Documentation
¶
Index ¶
- Constants
- func AppendPosition(out map[string][]*sdk.SourcePosition, key string, pos *sdk.SourcePosition)
- func AttachPositionCandidates(g *sdk.Graph, positions map[string][]*sdk.SourcePosition, ...)
- func AttachPositions(g *sdk.Graph, positions map[string]*sdk.SourcePosition, ...)
- func BuildToolContext(ctx context.Context) (context.Context, context.CancelFunc)
- func CommandNotReadyError(name string, err error) error
- func InferManifestMetadata(req sdk.DetectionRequest, evidencePatterns []string) sdk.ManifestMetadata
- func JavaReady(ctx context.Context) error
- func RequestWorkingDir(req sdk.DetectionRequest) string
- func ScanLines(path string, fn func(line int, text string)) error
- func SubgraphFrom(g *sdk.Graph, rootID string) (*sdk.Graph, error)
Constants ¶
const ( NameNPM = "npm-detector" NameNPMNative = "npm-native-detector" NamePNPM = "pnpm-detector" NamePNPMNative = "pnpm-native-detector" NameYarn = "yarn-detector" NameBun = "bun-detector" NameBunNative = "bun-native-detector" NameYarnNative = "yarn-native-detector" NameGradle = "gradle-detector" NameMaven = "maven-detector" NameGoMod = "go-detector" NameComposer = "composer-detector" NameBundler = "bundler-detector" NameGitHubActions = "github-actions-detector" NamePip = "pip-detector" NamePipenv = "pipenv-detector" NamePoetry = "poetry-detector" NameUV = "uv-detector" NameNuGet = "nuget-detector" NameCargo = "cargo-detector" NamePub = "pub-detector" NamePubNative = "pub-native-detector" NameCocoaPods = "cocoapods-detector" NameSwiftPM = "swiftpm-detector" NameSwiftPMNative = "swiftpm-native-detector" NameMix = "mix-detector" NameConan = "conan-detector" NameSBT = "sbt-detector" NameSBTNative = "sbt-native-detector" NameSBOM = "sbom-detector" NameSyft = "syft-detector" )
const BuildToolTimeout = 10 * time.Minute
BuildToolTimeout bounds a single build-tool invocation (mvn, gradle, sbt). These commands resolve dependency graphs over the network, and a stalled remote (observed twice with Maven Central) would otherwise hang the scan indefinitely because the pipeline context carries no deadline. The bound is deliberately generous — healthy resolutions finish in seconds to a few minutes even on cold caches — so hitting it means the tool is stuck, not slow.
Variables ¶
This section is empty.
Functions ¶
func AppendPosition ¶ added in v0.14.17
func AppendPosition(out map[string][]*sdk.SourcePosition, key string, pos *sdk.SourcePosition)
AppendPosition appends pos under key unless the same file/line/column position was already recorded.
func AttachPositionCandidates ¶ added in v0.14.17
func AttachPositionCandidates(g *sdk.Graph, positions map[string][]*sdk.SourcePosition, keys func(*sdk.Dependency) []string)
AttachPositionCandidates populates PackageLocation.Position on graph nodes using one or more lookup keys per dependency. It preserves multiple declaration sites and skips exact duplicate file/line/column entries.
func AttachPositions ¶
func AttachPositions(g *sdk.Graph, positions map[string]*sdk.SourcePosition, nameKey func(*sdk.Dependency) string)
AttachPositions populates PackageLocation.Position on graph nodes whose normalized key (derived by nameKey) appears in the positions map. Nodes already carrying a Location with the same RealPath are left untouched.
nameKey returns the lookup key for a graph node. Detectors typically derive it from dep.Name, dep.Org+":"+dep.Name, or a language-specific normalization. Returning "" skips the node.
func BuildToolContext ¶ added in v0.19.0
BuildToolContext derives a context for one build-tool invocation, bounded by BuildToolTimeout on top of whatever deadline ctx already carries.
func CommandNotReadyError ¶ added in v0.15.2
CommandNotReadyError returns a compact readiness error for a missing tool, or nil when err is nil.
func InferManifestMetadata ¶
func InferManifestMetadata(req sdk.DetectionRequest, evidencePatterns []string) sdk.ManifestMetadata
InferManifestMetadata determines the manifest metadata for detectors that naturally resolve one graph.
func JavaReady ¶ added in v0.15.2
JavaReady verifies that a Java runtime is available for JVM build tools. It returns nil when a runtime is usable and a non-nil error describing the reason otherwise. The probe is bound to ctx and additionally guarded by an internal timeout so a hung `java` cannot stall a scan.
func RequestWorkingDir ¶ added in v0.15.2
func RequestWorkingDir(req sdk.DetectionRequest) string
RequestWorkingDir returns the directory a detector should operate in for the given request, preferring the explicit project path and falling back to the subproject execution target location.
func ScanLines ¶
ScanLines invokes fn for every line in the file at path. The callback receives the 1-based line number and the raw line text (without the trailing newline). Returns the underlying scanner error if any. Returns nil silently when the file does not exist — detector position wiring is best-effort.
func SubgraphFrom ¶ added in v0.18.0
SubgraphFrom returns a new graph containing rootID and every node and edge reachable from it in g. Detectors that resolve a whole workspace/reactor into one graph use it to partition the merged graph into per-module manifest entries: each module entry carries the module root plus its reachable dependency subtree. Node pointers are shared with the source graph, matching how detectors already share nodes across container entries.
Types ¶
This section is empty.
Source Files
Directories