resolver

package
v1.12.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 27, 2026 License: Apache-2.0 Imports: 41 Imported by: 0

Documentation

Overview

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

Package resolver implements Terraform module resolution for tfmodules.RemoteResolver.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

  • Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *

  • This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.

Index

Constants

View Source 
const (
	DefaultMaxCacheBytes = 2 * 1024 * 1024 * 1024

	CacheSubdirModules  = "modules"
	CacheSubdirGitBare  = "git-bare"
	CacheSubdirGitLocal = "git-local"
)
View Source 
const (
	DefaultFetchTimeout   = 30 * time.Second
	DefaultMaxModuleBytes = 0
	DefaultMaxTotalBytes  = 200 * 1024 * 1024
)
View Source 
const (
	DefaultMaxPackageBytes = 128 * 1024 * 1024
	DefaultMaxFileBytes    = 5 * 1024 * 1024
	DefaultMaxPackageFiles = 10_000
)

Variables

View Source 
var FetchConcurrency = fetchConcurrencyFromEnv()

FetchConcurrency bounds simultaneous go-getter downloads (IAC_MODULE_FETCH_CONCURRENCY).

View Source 
var HostFetchConcurrency = hostFetchConcurrencyFromEnv()

Functions

func DefaultModuleCacheRoot added in v1.12.0 

func DefaultModuleCacheRoot() (string, error)

func GitModuleResolveKey added in v1.8.0 

func GitModuleResolveKey(source, version string) (string, bool)

GitModuleResolveKey returns a canonical cache key for pinnable git module sources. Transport scheme is part of the key so HTTPS and SSH spellings cannot coalesce. A missing ref is treated as HEAD so default-branch sources still share an identity.

func ModuleCacheSubdir added in v1.12.0 

func ModuleCacheSubdir(root, name string) string

func NewModuleCache 

func NewModuleCache() (*moduleCache, error)

func NewModuleCacheWithDir added in v1.12.0 

func NewModuleCacheWithDir(dir string, budget *ModuleCacheBudget) (*moduleCache, error)

func NewRegistryCache added in v1.8.0 

func NewRegistryCache(timeout time.Duration, hostAllowlist ...string) *registryCache

func ResolvePathWithinRoot added in v1.12.0 

func ResolvePathWithinRoot(ctx context.Context, root, target string) (string, error)

func ScannableTerraformPath added in v1.12.0 

func ScannableTerraformPath(ctx context.Context, entry fs.DirEntry, dir, packageRoot string) (path string, ok bool)

ScannableTerraformPath reports whether a directory entry is a .tf file that can be read. Regular files are accepted. Symlinks are accepted only when their target is a regular file confined within packageRoot (or dir when packageRoot is empty).

func WithResolvedPathCache added in v1.12.0 

func WithResolvedPathCache(ctx context.Context) context.Context

WithResolvedPathCache attaches a scan-scoped EvalSymlinks cache to ctx. Nested calls reuse the existing cache so graph walking and evaluation share hits.

func WithResourceBudget added in v1.12.0 

func WithResourceBudget(ctx context.Context, budget *ResourceBudget) context.Context

Types

type AcquisitionLease added in v1.12.0 

type AcquisitionLease struct {
	// contains filtered or unexported fields
}

func (*AcquisitionLease) Bytes added in v1.12.0 

func (l *AcquisitionLease) Bytes() int64

func (*AcquisitionLease) Release added in v1.12.0 

func (l *AcquisitionLease) Release()

type BareGitResolver added in v1.8.0 

type BareGitResolver struct {
	// Defaults to <user-cache-dir>/datadog-iac-scanner/git-bare.
	CacheDir string
	Budget   *ModuleCacheBudget
	// contains filtered or unexported fields
}

BareGitResolver keeps one bare clone per repo and extracts refs via git archive.

func NewBareGitResolver added in v1.8.0 

func NewBareGitResolver(cacheDir string, hostAllowlist ...string) *BareGitResolver

func (*BareGitResolver) Resolve added in v1.8.0 

func (r *BareGitResolver) Resolve(ctx context.Context, mod *tfmodules.ParsedModule) (Resolution, error)

Resolve implements Resolver for pinnable git:: sources. A missing ref uses HEAD.

type BudgetExceededError added in v1.12.0 

type BudgetExceededError struct {
	Gate     string
	Limit    string
	Maximum  int64
	Measured int64
}

func (*BudgetExceededError) Error added in v1.12.0 

func (e *BudgetExceededError) Error() string

type ChainResolver 

type ChainResolver struct {
	// contains filtered or unexported fields
}

ChainResolver tries each Resolver in order.

