DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 03/27/2025 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Response to Amendment
The Amendment filed on 07/30/2026 has been entered.
The rejection of claims 15-20 under 35 U.S.C 101 is withdrawn in view of Applicant's remarks.
The rejection of claims 1-20 under 35 U.S.C 112(b) is withdrawn in view of Applicant's remarks.
Claims 1, 8 and 15 are amended.
Claims 1-20 are pending of which claims 1, 8 and 15 are independent claims.
Response to Arguments
The applicant's arguments filed on 07/30/2026 regarding claims 1-20 have been fully considered but the arguments are essentially directed towards the newly introduced limitations, and they are addressed in this Office Action, below.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-3, 5, 8-10, 12 and 15-17, 19 are rejected under 35 U.S.C. 103 as being unpatentable over PIZANO et al. (US 2021/0157915, hereinafter PIZANO) in view of Filip et al. (US 2022/0335134, hereinafter Filip) and Gupta et al. (US 2024/0427901, hereinafter Gupta).
Regarding claim 1: PIZANO teaches: A computer-based method of detecting and reusing scan results to optimize a secure software supply chain, the method comprising:
generating a first unique ID for the scanned first content item (PIZANO - [0010]: The validation platform may generate a file hash for each of the one or more files to create one or more file hashes), wherein the first unique ID is correlated with collected evidence from the first scan ([0010]: The validation platform may store, in a data structure, data identifying the one or more repositories, the one or more applications, the one or more files, the one or more lines of code, the one or more file hashes, the one or more line hashes (if used), and the one or more function hashes (if used). The data structure may further store one or more status indicators associated with the files and/or functions, which may reflect a status associated with the security of the files and/or functions);
upon a merge of the pull request, generating a second unique ID for a second content item corresponding to a second commit as part of a second pipeline (PIZANO - [0010]: The validation platform may generate a file hash for each of the one or more files to create one or more file hashes); and
determining whether evidence for the second content item exists based on the first unique ID and the second unique ID (PIZANO - [0036]: if an application is being scanned and a calculated hash value of one of the files included in such application matches one of the hash values of the files stored in the data structure, validation platform 115 may determine whether results can be provided based on the information already stored in the data structure without scanning the file);
based on determining the evidence exists (PIZANO - [0036]: if the records associated with the file in data structure 112 include scanned indicators that show the file has been scanned and/or include approval indicators that indicate that the file is approved for use):
validating the evidence for the second content item based on one or more validation factors (PIZANO - [0036]: If the records associated with the file include scanned indicators that indicate that the file has not been scanned, or that the scan does not meet a required criteria (e.g., scan was too long ago, different kind of scanning tool was used)); and
based on determining the evidence for the second content item is valid, skipping a second scan for the second content item in the second pipeline (PIZANO - [0036]: if the records associated with the file in data structure 112 include scanned indicators that show the file has been scanned and/or include approval indicators that indicate that the file is approved for use, validation platform 115 may report that the file passes the scan, and may skip performing a scan).
However, PIZANO doesn’t explicitly teach, but Filip discloses:
receiving a pull request from a user (Filip - [0036]: a user initiates a pull request of the received set of source code);
executing a first scan of a first content item corresponding to a first commit as part of a first pipeline (Filip - [0036]: Subsequent to initiating the pull request of the received set of source code, source code scan mod 305 scans the set of source code to ultimately determine whether any security vulnerabilities exist);
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of PIZANO with Filip so that evaluate is based on user privacy values. The modification would have allowed the system to include user privacy values in the database for secure communication.
However, the combination of doesn’t explicitly teach but Gupta discloses: wherein validating the evidence further includes determining that a context of the first scan and a context of a second scan are identical, wherein the context of the first scan and the context of the second scan at least include a scan environment and a scan configuration (Gupta - Fig. 2, [0024]: The first container image 210 and the second container image 220 both include a set of shared layers 204, indicated with a solid border. These shared layers 204 may be identical to one another … The first layers 212 combine with the shared layers 204 to create the operational environment of the first container image 210, while the second layers 222 combine with the shared layers 204 to create the operational environment of the second image. [0026]: When the second container image 220 is scanned, the list of layers in the second container image 220 may be compared to the metadata that is stored in the scan cache 114. For any layers that are present in the scan cache 114, the security scan 112 may skip those layers, scanning only the second layers 222).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of PIZANO and Filip with Gupta so that scan environment and metadata is compared to determine if a layer needs to be scanned. The modification would have allowed the system to be more efficient.
Regarding claim 2: PIZANO as modified teaches: further comprising:
using the collected evidence from the first scan as the evidence for the second content item (PIZANO - [0036]: validation platform 115 may perform one or more actions using or otherwise based on the data stored in data structure 112); and
gating a deployment of an artifact corresponding to the second content item based on the collected evidence from the first scan (PIZANO - [0026]: The record in the data structure 112 associated with the file may include scanning indicators that may indicate a scan has been performed and/or approval indicators that may indicate that the file may not be used).
Regarding claim 3: PIZANO as modified teaches: further comprising:
based on determining the evidence does not exist:
executing the second scan of the second content item in the second pipeline, wherein new evidence is collected for the second content item from the second scan (PIZANO - [0036]: if the records associated with the file include scanned indicators that indicate that the file has not been scanned, or that the scan does not meet a required criteria (e.g., scan was too long ago, different kind of scanning tool was used), validation platform 115 may perform the scan. Where a scan is performed, validation platform 115 may create records for the scanned files in data structure 112, which may include the application information, file information and file hash information described above, and may further include scanned identifiers noting the scanning performed, approved identifiers indicating an approval status, and other information from the scan); and
gating a deployment of an artifact corresponding to the second content item based on the new evidence from the second scan (PIZANO - [0039]: if a user utilizes a modified file, validation platform 115 may scan the modified file once, and may store results of the scan in the data structure. see also [0026]).
