Documentation
¶
Overview ¶
Package baseline loads previously emitted findings.json files and computes a delta against a freshly produced findings slice. The diff is keyed on Finding.ID, which the analyzer pipeline guarantees is deterministic per instance ("RULE:ns:name"), so two scans of the same cluster surface the same set of IDs and an Added / Resolved / Unchanged classification falls out cleanly.
The loader accepts either of two on-disk shapes so callers can point the flag at whichever artifact they happen to have saved:
[ {...finding...}, {...finding...} ] // bare array (writeJSON output)
{ "findings": [ {...finding...}, ... ], ... } // wrapper object (forward-compat)
Detection is by first non-whitespace byte, not by filename suffix, so renamed files (findings.json, report.json, baseline.json) all work.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CountNewPrivescPaths ¶
CountNewPrivescPaths returns the number of Added findings that look like privilege-escalation graph paths (RuleID prefix "KUBE-PRIVESC-PATH-"). These get highlighted in the text/markdown summary because a new privesc path is the highest-signal regression a diff can surface.
func LoadFindings ¶
LoadFindings reads a JSON file at path and returns its findings slice. The file may be a bare JSON array (the shape written by the existing report writer) or a wrapper object containing a `findings` array; the shape is detected from the first non-whitespace byte. An empty file is an error.
Types ¶
type Result ¶
Result is the classification of two findings slices into three disjoint buckets keyed on Finding.ID. Resolved findings carry the OLD finding (so the caller can render its title/severity); Unchanged carries the NEW finding (so the caller sees the freshest data when re-rendering).
func Diff ¶
Diff partitions old and new findings into Added (in new, not in old), Resolved (in old, not in new), and Unchanged (in both, keyed by ID).
The result's three slices are sorted by (Severity rank desc, Score desc, RuleID asc, ID asc) so the output order is deterministic across runs regardless of input ordering. This matches the report writer's global priority comparator and keeps `diff` output stable for diff-of-diffs use cases (e.g. PR comments that get re-rendered on every push).
When both slices are nil/empty the result is the zero value; when they are identical (same ID set) Added and Resolved are both empty and Unchanged carries every NEW finding.
type Summary ¶
Summary is a small severity-tally view over a Result, used by the text and markdown writers to compose the one-line headline. It mirrors the shape of report.Summary so the rendered counts read the same in both surfaces (and so a future migration to report.Summary stays mechanical).
func SummarizeSeverities ¶
SummarizeSeverities counts findings by severity bucket.
Source Files