harnessx

harnessx

harnessx is a concurrent, dependency-aware check orchestration engine for Go. It lets you define a graph of checks with explicit dependencies, run them in parallel waves, and collect structured observations — without writing any scheduling or concurrency boilerplate. Common use cases include security scanning, compliance checks, health checks, and quality gates.

Features

Installation

go get github.com/cerberauth/harnessx

Requires Go 1.22+.

Quick Start

package main

import (
    "context"
    "fmt"
    "net/http"

    "github.com/cerberauth/harnessx"
)

func main() {
    // 1. Describe the target.
    target := harnessx.Target{URL: "https://example.com", Host: "example.com"}

    // 2. Define checks.
    tlsCheck := harnessx.Check{
        ID:    "tls",
        Name:  "TLS configuration",
        Scope: harnessx.ScopeGlobal,
        Run: func(ctx context.Context, t harnessx.Target, _ harnessx.ResultStore) (harnessx.Result, error) {
            resp, err := http.Get(t.URL)
            if err != nil || !resp.TLS.HandshakeComplete {
                return harnessx.Result{
                    Observations: []harnessx.Observation{{
                        Title: "TLS not negotiated",
                    }},
                }, nil
            }
            return harnessx.Result{}, nil
        },
    }

    headerCheck := harnessx.Check{
        ID:        "headers",
        Name:      "Security headers",
        Scope:     harnessx.ScopeGlobal,
        DependsOn: []harnessx.CheckID{"tls"},
        // Only runs if TLS passed cleanly.
        Conditions: []harnessx.Condition{harnessx.IfCheckPassed("tls")},
        Run: func(ctx context.Context, t harnessx.Target, _ harnessx.ResultStore) (harnessx.Result, error) {
            resp, err := http.Get(t.URL)
            if err != nil {
                return harnessx.Result{}, err
            }
            var observations []harnessx.Observation
            if resp.Header.Get("Strict-Transport-Security") == "" {
                observations = append(observations, harnessx.Observation{
                    Title: "Missing HSTS header",
                })
            }
            return harnessx.Result{Observations: observations}, nil
        },
    }

    // 3. Create the engine and register checks.
    engine := harnessx.New(
        harnessx.WithMaxConcurrency(4),
        harnessx.WithChecks(tlsCheck, headerCheck),
    )

    // 4. Run the scan.
    summary, err := engine.Run(context.Background(), target)
    if err != nil {
        panic(err)
    }

    fmt.Printf("Executed: %d  Skipped: %d  Failed: %d\n",
        summary.Executed, summary.Skipped, summary.Failed)
    for _, o := range summary.Observations {
        fmt.Printf("%s: %s\n", o.Title, o.Description)
    }
}

Concepts

Checks

A Check is the fundamental unit of work. Each check has a unique ID, an execution Scope, and either a Run or RunResource function.

type Check struct {
    ID          CheckID
    Name        string
    Description string
    Tags        []string

    // Dependency graph
    DependsOn  []CheckID
    Conditions []Condition // AND-evaluated; any false → skip

    // Skip control
    Skip SkipDecision // static/dynamic skip, optionally per-resource

    // Execution
    Scope       CheckScope     // ScopeGlobal or ScopePerResource
    Run         CheckFunc      // used when Scope == ScopeGlobal
    RunResource ResourceCheckFunc // used when Scope == ScopePerResource

    // Variants: run the same check definition once per variant instead
    // (mutually exclusive with Run/RunResource — see "Variants" below).
    Variants           []string
    VariantMode        VariantMode // VariantsSequential (default) or VariantsParallel
    RunVariant         VariantCheckFunc         // used when Scope == ScopeGlobal
    RunResourceVariant VariantResourceCheckFunc // used when Scope == ScopePerResource

    Timeout     time.Duration  // 0 → engine default (30s)
    Concurrency int            // per-resource parallelism; 0 → engine default
}

Check Definitions

Hand-assembling ID, Name, Description, Link, Tags, and DependsOn in Go gets repetitive for a reusable check package. The checkdef subpackage parses that metadata from an embedded YAML, TOML, or JSON file instead:

import "github.com/cerberauth/harnessx/checkdef"

type CheckDef = checkdef.CheckDef // ID, Name, Description, Link, Tags, DependsOn, CVSSVector, CVSSScore, CWEID, CAPECID, OWASP, Extra

func MustParseCheckDefYAML(pkg string, data []byte) CheckDef
func MustParseCheckDefTOML(pkg string, data []byte) CheckDef
func MustParseCheckDefJSON(pkg string, data []byte) CheckDef

Each MustParse* panics (prefixed with pkg) on malformed input — definitions are typically parsed once at init() time from an //go:embedded file, so a bad definition is a build-time bug, not a runtime error to recover from.

