govulncheck

type Analyzer struct {
	// Runner is the underlying govulncheck driver. Defaults to
	// NewRunner(Logger) when nil.
	Runner Runner
	Logger *zap.Logger
	// CacheDir overrides the default per-module result cache location.
	// Empty means "use the OS user cache directory under bomly/analyzers/govulncheck".
	CacheDir string
	// CacheTTL overrides the default 24h cache lifetime. Zero means use
	// the default. Negative values are treated as "no cache" (the cache
	// helper coerces them to default; explicit disable is via DisableCache).
	CacheTTL time.Duration
	// DisableCache turns off the on-disk result cache entirely. Useful in
	// CI smoke runs where freshness matters more than speed.
	DisableCache bool
}

type Finding struct {
	OSV        string
	Aliases    []string
	FixedIn    string
	Modules    []string
	Symbols    []model.AffectedSymbol
	CallPaths  []model.CallPath
	ImportedBy bool // app source imports the affected module/package
	CalledBy   bool // app source calls into an affected symbol
}

type Runner interface {
	// Name returns a stable identifier (e.g. "library") for telemetry and
	// Reason fields.
	Name() string
	// Run executes govulncheck rooted at moduleDir and returns the parsed
	// findings. moduleDir must contain a go.mod file.
	Run(ctx context.Context, moduleDir string) (RunnerResult, error)
}

type RunnerResult struct {
	// Findings keyed by canonical OSV ID (e.g. "GO-2023-2049").
	Findings map[string]Finding
	// ImportedModules is the set of module paths the application
	// transitively imports, keyed by module path. Used to distinguish
	// package-level reachability ("imported but no symbol called") from
	// "not imported at all".
	ImportedModules map[string]struct{}
}