XRAY-157127 - Keep each package manager resolving against its own Artifactory repo

[Jordanh1996]

https://jfrog-int.atlassian.net/browse/XRAY-157127

Background

Polyglot CI audits with distinct Go/npm (and other) resolver configs intermittently resolved one technology against another's Artifactory repository, producing flaky 404s depending on which technology ran first in the same jf audit process.

Description

BuildInfoBomGenerator reused one shared params across technologies; SetResolutionRepoInParamsIfExists wrote the first tech's repo into that field, so later techs skipped their projects/<tech>.yaml. Each tech now resolves through resolveTechParams against a per-call copy, leaving the generator params clean while --deps-repo / IgnoreConfigFile still short-circuit the lookup.

Tests

Unit: TestResolveTechParamsIsolation, TestResolveTechParamsSkipsConfigLookup, TestBuildDependencyTreeDoesNotMutateGeneratorParams.
Local e2e: polyglot go+npm fixture on the local stack — before npm hit go-vir; after it hit npm-remote.

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

Made with Cursor

[github-actions]

View full scan results in JFrog Platform

---

🐸 JFrog Frogbot