Add GitHub Environment guard for scan-pr when using Maven and Gradle

[eranturgeman]

• All tests passed. If this feature is not already covered by the tests, I added new tests.
• This pull request is on the dev branch.
• I used gofmt for formatting the code before submitting the pull request.
• Update documentation about new features / new supported technologies

---

Depends on:

• Add risky tech callback guard after techs detection jfrog-cli-security#852

This PR adds environment verification for scan-pr flow for Maven and Gradle.
During the scan process the dep-trees plugins are activated and they expose us to untrusted code execution. In order to prevent that we added a guarding functions that verifies the existence of GitHub environment with at least one reviewer - so we can be sure that when Maven and Gradle are being used - a trusted persona has approved the run.
The func checks 3 things:

1. An environment named 'frogbot' exist
2. The environment is set in the workflow file
3. The environment has at least 1 reviewer

[attiasas]

Nice work, checkout my comments

[github-actions]

📗 Scan Summary

• Frogbot scanned for vulnerabilities and found 6 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	6 Issues Found 4 High 2 Medium
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	Not Found
Secrets	✅ Done	Not Found
Infrastructure as Code (IaC)	✅ Done	Not Found

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Dependency Path
High	CVE-2021-4435	Missing Context	-
High	CVE-2020-8131	Not Covered	-
High	CVE-2019-5448	Not Covered	-
High	CVE-2019-10773	Not Covered	-
Medium	CVE-2025-9308	Not Covered	-
Medium	CVE-2019-15608	Not Covered	-

🔖 Details

[ CVE-2021-4435 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Missing Context
CVSS V3:	7.8

An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

[ CVE-2020-8131 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Not Covered
CVSS V3:	7.5

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

[ CVE-2019-5448 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Not Covered
CVSS V3:	8.1

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

[ CVE-2019-10773 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Not Covered
CVSS V3:	7.8

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

[ CVE-2025-9308 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Not Covered
CVSS V3:	5.5

Es wurde eine Schwachstelle in yarnpkg Yarn bis 1.22.22 entdeckt. Betroffen hiervon ist die Funktion setOptions der Datei src/util/request-manager.js. Mittels dem Manipulieren mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Der Angriff muss auf lokaler Ebene erfolgen.

[ CVE-2019-15608 ] yarn 1.0.0

Vulnerability Details

Contextual Analysis:	Not Covered
CVSS V3:	5.9

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0.

---

🐸 JFrog Frogbot