Documentation
¶
Overview ¶
Package githubpr opens a real pull request containing TheKnight's remediation output against a GitHub repository, using the GitHub REST API directly — no local git clone, no shelling out to the git binary. Every file lands in one new commit on one new branch off the target repo's default branch, alongside a PR description summarizing what's being fixed. Nothing here ever pushes to an existing branch or merges anything: opening the PR is the entire scope, same trust boundary as the rest of TheKnight (see the README's Security section) — a human still reviews and merges.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FixFilePath ¶
FixFilePath derives a safe repo-relative path for a fix from its finding. AWS-returned identifiers (an IAM role's Resource.ID is a full ARN, slashes and colons included) are run through remediate.SafeIdent — building a file path directly from an unsanitized AWS string is a path-safety problem, not just a display one, the same reasoning that drove the %q-escaping fixes in pkg/remediate's Terraform generation.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client opens remediation PRs via the GitHub API.
func New ¶
New builds a Client authenticated with a GitHub personal access token (fine-grained or classic; needs Contents: Read & write and Pull requests: Read & write on the target repo). Deliberately takes the token as a parameter rather than reading an env var itself — the caller (cmd/theknight) owns exactly how it's sourced, and should never accept it as a CLI flag (shell history, process list — same reasoning as AWS credentials never being a --secret-key flag).
func (*Client) CreatePR ¶
func (c *Client) CreatePR(ctx context.Context, owner, repo, baseBranch string, fixes []FileFix) (string, error)
CreatePR opens a pull request against owner/repo containing one file per fix, in a single new commit on a new branch off the repo's default branch (or baseBranch, if non-empty). Returns the PR's HTML URL.
Source Files