Documentation
¶
Overview ¶
Package introspect works out how a repository runs.
It is deliberately deterministic: no model is involved. Rule-based detection cannot reach every repository, but it reaches a useful majority, and what it produces can be explained line by line -- every service and task it emits carries the file it was read from. A generated manifest a developer cannot audit is worse than no manifest, because they will run it anyway.
The evidence is consulted in order of how much it actually knows:
- An existing compose file or devcontainer. This is not detection at all, it is transcription, and it is the highest-signal input by a wide margin.
- GitHub Actions `services:` blocks. Near-literal service definitions, with health commands already spelled out in `options:`, kept current because CI breaks when they are wrong.
- Procfiles, package manifests and framework conventions, which are good for the start command and poor for the port.
What it will not do is invent an egress allowlist. That is not an oversight: if configuration produced from repository content could widen the network policy, then repository content could widen the network policy, and the sandbox would be arguing with itself.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Render ¶
Render turns a detected manifest into the file a developer will read.
The header is not decoration. A generated manifest is about to be executed, and the two questions a reviewer has are "where did this come from" and "what is still wrong" -- so both are answered at the top of the file rather than in terminal output that scrolls away. The gaps stay in the file until somebody deletes them, which is the point.
Types ¶
type Evidence ¶
type Evidence struct {
Source Source `json:"source"`
Path string `json:"path,omitempty"`
Detail string `json:"detail"`
}
Evidence is one thing the detector concluded, and why.
type Result ¶
type Result struct {
Manifest *manifest.Manifest `json:"-"`
Evidence []Evidence `json:"evidence"`
// Gaps are the things a human still has to decide. Naming them is the
// difference between a manifest that fails cleanly and one that fails
// mysteriously.
Gaps []string `json:"gaps"`
// Unverified records that `--verify` booted this proposal and it did not
// come up, with the failure. It is written into the file because the
// terminal line saying so scrolls away, and what is left behind afterwards
// is a manifest that looks exactly like one that worked.
Unverified string `json:"unverified,omitempty"`
}
Result is a detected manifest plus an account of how it was reached.
type Source ¶
type Source string
Source names where a conclusion came from.
const ( SourceCompose Source = "compose" SourceDevcontainer Source = "devcontainer" SourceActions Source = "github-actions" SourceProcfile Source = "procfile" SourcePackageJSON Source = "package.json" SourcePython Source = "python" SourceGo Source = "go" SourceRuby Source = "ruby" SourceConvention Source = "convention" )
Source Files