func NewChainResolver 

func NewChainResolver(resolvers ...Resolver) *ChainResolver

func (*ChainResolver) Resolve 

func (c *ChainResolver) Resolve(ctx context.Context, mod *tfmodules.ParsedModule) (Resolution, error)

type DotTerraformResolver 

type DotTerraformResolver struct {
	RootDirs []string
	// contains filtered or unexported fields
}

DotTerraformResolver reads terraform init output: .terraform/modules/modules.json.

func (*DotTerraformResolver) Resolve 

func (r *DotTerraformResolver) Resolve(ctx context.Context, mod *tfmodules.ParsedModule) (Resolution, error)

type GoGetterConfig added in v1.8.0 

type GoGetterConfig struct {
	Disabled bool

	FetchTimeout time.Duration
	// MaxModuleBytes caps each individual module fetch when no graph budget is attached.
	MaxModuleBytes int64
	// MaxTotalBytes is retained for standalone resolver compatibility.
	MaxTotalBytes int64

	HostAllowlist []string
	Cache         *moduleCache
	RegistryCache *registryCache
	// Git resolves pinnable git:: download URLs (registry X-Terraform-Get and
	// default-branch sources) through BareGit instead of an unpinned git subprocess.
	Git Resolver

	TmpDir string
	// contains filtered or unexported fields
}

GoGetterConfig holds caps and options for GoGetterResolver. It must not be copied after first use (contains atomic.Int64 and a channel); always use a pointer.

func NewGoGetterConfig added in v1.8.0 

func NewGoGetterConfig() *GoGetterConfig

NewGoGetterConfig returns default fetch limits and concurrency controls.

type GoGetterResolver added in v1.8.0 

type GoGetterResolver struct {
	// contains filtered or unexported fields
}

GoGetterResolver downloads modules via hashicorp/go-getter (registry translation, caps, cache).

func NewGoGetterResolver added in v1.8.0 

func NewGoGetterResolver(cfg *GoGetterConfig) *GoGetterResolver

func (*GoGetterResolver) Resolve added in v1.8.0 

func (r *GoGetterResolver) Resolve(ctx context.Context, mod *tfmodules.ParsedModule) (Resolution, error)

type LocalGitRefResolver added in v1.8.0 

type LocalGitRefResolver struct {
	ScanRoots []string

	// Defaults to <user-cache-dir>/datadog-iac-scanner/git-local.
	CacheDir string
	Budget   *ModuleCacheBudget
	// contains filtered or unexported fields
}

LocalGitRefResolver extracts self-referential git modules from the local checkout.

func NewLocalGitRefResolver added in v1.8.0 

func NewLocalGitRefResolver(scanRoots []string, cacheDir string) *LocalGitRefResolver

func (*LocalGitRefResolver) Resolve added in v1.8.0 

func (r *LocalGitRefResolver) Resolve(ctx context.Context, mod *tfmodules.ParsedModule) (Resolution, error)

Resolve implements Resolver for git:: sources that reference the local checkout.

type LocalResolver 

type LocalResolver struct{}

LocalResolver resolves local filesystem module sources.

func (LocalResolver) Resolve 

func (LocalResolver) Resolve(_ context.Context, mod *tfmodules.ParsedModule) (Resolution, error)

type Manifest 

type Manifest struct {
	Dir     string                   `json:"dir"`
	Modules map[string]ManifestEntry `json:"modules"`
}

Manifest is validated JSON: optional root Dir plus source or source@version → ManifestEntry.

func LoadManifest 

func LoadManifest(path string) (*Manifest, error)

LoadManifest parses and validates manifest JSON from path.

type ManifestEntry 

type ManifestEntry struct {
	LocalPath   string `json:"local_path"`
	PackageRoot string `json:"package_root,omitempty"`
	Version     string `json:"version,omitempty"`
	Origin      string `json:"origin,omitempty"`
}

ManifestEntry is one row in a --modules-manifest JSON file.

type ModuleCacheBudget added in v1.12.0 

type ModuleCacheBudget struct {
	// contains filtered or unexported fields
}

ModuleCacheBudget tracks one byte limit shared across modules/, git-bare/, and git-local/.

