Documentation
¶
Overview ¶
Package scanner holds the Leakwatch scan orchestration that used to live in the cmd/ layer: assembling the engine configuration, running a single-source scan, running multiple git repositories in parallel, and post-processing results (.leakwatchignore filtering and remediation enrichment).
Keeping this logic out of cmd/ restores the "thin wiring layer" contract that package cmd declares for itself (ADR-0002) and makes the pipeline — including the concurrent multi-repo orchestration — unit- and race-testable without any Cobra plumbing.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BuildEngineConfig ¶
BuildEngineConfig assembles the engine.Config shared by every scan command.
Custom rules are compiled into detectors and appended to a local slice built from detector.All(); the process-global registry is never mutated, which makes BuildEngineConfig idempotent and test-isolated (previously each scan wrote its custom rules into the global registry, so a second call in the same process silently rejected them). A custom rule whose ID collides with an existing detector is skipped with a warning, matching the previous non-panicking registration semantics.
func Run ¶
Run executes a single-source scan: it builds the engine, runs the scan under the given (already signal-aware) context, and post-processes the result (.leakwatchignore filtering and remediation enrichment).
It returns the engine's scan result together with the scan error. The error is non-nil on interruption (ctx cancelled) or a terminal source failure; in the interruption case a partial, non-nil result is still returned so the caller can render partial findings and choose a distinct interrupted exit code. Only a pre-scan failure (e.g. source validation) yields a nil result.
func ScanRepos ¶
func ScanRepos(ctx context.Context, cfg *Config, repoURLs []string, srcOpts []gitsource.Option, parallel int) (*engine.ScanResult, error)
ScanRepos scans multiple git repositories in parallel and combines their findings into a single result.
A SINGLE engine (and therefore a single shared verifier rate limiter) is constructed once and reused across every repository goroutine, so the configured verification.rate-limit is enforced globally rather than being multiplied by the parallelism factor. Repositories are cloned/scanned concurrently up to `parallel` at a time; findings are aggregated under a mutex and post-processed identically to a single-source scan (the ignore root is empty because repos are remote/temporary clones — only a CWD .leakwatchignore applies).
The returned error is non-nil when one or more repositories failed to scan (distinct from findings, which are surfaced via the result). The combined result's Interrupted flag reflects context cancellation.
Types ¶
type Config ¶
type Config struct {
Concurrency int
MaxFileSize int64 // used by cmd/ to build sources
ExcludePaths []string // used by cmd/ to build sources
ExcludeDetectors []string
EnableEntropy bool
EntropyThreshold float64
ShowRaw bool
OutputFile string
Format string
NoVerify bool
OnlyVerified bool
MinSeverity finding.Severity
EnableRemediation bool
// ScanRoot is the root path used to discover a .leakwatchignore file (in
// addition to the current working directory). It is empty for sources with no
// meaningful local root (remote repos, buckets, images, Slack).
ScanRoot string
// ScanTarget is a display name for the scan summary (path, URL, image ref).
ScanTarget string
// Verification engine settings sourced from the `verification:` config block.
VerifyEnabled bool
VerifyTimeout time.Duration
VerifyConcurrency int
VerifyRateLimit float64
// CustomRules are user-defined YAML custom rules from the `custom-rules:`
// config block. BuildEngineConfig compiles them into detectors threaded
// through engine.Config without touching the process-global detector
// registry, so repeated scans in one process stay idempotent.
CustomRules []custom.RuleDef
}
Config holds the fully-resolved settings for a scan, independent of Cobra and Viper. The cmd/ layer parses flags/config into this struct and hands it to the scanner entry points; nothing here references a *cobra.Command or *pflag.Flag.
Source Files