Xray component resolution

[attiasas]

Summary

Add client support for Xray Zero Touch Remediation (POST api/v1/ztr/lockfile/remediate). The API resolves lockfile dependencies against a virtual repository and returns an updated lockfile plus a list of packages whose integrity was changed.

Treats HTTP 503 as “feature disabled”: Remediate returns the original lockfile and disabled=true instead of an error.

Changes

• Add ZeroTouchRemediationService and Remediate() in xray/services/zerotouchremediation.go, calling api/v1/ztr/lockfile/remediate with scoped project key support. Retries are disabled for this request (no retry on 5xx).
• Add request/response types: ComponentResolutionRequest (build-tool, repo, lockfile as string), ComponentResolutionResponse (lockfile string, changes), and Change (package, before_integrity, after_integrity).
• Expose XrayServicesManager.ZeroTouchRemediation() in xray/manager.go.
• Extend the Xray mock server with a Zero Touch Remediation handler and npm/maven fixtures, including a disabled (503) case.
• Add integration tests in tests/xrayzerotouchremediation_test.go.
• Document usage in README.md under “Zero Touch Remediation”.

Testing

Integration tests added:

• TestZeroTouchRemediationService_Remediate_NpmBuildTool_NoChanges
• TestZeroTouchRemediationService_Remediate_Disabled_NoChanges
• TestZeroTouchRemediationService_Remediate_MavenBuildTool_Changes

Run with: go test -tags=itest ./tests/ -run TestZeroTouchRemediationService

[github-actions]

---

🐸 JFrog Frogbot