reposcan

type Item struct {
	Result repocheck.Result `json:"result"`
	// Change is the verified edit that fixes it, when one exists.
	Change *fix.Change `json:"change,omitempty"`
	// Decline says why there is no edit, for a vulnerable reference without one.
	Decline *fix.Decline `json:"decline,omitempty"`
}

type Options struct {
	Registry registry.Options
	Refs     refs.Options
	// Parallel is how many references are resolved at once (default 4).
	Parallel int
	// Files limits the scan to these repository-relative files (a PR's changed
	// files); empty scans the whole tree.
	Files []string
	// NoPlan skips fix planning (no tag listing).
	NoPlan bool
	// MaxImages caps the distinct image references resolved (default 200), so a
	// repository cannot make one scan spend a registry's rate limit for everyone.
	// References past the cap are listed as not checked.
	MaxImages int
}

type TransientError struct{ Refs []string }