Corgea JetBrains Plugin

Automatically find and fix insecure code — directly in your JetBrains IDE.

Works with IntelliJ IDEA, PyCharm, WebStorm, GoLand, PHPStorm, and all other IntelliJ-based IDEs.

Features

• Security scanning — Run full project scans or scan only uncommitted files
• Code vulnerabilities — View issues grouped by file with severity badges and line numbers
• SCA vulnerabilities — View dependency vulnerabilities grouped by package with CVE info and fix versions
• Editor highlighting — Vulnerable lines are underlined with gutter icons and quick-fix actions
• Finding details — Open any finding to read the explanation and preview the suggested fix as a diff
• One-click fixes — Apply auto-generated patches directly from the editor
• Live scan progress — Step-by-step progress with CLI output, and the Code and Dependencies tabs refresh themselves as results arrive
• OAuth & API key auth — Supports both authentication methods, including enterprise/self-hosted servers

Prerequisites

• JDK 21 — Required for building
• IntelliJ-based IDE 2024.3+ — Required for running
• Corgea account — Sign up at corgea.com
• Corgea CLI (optional, for scanning) — pip install corgea-cli

Building the Plugin

The project uses the Gradle wrapper, so you don't need Gradle installed — just a JDK 21.

macOS

Install JDK 21 via Homebrew:

brew install openjdk@21

Build:

cd corgea-jetbrains-plugin

# Apple Silicon (M1/M2/M3/M4)
JAVA_HOME=/opt/homebrew/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home ./gradlew buildPlugin

# Intel Mac
JAVA_HOME=/usr/local/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home ./gradlew buildPlugin

Alternatively, if JDK 21 is already your default:

./gradlew buildPlugin

Windows

Install JDK 21:

Download and install from Adoptium (Temurin) or Oracle. During installation, check the option to set JAVA_HOME.

Build (Command Prompt):

cd corgea-jetbrains-plugin

set JAVA_HOME=C:\Program Files\Eclipse Adoptium\jdk-21.0.5.11-hotspot
gradlew.bat buildPlugin

Build (PowerShell):

cd corgea-jetbrains-plugin

$env:JAVA_HOME = "C:\Program Files\Eclipse Adoptium\jdk-21.0.5.11-hotspot"
.\gradlew.bat buildPlugin

Adjust the JAVA_HOME path to match your JDK 21 installation directory.

Linux

Install JDK 21:

# Ubuntu / Debian
sudo apt update && sudo apt install openjdk-21-jdk

# Fedora / RHEL
sudo dnf install java-21-openjdk-devel

# Arch
sudo pacman -S jdk21-openjdk

Build:

cd corgea-jetbrains-plugin

# If JDK 21 is your default
./gradlew buildPlugin

# Or set JAVA_HOME explicitly (Ubuntu example)
JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64 ./gradlew buildPlugin

Build output

After a successful build, the plugin ZIP is located at:

build/distributions/corgea-jetbrains-plugin-1.0.0.zip

Installing and Using

1. Install in your IDE

1. Open your JetBrains IDE
2. Go to Settings → Plugins → ⚙️ → Install Plugin from Disk...
3. Select the built ZIP file
4. Restart the IDE

2. Authenticate

Option A — OAuth (recommended):

1. Open the Corgea tool window (right sidebar)
2. Enter your Corgea URL (or leave the default https://www.corgea.app)
3. Click Login with OAuth
4. Authenticate in your browser — the IDE will pick up the token automatically

Option B — API key:

1. Go to Settings → Corgea
2. Enter your Corgea URL and API key (found on the Integrations page in Corgea)
3. Click Test Connection to verify
4. Click Apply

3. View vulnerabilities

Once authenticated, the Corgea tool window shows:

• Code tab — Vulnerabilities grouped by file, click any item to navigate to the affected line
• Dependencies tab — SCA vulnerabilities grouped by package
• Scanning tab — Start scans and monitor progress

Clicking a finding also opens a details tab with the full explanation and, when Corgea has generated a fix, a diff of the proposed change.

