[Buganizer ID: 494154345] Feature: Add List Resource Vulnerability Findings action to Wiz integration#683
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a new capability to the Wiz integration by allowing users to retrieve vulnerability findings for specific resources. The changes include the necessary action files, API client updates, and supporting data models to facilitate this functionality. Additionally, the integration version has been incremented to reflect these updates, and the test suite has been expanded to ensure the new feature works as expected. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new action, 'List Resource Vulnerability Findings,' to the Wiz integration, including the necessary API client methods, GraphQL query builders, and data models. The integration version is bumped to 5.0, and several files have been refactored for improved import organization and type safety. Review feedback highlights the need for strict type annotations on all function parameters, adherence to the 2-4 word naming convention for action parameters, and the inclusion of an upper bound for the required Python version in the project configuration.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 8023110. Configure here.
|
You have used all of your free Bugbot PR reviews. To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial. |
…e expected by the Wiz API and our own response parsing logic.
|
You have used all of your free Bugbot PR reviews. To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial. |
|
You have used all of your free Bugbot PR reviews. To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial. |
- Refactor `list_resource_vulnerability_findings` action to return findings grouped by entity in `JsonResult`. - Fix GraphQL query to use `assetName` with the equals operator for resource filtering. - Update widget HTML to match `EntityListResponseTemplate` exactly (except for the title). - Update unit tests to assert the new `EntityResult` structure. - Fix a minor linter warning regarding line length in the test file. b/502645185
|
You have used all of your free Bugbot PR reviews. To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial. |
|
You have used all of your free Bugbot PR reviews. To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial. |
|
You have used all of your free Bugbot PR reviews. To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial. |
|
You have used all of your free Bugbot PR reviews. To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial. |
1 participant
Description
What problem does this PR solve?
Implements the new action
List Resource Vulnerability Findingsfor the Wiz integration, allowing users to retrieve vulnerability findings for specific resources.How does this PR solve the problem?
list_resource_vulnerability_findings.pyandlist_resource_vulnerability_findings.yamlin theactions/directory.WizApiClientincore/api_client.pyto include theget_resource_vulnerability_findingsmethod.tests/test_actions/test_list_resource_vulnerability_findings.py.resources/.5.0inpyproject.tomland updatedrelease_notes.yaml.Any other relevant information (e.g., design choices, tradeoffs, known issues):
N/A
Checklist:
General Checks:
Open-Source Specific Checks:
For Google Team Members and Reviewers Only:
Screenshots (If Applicable)
N/A
Further Comments / Questions
N/A
Note
Medium Risk
Adds a new Wiz action and GraphQL query path that calls the Wiz API and parses new response shapes; main risk is correctness of query/filters and result handling rather than security-sensitive logic.
Overview
Adds a new
List Resource Vulnerability Findingsaction that queries Wiz for vulnerability findings by resource name (supports comma-separated resources) with optional filters (severity, related issue severity, CVE IDs, has-fix/has-public-exploit) and caps per-resource results at 500.Extends the Wiz client to support this via a new GraphQL query builder (
VulnerabilityFindingsQueryBuilder), a newVulnerabilityFindingdatamodel/parser, plus an example JsonResult file and tests/mocks to cover success and no-results cases. Integration metadata is updated by bumping the version to5.0and adding release notes, alongside minor import cleanups.Reviewed by Cursor Bugbot for commit 8023110. Bugbot is set up for automated code reviews on this repo. Configure here.