Documentation
¶
Overview ¶
Package trust provides the boolean-combinator trust-decision framework for the maintainer-watcher-github-pr. Callers compose leaves with And, Or, and Not to express compound trust policies without modifying the watcher core.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type And ¶
type And []Trust
And succeeds only if every member succeeds. Evaluates ALL members (no short-circuit) to produce a complete audit trail. An empty And returns vacuous success — callers must ensure non-empty slices for security-relevant decisions (startup validation enforces this).
type Func ¶
Func adapts a plain function to the Trust interface. Useful for inline trust checks without struct boilerplate.
type Or ¶
type Or []Trust
Or succeeds if any member succeeds. Evaluates ALL members (no short-circuit) to produce a complete audit trail. An empty Or returns vacuous failure — callers must ensure non-empty slices for security-relevant decisions.
type PR ¶
type PR struct {
AuthorLogin string
}
PR is the trust-evaluation input derived from a GitHub pull request. Only the fields needed for trust decisions are included.
type Result ¶
Result captures a trust decision and a human-readable description. The description is the audit trail: why was this PR trusted or denied?
type Trust ¶
Trust is the single-method trust-decision interface. Each implementation returns both an outcome (trusted/denied) and a human-readable description forming the audit trail for the decision.
func NewAuthorAllowlist ¶
NewAuthorAllowlist returns a Trust leaf that grants trust by exact GitHub login membership (case-sensitive byte equality).
Fail-safe rules:
- Empty members list → always denies.
- PR with empty AuthorLogin → always denies (author unknown).
Operators are responsible for matching GitHub's stored casing.
Source Files