4. Run a scan

• Tools → Corgea → Full Scan — Scans the entire project
• Tools → Corgea → Scan Uncommitted Changes — Scans only modified files

You can also start scans from the Scanning tab in the tool window. While a scan is running the tab shows each step as it completes along with the CLI output, and the toolbar switches to "Auto refresh enabled" while the results tabs poll for new findings.

5. Apply fixes

When a vulnerability has an auto-fix available:

• Hover over a highlighted line → click the gutter icon → view details
• Press Alt+Enter on a highlighted line → select Apply Corgea fix
• Right-click → Corgea → Apply Corgea Fix

Development

Run in a sandbox IDE

This launches a sandboxed IntelliJ IDEA instance with the plugin pre-installed for testing.

macOS / Linux:

JAVA_HOME=/path/to/jdk-21 ./gradlew runIde

Windows (Command Prompt):

set JAVA_HOME=C:\Program Files\Eclipse Adoptium\jdk-21.0.5.11-hotspot
gradlew.bat runIde

Windows (PowerShell):

$env:JAVA_HOME = "C:\Program Files\Eclipse Adoptium\jdk-21.0.5.11-hotspot"
.\gradlew.bat runIde

Running tests

Tests use JUnit 5 and MockK. The API layer tests also use OkHttp MockWebServer.

macOS / Linux:

JAVA_HOME=/path/to/jdk-21 ./gradlew test

Windows (Command Prompt):

set JAVA_HOME=C:\Program Files\Eclipse Adoptium\jdk-21.0.5.11-hotspot
gradlew.bat test

Windows (PowerShell):

$env:JAVA_HOME = "C:\Program Files\Eclipse Adoptium\jdk-21.0.5.11-hotspot"
.\gradlew.bat test

Test reports are written to build/reports/tests/test/index.html.

Project structure

src/main/kotlin/com/corgea/plugin/
├── api/            # REST client, endpoints, data models
├── auth/           # OAuth, API key auth, credential storage
├── actions/        # Menu and editor actions
├── cli/            # CLI process runner, terminal output parsing
├── details/        # Finding details editor (explanation, fix diff)
├── editor/         # Annotator, gutter icons, quick fixes
├── git/            # Git4Idea integration
├── icons/          # Icon constants
├── notifications/  # Notification helpers
├── services/       # Business logic (scan, vulns, config)
├── settings/       # Persistent settings, settings UI
├── toolwindow/     # Swing tool window and its panels
└── ui/             # Shared presentation helpers (severity labels and colors)

src/main/resources/
├── META-INF/       # plugin.xml descriptor, pluginIcon.svg (Marketplace logo)
├── icons/          # Tool window, action, and gutter icons
└── messages/       # i18n strings

Where plugin metadata lives

src/main/resources/META-INF/plugin.xml is the single source of truth for the plugin id, name, description, vendor, and change notes. Do not also set those in the intellijPlatform.pluginConfiguration block in build.gradle.kts — the patchPluginXml task would silently overwrite the descriptor with the Gradle value, which is how a rich description gets replaced by a one-liner on the Marketplace listing.

Gradle owns only the values that need to change per release or per build: version, sinceBuild, and the publishing/signing credentials. Those come from gradle.properties and environment variables.

Useful Gradle tasks

Use ./gradlew on macOS/Linux or gradlew.bat on Windows.

Command	Description
./gradlew build	Compile and run checks
./gradlew buildPlugin	Package the plugin ZIP
./gradlew runIde	Launch a sandbox IDE with the plugin
./gradlew verifyPluginProjectConfiguration	Validate the Gradle/plugin setup
./gradlew verifyPlugin	Run the IntelliJ Plugin Verifier against the target IDEs
./gradlew signPlugin	Sign the built ZIP
./gradlew publishPlugin	Upload a new version to the Marketplace
./gradlew test	Run tests

Troubleshooting

"No Java compiler found" — Make sure JAVA_HOME points to a JDK (not a JRE). Verify with java -version and javac -version.