Regarding claim 5: PIZANO as modified teaches: wherein validating the evidence for the second content item further comprises:
computing a staleness of the collected evidence from the first scan, wherein the evidence for the second content item is valid based on determining the staleness is below a time-frame threshold (PIZANO - [0036]: the scan does not meet a required criteria (e.g., scan was too long ago).
Regarding claims 8-10 and 12: Claims are directed to apparatus/system claims and do not teach or further define over the limitations recited in claims 1-3 and 5. Therefore, claims 8-10 and 12 are also rejected for similar reasons set forth in claims 1-3 and 5. Furthermore, PIZANO Fig. 3 and in para. [0061] also discloses a processor, a memory and computer-readable medium.
Regarding claims 15-17 and 19: Claims are directed to computer readable medium claims and do not teach or further define the limitations recited in claims 1-3 and 5. Therefore, claims 15-17 and 19 are also rejected for similar reasons set forth in claims 1-3 and 5. Furthermore, PIZANO Fig. 3 and in para. [0061] also discloses a computer-readable medium.
Claims 4, 11 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over PIZANO et al. (US 2021/0157915, hereinafter PIZANO) in view of Filip et al. (US 2022/0335134, hereinafter Filip), Gupta et al. (US 2024/0427901, hereinafter Gupta) and Balanescu et al. (US 20250335195, hereinafter Balanescu).
Regarding claim 4, 11 and 18: PIZANO as modified teaches: wherein determining whether the evidence for the second content item exists further comprises:
determining whether the first unique ID and the second unique ID match (PIZANO - [0036]: if an application is being scanned and a calculated hash value of one of the files included in such application matches one of the hash values of the files stored in the data structure); and
based on determining the first unique ID and the second unique ID do not match, computing a related ID, by [a GIT application programming interface (API)], for the second content item (PIZANO - [0078]: process 400 may include determining that the hash associated with the file included in the new application does not match any of the one or more file hashes; performing the scan of the file included in the new application based on determining that the hash associated with the file does not match any of the one or more file hashes; and inserting into the data structure the hash associated with the file) that maps the second content item to the first unique ID when the GIT API detects the first content item and the second content item are substantially identical between the first pipeline and the second pipeline (PIZANO - [0016]: Validation platform 115 may remove the blank spaces and/or the characters to generate a modified file for each of the one or more files. In this way, validation platform 115 may modify the one or more files to generate one or more modified files that are limited to substantive code. This may enable validation platform 115 to more accurately, quickly and easily compare application files to identify files that have identical substantive code (and be able to avoid identifying files as modified where the only changes are to comments, readability, or other cosmetic and non-substantive changes)).
However, PIZANO as modified doesn’t explicitly teach but Balanescu discloses a GIT application programming interface (API) (Balanescu - [0039]: GitHub's public API to learn and understand how similar projects have addressed the same dependency issues).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of PIZANO with Filip, Gupta and Balanescu so thatGIT API is used to compare pipelines. The modification would have allowed the system to utilize GIT API to perform the tasks.
Claims 6-7, 13-14 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over PIZANO et al. (US 2021/0157915, hereinafter PIZANO) in view of Filip et al. (US 2022/0335134, hereinafter Filip), Gupta et al. (US 2024/0427901, hereinafter Gupta) and Manghnani et al. (US 2023/0109694, hereinafter Manghnani).
Regarding claim 6, 13 and 20: PIZANO as modified doesn’t explicitly teach but Manghnani discloses: wherein the first pipeline is a pull request pipeline and the second pipeline is a continuous integration pipeline (Manghnani - [0029]: The method 400 then includes a step 404 of tracking, by the one or more processors of the computer system, check-in or pull requests on the source code during code merges that are associated with a task in a development lifecycle tool … the method 400 includes a step 412 of deploying the source code along with the annotations into an application using a continuous integration/continuous delivery pipeline (CI/CD)).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of PIZANO with Filip, Gupta and Manghnani so that continuous pipelines is used in code merge. The modification would have allowed the system to be more efficiency.
Regarding claim 7 and 14: PIZANO as modified doesn’t explicitly teach but Manghnani discloses: wherein the first pipeline and the second pipeline are continuous integration pipelines (Manghnani - [0015]: The software developer platform 112 may utilize a continuous integration/continuous delivery (CI/CD) pipeline to allow the developed source code to be delivered or deployed in a side car pattern with a code analytic engine of the computer system).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of PIZANO with Filip and Manghnani so that continuous pipelines are used in code merge. The modification would have allowed the system to be more efficiency.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
PLOTNIK US 2025/0328655 - Augmenting Automated Runtime API Testing With Static Analysis Calahan et al. US 2023/0229435 CODE MANAGEMENT CROSS-SUPPORT AND SYNCHRONIZATION
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MENG LI whose telephone number is (571)272-8729. The examiner can normally be reached M-F 8:30-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Alexander Lagor can be reached on (571) 270-5143. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MENG LI/
Primary Examiner, Art Unit 2437
Prosecution Insights