benchmark

package
v0.19.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 17, 2026 License: Apache-2.0 Imports: 21 Imported by: 0

Documentation

Overview

Package benchmark owns Bomly's hidden local dependency-graph benchmark.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func BuildSourceSummaryWithPolicy added in v0.19.0 

func BuildSourceSummaryWithPolicy(source string, bomlyDoc, sourceDoc *sbom.Document, artifacts SourceArtifacts, policy ComparisonPolicy) (SourceSummary, ComparisonReport)

BuildSourceSummaryWithPolicy compares two filtered SBOM documents and classifies independently adjudicated Bomly-only graph extensions.

func FilterDocument 

func FilterDocument(doc *sbom.Document, ecosystem sdk.Ecosystem) *sbom.Document

FilterDocument returns a copy containing only packages from ecosystem and their relationships.

func ParseNames 

func ParseNames(values ...string) []string

ParseNames parses a comma-separated selector list.

func RenderText 

func RenderText(w io.Writer, summary RunSummary) error

RenderText writes a compact benchmark score matrix.

Types

type AdjudicatedRelationship added in v0.19.0 

type AdjudicatedRelationship struct {
	From   string `json:"from"`
	To     string `json:"to"`
	Reason string `json:"reason"`
}

AdjudicatedRelationship records a pinned relationship that is present in repository evidence but absent from a benchmark source.

type CaseSummary 

type CaseSummary struct {
	SchemaVersion string          `json:"schema_version"`
	Case          string          `json:"case"`
	Repository    string          `json:"repository"`
	HeadSHA       string          `json:"head_sha,omitempty"`
	Ecosystem     sdk.Ecosystem   `json:"ecosystem"`
	Status        string          `json:"status"`
	Reason        string          `json:"reason,omitempty"`
	Detectors     []string        `json:"used_detectors,omitempty"`
	Sources       []SourceSummary `json:"sources,omitempty"`
	Scores        *ScoreSummary   `json:"scores,omitempty"`
	Agreement     *ScoreSummary   `json:"agreement_scores,omitempty"`
}

CaseSummary describes one repository comparison case.

type ComparisonDifference added in v0.19.0 

type ComparisonDifference struct {
	Kind           string `json:"kind"`
	Classification string `json:"classification"`
	PURL           string `json:"purl,omitempty"`
	BomlyPURL      string `json:"bomly_purl,omitempty"`
	SourcePURL     string `json:"source_purl,omitempty"`
	From           string `json:"from,omitempty"`
	To             string `json:"to,omitempty"`
	Reason         string `json:"reason,omitempty"`
}

ComparisonDifference describes one exact package or relationship mismatch.

type ComparisonPolicy added in v0.19.0 

type ComparisonPolicy struct {
	PackageExtensions      map[string]string
	RelationshipExtensions map[string]string
}

ComparisonPolicy identifies Bomly-only packages and relationships that have independent evidence and should be reported as graph extensions, not errors.

type ComparisonReport added in v0.19.0 

type ComparisonReport struct {
	SchemaVersion string                 `json:"schema_version"`
	Differences   []ComparisonDifference `json:"differences,omitempty"`
}

ComparisonReport records every non-matching package and relationship.

type NativeScanFunc 

type NativeScanFunc func(context.Context, NativeScanRequest) (NativeScanResult, error)

NativeScanFunc executes Bomly's native detectors without managed plugins or configuration files.

type NativeScanRequest 

type NativeScanRequest struct {
	CheckoutDir  string
	Repository   string
	Revision     string
	Ecosystem    sdk.Ecosystem
	InstallFirst bool
}

NativeScanRequest describes one in-process Bomly native-detector scan.

type NativeScanResult 

type NativeScanResult struct {
	Graph     *sdk.Graph
	Detectors []string
}

NativeScanResult contains the graph and detector provenance from one native scan.

type PackageMetrics 

type PackageMetrics struct {
	BomlyCount      int     `json:"bomly_count"`
	SourceCount     int     `json:"source_count"`
	ExactMatches    int     `json:"exact_matches"`
	VersionMismatch int     `json:"version_mismatches"`
	BomlyOnly       int     `json:"bomly_only"`
	Extensions      int     `json:"adjudicated_extensions"`
	Unadjudicated   int     `json:"unadjudicated_bomly_only"`
	SourceOnly      int     `json:"source_only"`
	BomlyIgnored    int     `json:"bomly_ignored_without_purl"`
	SourceIgnored   int     `json:"source_ignored_without_purl"`
	Score           float64 `json:"score"`
	AgreementScore  float64 `json:"agreement_score"`
}

PackageMetrics describes PURL-normalized package overlap.

type PublicGitHubRepository 

type PublicGitHubRepository struct {
	URL  string
	Slug string
}

PublicGitHubRepository is a validated public GitHub repository selector.

func ParsePublicGitHubRepository 

func ParsePublicGitHubRepository(value string) (PublicGitHubRepository, error)

ParsePublicGitHubRepository validates a public-repository URL shape.

