The .phylum_project file contains the Project ID and (optionally) group name. But it does not contain the API URL. This leads to unknown project errors if a .phylum_project file is, for example, created on staging and then run against prod.
It would be nice if we tracked the API URL in the .phylum_project file. To avoid clutter, we could skip adding the URL if it matches the default (which is prod).
Then, at a minimum, we can check it against the configured URL and give a more reasonable error message. Or, more preferably, we could update the config format to store URL/token pairs, and execute queries against the correct instance per project.
This would also help phylum-ci now that it is using the .phylum_project file to build the project URL (as of phylum-dev/phylum-ci#54)
It's very possible that this idea would cause more trouble than it's worth, but I think it's worth considering.
The
.phylum_projectfile contains the Project ID and (optionally) group name. But it does not contain the API URL. This leads to unknown project errors if a.phylum_projectfile is, for example, created on staging and then run against prod.It would be nice if we tracked the API URL in the
.phylum_projectfile. To avoid clutter, we could skip adding the URL if it matches the default (which is prod).Then, at a minimum, we can check it against the configured URL and give a more reasonable error message. Or, more preferably, we could update the config format to store URL/token pairs, and execute queries against the correct instance per project.
This would also help
phylum-cinow that it is using the.phylum_projectfile to build the project URL (as of phylum-dev/phylum-ci#54)It's very possible that this idea would cause more trouble than it's worth, but I think it's worth considering.