Wrong Java version — The plugin requires JDK 21. Check your version with java -version. If you have multiple JDKs installed, set JAVA_HOME explicitly as shown in the build instructions above.

Gradle daemon conflicts — If you see errors after switching JDK versions, stop existing daemons first: ./gradlew --stop

buildSearchableOptions fails with "Only one instance of IDEA can be run at a time" — That task starts a headless IDE, which clashes with an IDE already running from the same installation. Either close it or skip the task: ./gradlew buildPlugin -x buildSearchableOptions

Publishing to the JetBrains Marketplace

First release (manual, one time only)

The Marketplace will not accept an API upload for a plugin it has never seen, so version 1.0.0 has to go through the web UI.

1. Run the pre-flight checks and build the artifact:

./gradlew verifyPluginProjectConfiguration test verifyPlugin buildPlugin

2. Sign in at plugins.jetbrains.com with a JetBrains account and accept the Developer Agreement.
3. Open Add new plugin and upload build/distributions/*.zip.
4. Fill in the listing fields, which live on the Marketplace and not in this repository: category (Code tools), tags, and the license. This plugin is proprietary, so select a custom EULA rather than an open-source license.
5. Submit. Automated checks run first, then a JetBrains moderator reviews the plugin. Expect two to three working days; email marketplace@jetbrains.com if you have not heard back after four.
6. Tag the released commit (git tag v1.0.0 && git push origin v1.0.0) so the history matches what shipped. Do not publish a GitHub release for this version — that would trigger the release workflow, and the Marketplace rejects a version it already has. A bare tag does not trigger it.

Subsequent releases (automated)

Once the plugin exists on the Marketplace and the first version has been approved, releases go out through .github/workflows/release.yml, which triggers when you publish a GitHub release.

1. Bump pluginVersion in gradle.properties.
2. Add an entry to CHANGELOG.md and to the <change-notes> block in src/main/resources/META-INF/plugin.xml. The descriptor block is what the Marketplace shows.
3. Merge to main, then publish a GitHub release tagged v<version> (for example v1.0.1). The workflow fails fast if the tag and pluginVersion disagree.

To publish from a workstation instead, export the secrets below and run ./gradlew publishPlugin.

Required repository secrets

Secret	Purpose
PUBLISH_TOKEN	Marketplace upload token. Generate under your Marketplace profile → My Tokens.
CERTIFICATE_CHAIN	Signing certificate chain (contents of chain.crt).
PRIVATE_KEY	Signing private key (contents of private.pem).
PRIVATE_KEY_PASSWORD	Passphrase for that private key.

Signing is skipped automatically when the certificate and key are absent, and the Marketplace re-signs every distribution with its own key regardless, so an unsigned build will still publish. Configure it anyway — it lets users verify the artifact came from Corgea.

Generate the key pair once and store the outputs as secrets:

openssl genpkey -aes-256-cbc -algorithm RSA -out private_encrypted.pem -pkeyopt rsa_keygen_bits:4096
openssl rsa -in private_encrypted.pem -out private.pem
openssl req -key private.pem -new -x509 -days 365 -out chain.crt

Keep private.pem and private_encrypted.pem out of the repository — the .gitignore already excludes *.pem and *.crt.

Release channels

pluginChannel in gradle.properties controls where a build lands. default is the public stable channel. Any other value (beta, eap, …) publishes to a channel users must add manually as a custom plugin repository, which is useful for testing a release with a small group first:

https://plugins.jetbrains.com/plugins/beta/list

Marketplace logo

src/main/resources/META-INF/pluginIcon.svg is the listing logo: a 40×40 SVG that the Marketplace also renders at 80×80. If the brand mark changes, replace that file rather than the raster icons in src/main/resources/icons/, which are the in-IDE tool window and gutter icons and are sized differently.