func NewModuleCacheBudget added in v1.12.0 

func NewModuleCacheBudget(root string, maxBytes int64) (*ModuleCacheBudget, error)

func (*ModuleCacheBudget) Admit added in v1.12.0 

func (b *ModuleCacheBudget) Admit(keep string)

func (*ModuleCacheBudget) EnsureEntryFits added in v1.12.0 

func (b *ModuleCacheBudget) EnsureEntryFits(path string) error

func (*ModuleCacheBudget) Lease added in v1.12.0 

func (b *ModuleCacheBudget) Lease(path string) func()

func (*ModuleCacheBudget) MaxBytes added in v1.12.0 

func (b *ModuleCacheBudget) MaxBytes() int64

func (*ModuleCacheBudget) Pin added in v1.12.0 

func (b *ModuleCacheBudget) Pin(path string)

func (*ModuleCacheBudget) Root added in v1.12.0 

func (b *ModuleCacheBudget) Root() string

func (*ModuleCacheBudget) Unpin added in v1.12.0 

func (b *ModuleCacheBudget) Unpin(path string)

func (*ModuleCacheBudget) WithPin added in v1.12.0 

func (b *ModuleCacheBudget) WithPin(path string, fn func() error) error

type PackageCounter added in v1.12.0 

type PackageCounter struct {
	// contains filtered or unexported fields
}

func (*PackageCounter) AddEntry added in v1.12.0 

func (c *PackageCounter) AddEntry(size int64) error

func (*PackageCounter) Usage added in v1.12.0 

func (c *PackageCounter) Usage() PackageUsage

type PackageUsage added in v1.12.0 

type PackageUsage struct {
	Bytes int64
	Files int
}

func MeasurePackage added in v1.12.0 

func MeasurePackage(ctx context.Context, root string, limits ResourceLimits) (PackageUsage, error)

type PrefetchedResolver 

type PrefetchedResolver struct {
	// contains filtered or unexported fields
}

PrefetchedResolver resolves modules from a --modules-manifest.

func NewPrefetchedResolver 

func NewPrefetchedResolver(m *Manifest) *PrefetchedResolver

func (*PrefetchedResolver) Resolve 

func (r *PrefetchedResolver) Resolve(ctx context.Context, mod *tfmodules.ParsedModule) (Resolution, error)

type Resolution 

type Resolution struct {
	LocalPath       string
	PackageRoot     string
	ResolvedVersion string
	ResolvedRef     string
	Cleanup         func() // optional post-scan cleanup
}

Resolution holds an acquired package, its selected module directory, and optional cleanup.

func ConfineResolution added in v1.12.0 

func ConfineResolution(ctx context.Context, res Resolution) (Resolution, error)

type Resolver 

type Resolver interface {
	Resolve(ctx context.Context, mod *tfmodules.ParsedModule) (Resolution, error)
}

Resolver maps one module call to disk; errors should wrap *tfmodules.UnresolvedError when appropriate.

type ResourceBudget added in v1.12.0 

type ResourceBudget struct {
	// contains filtered or unexported fields
}

func NewResourceBudget added in v1.12.0 

func NewResourceBudget(limits ResourceLimits) *ResourceBudget

func ResourceBudgetFromContext added in v1.12.0 

func ResourceBudgetFromContext(ctx context.Context) *ResourceBudget

func (*ResourceBudget) AcquireAcquisition added in v1.12.0 

func (b *ResourceBudget) AcquireAcquisition(
	ctx context.Context, maximum, requested int64,
) (*AcquisitionLease, bool)

func (*ResourceBudget) AdmitPackage added in v1.12.0 

func (b *ResourceBudget) AdmitPackage(identity string, usage PackageUsage) error

func (*ResourceBudget) Limits added in v1.12.0 

func (b *ResourceBudget) Limits() ResourceLimits

func (*ResourceBudget) NewPackageCounter added in v1.12.0 

func (b *ResourceBudget) NewPackageCounter() *PackageCounter

func (*ResourceBudget) TotalUsage added in v1.12.0 

func (b *ResourceBudget) TotalUsage() PackageUsage

func (*ResourceBudget) TryAcquireAcquisition added in v1.12.0 

func (b *ResourceBudget) TryAcquireAcquisition(maximum, requested int64) (*AcquisitionLease, bool)

func (*ResourceBudget) Usage added in v1.12.0 

func (b *ResourceBudget) Usage(identity string) (PackageUsage, bool)

type ResourceLimits added in v1.12.0 

type ResourceLimits struct {
	MaxPackageBytes int64
	MaxFileBytes    int64
	MaxPackageFiles int
	MaxTotalBytes   int64
}

func (ResourceLimits) Enabled added in v1.12.0 

func (l ResourceLimits) Enabled() bool

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.