9749785

refactor: optimize CxIgnoredFindings.java and fix IDE warnings

e7bce6d

fix: prevent duplicate 'Session Expired' notifications on logout (AST…

3ce2c62

…-132334)

fix(ui): update promotional panel for scan results and CxOne findings…

2ff3138

… per Figma design

Resolved integration test cases and UI issue for split panel

e060a63

Merge branch 'other/ui_fixes' of https://github.com/Checkmarx/ast-jet…

13fb9c4

…brains-plugin into other/ui_fixes

- initial project setup with multi module AST-133066

1006c31

- Removed main src folder

- initial project setup with multi module AST-133066

99f26d0

- Removed main src folder

- Added gradle.properties file to maintain the versions and default v…

4602d80

…alues - Configure common dependencies on global level

- updated plugin id and name for devassist

d6aa325

- Added common classes to common-lib AST-133373

783a3eb

- Added common classes to common-lib AST-133373

988aedf

- Mirated devassit feature backed classes to devassist-lib AST-133401

805fbf1

- Mirated devassist feature backed classes to devassist-lib AST-133401

088699d

- Added icons to common-lib

250e8d3

- Migrated required classes to plugin-ignite and checkmarx-ast plugin AST-133069 - Added test cases

- Migrated required classes to plugin-ignite and checkmarx-ast plugin…

f8ee88f

… AST-133069 - Added icons to common-lib - Added test cases

- Refactor code, migrate common classes and fixed the plugin issues A…

8b42aa7

…ST-133376, AST-133638

- Refactor code, migrate common classes and fixed the plugin issues A…

9916841

…ST-133376, AST-133638

- Organized imports

d592606

- Migrated devassist unit cases to devassist-lib and fixed imports - …

5720327

…AST-133403

- Added scan registration code on project open

95eb6f0

- Added settings classes for plugin-ignite AST-133784

c99a748

- Renamed project listener class to dev assist and register for check…

0f00e77

…marx-ast

- Added settings classes for plugin-ignite AST-133784

d77f5ab

- Migrate realtime settings classes and created required classes for …

d11ad90

…plugin ignite AST-133784

- Refactor Code, and created common methods for common code

a316d22

- Move Settings UI classes specific to the plugins and refactor code

c5c816e

cx-anand-nandeshwar and others added 16 commits February 12, 2026 12:33

- Refactor and rename ignite plugin files

e378ff3

- Refactor and rename ignite plugin files

af48f6d

- Refactor and rename module name

41cc38f

- Added new images for checkmarx developer assist and fixed filter issue

33c9e23

- updated README.md file for checkmarx developer assist

335160a

- Fixed open settings issue on log-out state and renamed class

7dc561d

- Optimize imports

c606745

- Optimize authentication code removed radio button

662debf

- Updated changed notes and auth UI

ee7a574

fixing unit and integration testcases

dbc97e0

Merge branch 'feature/project_ignite_AST-131708' of https://github.co…

fe100c4

…m/Checkmarx/ast-jetbrains-plugin into feature/project_ignite_AST-131708

- Fixed the open settings page issue on logout

a93c9ab

- Renamed class as per module

35cd951

- Fixed agent name

199e379

Add comprehensive unit test suite for Ignite module settings and UI c…

3764052

…omponents

- Renamed plugin name

2f3c2cb

cx-atish-jadhav requested review from cx-anurag-dalke and cx-umesh-waghode February 17, 2026 07:19

cx-atish-jadhav assigned cx-amol-mane, cx-anand-nandeshwar and cx-atish-jadhav Feb 17, 2026

Merge branch 'main' into feature/project_ignite_AST-131708

ad569a2

cx-umesh-waghode requested changes Feb 17, 2026

View reviewed changes

cx-anand-nandeshwar added 2 commits February 17, 2026 16:22

- Refactor and rename files and code from ignite to cxdevassist

a12c25e

- Changes for review comments

Merge remote-tracking branch 'origin/feature/project_ignite_AST-13170…

08b822a

…8' into feature/project_ignite_AST-131708

cx-atish-jadhav and others added 3 commits February 18, 2026 01:11

Changed workflow to run all tests

9398cfa

- Removed plugin specific readme files

659dc34

Conversation

cx-atish-jadhav commented Feb 17, 2026 • edited by cx-anand-nandeshwar Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What Changed

Impact

References

Testing

Test Coverage Added

Manual Testing Performed

Checklist

Uh oh!

gitguardian bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 3 secrets following the scan of your pull request.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cx-anand-nandeshwar Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Comments

cx-atish-jadhav commented Feb 17, 2026 •

edited by cx-anand-nandeshwar

Loading

gitguardian bot commented Feb 17, 2026 •

edited

Loading

cx-anand-nandeshwar Feb 17, 2026 •

edited

Loading

github-actions bot commented Feb 17, 2026 •

edited

Loading