Documentation
¶
Index ¶
- Constants
- Variables
- func AnalyzeRepository(ctx context.Context, repoPath string) (*models.GitMetadata, error)
- func CacheKey(normalizedURL string) string
- func CleanupTarFile(path string)
- func CloneContentOnly(ctx context.Context, sourceURL, destDir, commitSHA string, ...) error
- func CloneMetadataOnly(ctx context.Context, sourceURL, destDir string) error
- func ExtractCachedRepo(tarPath, destDir string) error
- func GetCachedClone(ctx context.Context, backend cache.Backend, ...) (string, bool, error)
- func GetHeadCommit(ctx context.Context, repoPath string) (string, error)
- func GetRemoteHeadSHA(ctx context.Context, sourceURL string) (string, error)
- func GetRemoteRefSHA(ctx context.Context, sourceURL, ref string) (string, error)
- func GetVCSName(vcsType VCSType) string
- func IsFullSHA(s string) bool
- func IsPrivateRequest(ctx context.Context, sourceURL string) (bool, error)
- func NormalizeCacheURL(rawURL string) (string, error)
- func PutCachedClone(ctx context.Context, backend cache.Backend, ...) error
- func ValidateGitRef(ref string) error
- func ValidateGitRepo(path string) (string, error)
- type CIProvider
- type CloneError
- type CommitInfo
- type CommitMetrics
- type RollingWindowResult
- type VCSType
Constants ¶
const ( ErrTypeNotFound = "REPO_NOT_FOUND" ErrTypePrivateRepo = "PRIVATE_REPO" ErrTypeTimeout = "CLONE_TIMEOUT" ErrTypeUnsafeProtocol = "UNSAFE_PROTOCOL" ErrTypeUnsupportedVCS = "UNSUPPORTED_VCS" ErrTypeNetworkTransient = "NETWORK_TRANSIENT" ErrTypeOther = "GIT_ERROR" )
const (
MaxCloneTime = 30 * time.Second
)
Variables ¶
var CIProviders = map[string]CIProvider{ "GitHub Actions": { Paths: []string{".github/workflows"}, SparsePatterns: []string{".github/workflows/*.yml", ".github/workflows/*.yaml"}, }, "GitLab CI": {Paths: []string{".gitlab-ci.yml", ".gitlab-ci.yaml"}}, "CircleCI": {Paths: []string{".circleci/config.yml", ".circleci/config.yaml"}}, "Travis CI": {Paths: []string{".travis.yml"}}, "Jenkins": {Paths: []string{"Jenkinsfile"}}, "Azure Pipelines": {Paths: []string{"azure-pipelines.yml"}}, "Bitbucket Pipelines": {Paths: []string{"bitbucket-pipelines.yml"}}, "AppVeyor": {Paths: []string{"appveyor.yml"}}, }
CIProviders is the single source of truth for all supported CI services. Key is the human-readable service name used in reporting.
var SecurityPolicyPaths = []string{
"SECURITY.md",
"SECURITY.txt",
"SECURITY.rst",
".github/SECURITY.md",
"docs/SECURITY.md",
}
SecurityPolicyPaths lists candidate locations for a security policy file. Used by the sparse checkout (to fetch these files) and the SOURCE_NO_SECURITY_POLICY check.
var SparseCheckoutPatterns = append(append([]string{ ".risk-guard.yml", ".riskguardignore", }, SecurityPolicyPaths...), ciSparsePatterns()...)
SparseCheckoutPatterns collects all file patterns needed by source checks for sparse checkout.
Functions ¶
func AnalyzeRepository ¶
func CacheKey ¶
CacheKey returns a sha256 hex digest of a normalized URL, suitable for use as a path component.
func CleanupTarFile ¶
func CleanupTarFile(path string)
CleanupTarFile removes a temp tar file, ignoring errors.
func CloneContentOnly ¶
func CloneMetadataOnly ¶
CloneMetadataOnly uses --filter=tree:0 --no-checkout to avoid downloading file content, reducing clone size for repos where only commit history is needed.
func ExtractCachedRepo ¶
ExtractCachedRepo extracts a cached tar.gz into destDir.
func GetCachedClone ¶
func GetCachedClone(ctx context.Context, backend cache.Backend, patternsHash, normalizedURL, commitSHA string) (string, bool, error)
GetCachedClone retrieves a cached repo tar.gz, writing it to a temp file. Returns ("", false, nil) on cache miss.
func GetRemoteHeadSHA ¶
GetRemoteHeadSHA returns the commit SHA that HEAD points to on the remote, without cloning. Returns ("", nil) for empty repos that have no HEAD ref.
func GetRemoteRefSHA ¶
GetRemoteRefSHA resolves an arbitrary git ref (branch, tag, commit prefix) to a full SHA via ls-remote.
func GetVCSName ¶
GetVCSName returns a human-readable name for the VCS type
func IsPrivateRequest ¶
IsPrivateRequest returns true if the request has authentication that indicates a private repo.
func NormalizeCacheURL ¶
NormalizeCacheURL normalizes a source URL for use as a cache key component. Composes on NormalizeSourceURL (semantic normalization: known host upgrades, owner/repo extraction), then applies mechanical normalization (case folding, credential stripping, suffix cleanup).
func PutCachedClone ¶
func PutCachedClone(ctx context.Context, backend cache.Backend, patternsHash, normalizedURL, commitSHA, repoDir string) error
PutCachedClone creates a tar.gz of repoDir and stores it in the cache backend.
func ValidateGitRef ¶
ValidateGitRef validates that a git ref (commit, tag, branch) contains only safe characters.
func ValidateGitRepo ¶
Types ¶
type CIProvider ¶
type CIProvider struct {
Paths []string // file/dir paths to check for existence
SparsePatterns []string // sparse checkout globs; nil means same as Paths
}
CIProvider defines the file paths and sparse checkout patterns for a CI service.
type CloneError ¶
func (*CloneError) Error ¶
func (e *CloneError) Error() string
func (*CloneError) Unwrap ¶
func (e *CloneError) Unwrap() error
type CommitInfo ¶
type CommitMetrics ¶
type RollingWindowResult ¶
type VCSType ¶
type VCSType string
VCSType represents the type of version control system
func DetectVCSFromURL ¶
DetectVCSFromURL attempts to determine the VCS type from a repository URL Returns the detected VCS type and whether it's supported by Risk Guard Assumes Git unless a known non-Git alternative is detected
Source Files