report

type RefFinding struct {
	File      string        `json:"file"`
	Line      int           `json:"line"`
	Kind      string        `json:"kind"`
	Image     string        `json:"image"`
	Status    assess.Status `json:"status"`
	Severity  string        `json:"severity"`
	Reason    string        `json:"reason"`
	Platforms []string      `json:"platforms,omitempty"`
	Fix       string        `json:"fix,omitempty"`
}

type Report struct {
	Tool    string   `json:"tool"`
	Version string   `json:"version"`
	CVEs    []string `json:"cves"`
	// DataSnapshot is when the distribution fix data was collected.
	DataSnapshot string    `json:"data_snapshot"`
	Targets      []*Target `json:"targets"`
}

type Target struct {
	Name     string               `json:"target"`
	Type     string               `json:"type"` // "filesystem", "image" or "repository"
	Digest   string               `json:"digest,omitempty"`
	Platform string               `json:"platform,omitempty"`
	Root     string               `json:"root,omitempty"` // SARIF paths are relative to it
	OS       *knowledge.OSRelease `json:"os,omitempty"`
	Files    int                  `json:"files_scanned"`
	Findings []assess.Finding     `json:"findings"`
	Refs     []RefFinding         `json:"references,omitempty"`
	// RefsChecked counts image references examined in a repository scan,
	// including those that are not PHP.
	RefsChecked int           `json:"references_checked,omitempty"`
	Skipped     []source.Skip `json:"skipped"`
	// Problems lists package databases that could not be read fully.
	Problems []string `json:"problems,omitempty"`
	// Incomplete says why the scan could not finish (a registry failed). The
	// results are shown but are not the whole picture, and the exit status is 2.
	Incomplete string `json:"incomplete,omitempty"`
	Error      string `json:"error,omitempty"`
}