internal/

Package analysis implements Godzilla's taint analysis engine: it walks gIR programs and reports Findings for source-to-sink dataflows described by a rules.RuleSet, alongside two non-dataflow passes (dangerous-call and secrets).

Package buildpolicy centralizes one security-sensitive decision: whether Godzilla may execute a SCANNED project's own build tooling — Maven/Gradle for Java, Cargo for Rust.

Package config loads a per-project .godzilla.yaml so a repository can carry its scan policy in version control (CI-5): the gate threshold, path include/exclude filters (e.g.

Package irwalk provides the nil-guarded gIR traversal iterators shared by the analysis passes, the frontends' whole-program rewrites, and converter tests.

Package llm provides an optional, pluggable LLM-backed reviewer that adjudicates lower-confidence taint findings and discards likely false positives.

Package memlimit sets a soft heap ceiling (GOMEMLIMIT) so a large scan makes the garbage collector work harder instead of OOM-killing the process.

Package playground serves the gIR Playground: a local web UI that shows what a frontend lowered a project to, and what the loaded rules make of it.

Package proc centralizes the timeouts for the external toolchain processes the frontends shell out to (python3, java, rustc, cargo, clang, mvn/gradle).

Package report renders a slice of analysis.Finding values into a single HTML document whose only external reference is the Google Fonts stylesheet; it degrades to the system stack offline.

Package rules defines Godzilla's rule model and matching primitives.

Package ruletest runs a directory of vulnerable sample projects against a rule set and checks each against a hand-written expected.yaml, giving rule authors a `godzilla rules test <dir>` workflow (CI-7) without cloning the repo or running `go test`.

Package scan is the importable scan pipeline shared by the CLI and the test corpus.

Package scaninfo carries the scan telemetry behind the HTML report's diagnostics panel: internal/scan fills it, internal/report renders it, and the CLI passes it across without translating.

Package srclines is the shared source-file line cache used by every stage that re-reads scanned source to show or match lines: the HTML report's code snippets, the LLM reviewer's code context, and the inline godzilla:ignore sweep.

Package testsupport holds the small helpers shared by test packages across the repo: the toolchain-presence skip (RequireTool) and the one-rule RuleSet builder (OneRuleSet).

Package triage applies deterministic, user-directed suppression to findings AFTER analysis: inline `godzilla:ignore` source directives and a fingerprint baseline file.

Package walkignore is the one shared policy for which directories and files a source scan prunes: skip VCS metadata, dependency/vendor trees, virtual environments, build output and editor/tool caches, plus individual files that are too large or are obviously generated/minified bundles.