type RelationshipMetrics 

type RelationshipMetrics struct {
	BomlyCount     int      `json:"bomly_count"`
	SourceCount    int      `json:"source_count"`
	Matched        int      `json:"matched"`
	BomlyOnly      int      `json:"bomly_only"`
	Extensions     int      `json:"adjudicated_extensions"`
	Unadjudicated  int      `json:"unadjudicated_bomly_only"`
	SourceOnly     int      `json:"source_only"`
	Score          *float64 `json:"score,omitempty"`
	AgreementScore *float64 `json:"agreement_score,omitempty"`
}

RelationshipMetrics describes PURL-normalized dependency-edge overlap.

type RunOptions 

type RunOptions struct {
	ManifestPath       string
	RunDir             string
	SelectedCases      []string
	SelectedSources    []string
	SelectedEcosystems []string
	CustomRepository   string
	InstallFirst       bool
	Notifications      io.Writer
	HTTPClient         *http.Client
	Logger             *zap.Logger
	NativeScan         NativeScanFunc
}

RunOptions configures one hidden benchmark invocation.

type RunSummary 

type RunSummary struct {
	SchemaVersion string        `json:"schema_version"`
	Status        string        `json:"status"`
	Reason        string        `json:"reason,omitempty"`
	RunDir        string        `json:"run_dir"`
	Cases         []CaseSummary `json:"cases,omitempty"`
	Scores        *ScoreSummary `json:"scores,omitempty"`
	Agreement     *ScoreSummary `json:"agreement_scores,omitempty"`
}

RunSummary describes a complete hidden benchmark invocation.

func Run 

func Run(ctx context.Context, opts RunOptions) (RunSummary, error)

Run executes the hidden local benchmark and writes deterministic artifacts.

type ScopeSummary 

type ScopeSummary struct {
	KnownScopeCount   int            `json:"known_scope_count"`
	UnknownScopeCount int            `json:"unknown_scope_count"`
	Scopes            map[string]int `json:"scopes,omitempty"`
}

ScopeSummary describes scope metadata availability for one SBOM source.

type ScoreSummary 

type ScoreSummary struct {
	Package      float64  `json:"package"`
	Relationship *float64 `json:"relationship,omitempty"`
	Overall      float64  `json:"overall"`
}

ScoreSummary contains the benchmark scores for one comparison or aggregate.

type SourceArtifacts 

type SourceArtifacts struct {
	SBOM       string `json:"sbom,omitempty"`
	RawSBOM    string `json:"raw_sbom,omitempty"`
	Diff       string `json:"diff,omitempty"`
	Log        string `json:"log,omitempty"`
	Response   string `json:"response,omitempty"`
	Summary    string `json:"summary,omitempty"`
	Mismatches string `json:"mismatches,omitempty"`
}

SourceArtifacts records paths relative to one benchmark case directory.

type SourceSummary 

type SourceSummary struct {
	Source        string               `json:"source"`
	Role          string               `json:"role,omitempty"`
	Status        string               `json:"status"`
	Reason        string               `json:"reason,omitempty"`
	Artifacts     SourceArtifacts      `json:"artifacts,omitempty"`
	Detectors     []string             `json:"used_detectors,omitempty"`
	Packages      *PackageMetrics      `json:"packages,omitempty"`
	Relationships *RelationshipMetrics `json:"relationships,omitempty"`
	BomlyScope    *ScopeSummary        `json:"bomly_scope,omitempty"`
	SourceScope   *ScopeSummary        `json:"source_scope,omitempty"`
	Scores        *ScoreSummary        `json:"scores,omitempty"`
	Agreement     *ScoreSummary        `json:"agreement_scores,omitempty"`
}

SourceSummary describes one baseline comparison.

func BuildSourceSummary 

func BuildSourceSummary(source string, bomlyDoc, sourceDoc *sbom.Document, artifacts SourceArtifacts) SourceSummary

BuildSourceSummary compares two filtered SBOM documents.

type Target 

type Target struct {
	Name      string        `json:"name"`
	URL       string        `json:"url"`
	Ref       string        `json:"ref"`
	Ecosystem sdk.Ecosystem `json:"ecosystem"`
	Args      []string      `json:"args,omitempty"`
	Tools     []string      `json:"tools,omitempty"`
	// Detectors pins the smoke scan to the detector selector(s) whose output
	// the golden encodes (passed as --detectors). With a pinned selector set
	// the engine skips any fallback outside it, so a degraded environment
	// (e.g. a flaked java readiness probe) fails the case loudly instead of
	// silently regenerating a fallback-shaped golden.
	Detectors                string                    `json:"detectors,omitempty"`
	BenchmarkEnabled         bool                      `json:"benchmark_enabled,omitempty"`
	AdjudicatedRelationships []AdjudicatedRelationship `json:"adjudicated_relationships,omitempty"`
}

Target describes one repository-backed smoke and benchmark case.

func LoadTargets 

func LoadTargets(path string) ([]Target, error)

LoadTargets reads targets from path, or from the embedded manifest when path is empty.

func Targets 

func Targets(targets []Target) []Target

Targets filters targets to those enabled for the hidden benchmark.

func (Target) SmokeArgs 

func (t Target) SmokeArgs() []string

SmokeArgs returns the scan arguments for the target's pinned smoke-test revision.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.