Adds FoD SAST scan policy support to setup and start commands.

[kadraman]

Changes

• Adds --scan-policy to fod sast-scan setup and fod sast-scan start.
• Preserves the configured release policy when starting scans without an override.
• Supports case-insensitive values:
  • Security
  • DevOps
  • Legacy
• Maps policy values to endpoint-specific FoD representations:
  • Setup legacy: FoD_Legacy
  • Start legacy: FoD_Legacy_
• Prevents the GET-only policy representation from being incorrectly sent back in setup requests.

Validation

• FoD module tests pass.
• Spotless checks pass.
• Lowercase policy values verified against a live FoD tenant.
• Verified transition between values with and without scan-policy applied to a live FoD tenant.

[Copilot]

🟢 Approval recommended

The changes are focused, consistent with existing request handling, and include relevant automated coverage.

Pull request overview

Adds FoD SAST scan-policy support across setup and start commands, including endpoint-specific legacy mappings and preservation of configured policies.

Changes:

• Adds --scan-policy options and localized help text.
• Normalizes case-insensitive policy values and legacy representations.
• Adds unit and functional coverage for policy fields and CLI help.

File summaries

File	Description
FoDScanSastHelper.java	Normalizes policies and adds them to start requests.
FoDSastScanSetupCommand.java	Sends normalized setup policy.
FoDSastScanStartCommand.java	Applies explicit or configured release policy.
Request/descriptor classes	Adds scan-policy fields.
FoDMessages.properties	Documents the new options.
Test files	Covers normalization and CLI help/output.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.