Documentation
¶
Overview ¶
Package ruletest runs a directory of vulnerable sample projects against a rule set and checks each against a hand-written expected.yaml, giving rule authors a `godzilla rules test <dir>` workflow (CI-7) without cloning the repo or running `go test`. It is the same oracle shape the in-repo corpus uses — every expected rule must fire (at least `min` times, optionally at a given sink line/callee) and no unexpected rule may fire — packaged for reuse by the CLI.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Expectation ¶
type Expectation struct {
Findings []Expected `yaml:"findings"`
}
Expectation is a sample's expected.yaml. An empty Findings list means the sample must produce NO findings (a clean-code / false-positive control).
type Expected ¶
type Expected struct {
Rule string `yaml:"rule"`
Min int `yaml:"min"`
Line int32 `yaml:"line,omitempty"`
Sink string `yaml:"sink,omitempty"`
}
Expected asserts a rule fires at least Min times (default 1), optionally at a sink Line and/or a sink callee containing Sink.
type Result ¶
type Result struct {
Sample string // sample directory name
Pass bool // true if every assertion held
Failures []string // human-readable assertion failures (empty when Pass)
Skipped string // non-empty reason if the sample could not be evaluated
}
Result is the outcome of checking one sample directory.
Source Files