# check.yaml
id: alg_none
name: "Algorithm None"
description: "Tests if the server accepts tokens with the algorithm set to 'none'."
link: "https://example.com/vulnerabilities/jwt-alg-none"
tags:
  - algorithm
depends_on:
  - baseline
cvss_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
cvss_score: 9.3
cwe_id: "CWE-345"
capec_id: "CAPEC-31"
owasp: "API2:2023"
extra:
  custom_field: custom_value # def-specific fields this package doesn't model yet

NewCheck / NewResourceCheck turn a CheckDef plus a run function into a harnessx.Check, so a check only supplies what makes it different — the metadata fields are wired for you:

func NewCheck(def CheckDef, run harnessx.CheckFunc, opts ...Option) harnessx.Check         // Scope: ScopeGlobal
func NewResourceCheck(def CheckDef, run harnessx.ResourceCheckFunc, opts ...Option) harnessx.Check // Scope: ScopePerResource

// Same wiring, but run is invoked once per WithVariants entry — see "Variants".
func NewVariantCheck(def CheckDef, run harnessx.VariantCheckFunc, opts ...Option) harnessx.Check                 // Scope: ScopeGlobal
func NewVariantResourceCheck(def CheckDef, run harnessx.VariantResourceCheckFunc, opts ...Option) harnessx.Check // Scope: ScopePerResource

func WithSkip(s harnessx.SkipDecision) Option
func WithConditions(c ...harnessx.Condition) Option
func WithTimeout(d time.Duration) Option
func WithConcurrency(n int) Option // NewResourceCheck / NewVariantResourceCheck only
func WithVariants(variants ...string) Option
func WithVariantMode(mode harnessx.VariantMode) Option // default VariantsSequential

//go:embed check.yaml
var checkYAML []byte

var def = checkdef.MustParseCheckDefYAML("algnone", checkYAML)

var Check = checkdef.NewCheck(def, run,
    checkdef.WithSkip(harnessx.SkipWhen(func(ctx context.Context, t harnessx.Target, _ harnessx.ResultStore) string {
        if offline {
            return "requires live server"
        }
        return ""
    })),
)

checkdef is a separate package from root harnessx so the core engine keeps its zero-dependency guarantee — the YAML/TOML parsers are only pulled in by code that imports checkdef.

Scopes

Variants

Some checks are one exploit with several equivalent forms — a JWT alg: none bypass tried as "none", "NONE", "None". Rather than registering three near-duplicate checks (same ID, Skip, Conditions, DependsOn), give a single check a Variants list and a variant-aware run function. The engine invokes it once per variant and merges the results back into one Result:

algNone := harnessx.Check{
    ID:       "alg-none",
    Scope:    harnessx.ScopeGlobal,
    Variants: []string{"none", "NONE", "None"},
    RunVariant: func(ctx context.Context, t harnessx.Target, variant string, _ harnessx.ResultStore) (harnessx.Result, error) {
        if accepted := tryAlgNone(ctx, t, variant); accepted {
            return harnessx.Result{
                Observations: []harnessx.Observation{{Title: "server accepted alg=" + variant}},
            }, nil
        }
        return harnessx.Result{}, nil
    },
}

• VariantMode controls how variants run: VariantsSequential (the default, zero value) runs them one at a time in list order; VariantsParallel runs them concurrently.
• Each variant's outcome is recorded as an Attempt on the merged Result.Attempts, so a check that "found nothing" but tried five variants is distinguishable from one that never ran.
• Observation.Variant is auto-filled with the variant name when a variant's run function leaves it empty, so downstream reporters and the Result.Observations slice know which variant produced each finding.
• A panic in one variant is recovered and recorded on that variant's Attempt.Err — it does not abort the other variants.
• ScopePerResource checks use RunResourceVariant instead of RunVariant, and run every variant against every resource.

type VariantCheckFunc func(ctx context.Context, target Target, variant string, store ResultStore) (Result, error)
type VariantResourceCheckFunc func(ctx context.Context, target Target, resource Resource, variant string, store ResultStore) (Result, error)

type VariantMode int
const (
    VariantsSequential VariantMode = iota // default
    VariantsParallel
)

type Attempt struct {
    Variant      string
    Observations []Observation
    Resources    []Resource
    Duration     time.Duration
    Data         any
    Err          error
}

checkdef.NewVariantCheck / checkdef.NewVariantResourceCheck wire a CheckDef plus a variant run function the same way NewCheck / NewResourceCheck do — see Check Definitions above.

Resource Discovery

A ScopeGlobal check can return a Resources slice in its result. Those resources are accumulated in the engine's store and made available to all subsequent ScopePerResource checks.

crawl := harnessx.Check{
    ID:    "crawl",
    Scope: harnessx.ScopeGlobal,
    Run: func(ctx context.Context, t harnessx.Target, _ harnessx.ResultStore) (harnessx.Result, error) {
        endpoints := discover(ctx, t.URL) // returns []Resource
        return harnessx.Result{Resources: endpoints}, nil
    },
}

probe := harnessx.Check{
    ID:          "probe",
    Scope:       harnessx.ScopePerResource,
    DependsOn:   []harnessx.CheckID{"crawl"},
    RunResource: func(ctx context.Context, t harnessx.Target, r harnessx.Resource, _ harnessx.ResultStore) (harnessx.Result, error) {
        // called once for each Resource returned by "crawl"
        return test(ctx, r), nil
    },
}

Conditions

Conditions gate whether a check runs. All conditions in a check's Conditions slice must pass (AND semantics). Built-in predicates:

// Run "deep-probe" only if "detect" produced any observations.
deepProbe := harnessx.Check{
    ID:         "deep-probe",
    Scope:      harnessx.ScopeGlobal,
    DependsOn:  []harnessx.CheckID{"detect"},
    Conditions: []harnessx.Condition{
        harnessx.IfCheckObserved("detect"),
    },
    Run: ...,
}

Skip Decisions

Skip gates whether a check (or, for ScopePerResource checks, an individual resource) runs at all — evaluated before Conditions and before the check function. A non-empty reason skips and records Result.SkipReason; reporters still receive OnCheckComplete for it.

type SkipDecision struct { /* built via SkipAlways / SkipWhen / SkipResourceWhen */ }

func SkipAlways(reason string) SkipDecision
func SkipWhen(fn func(ctx context.Context, target Target, store ResultStore) string) SkipDecision
func SkipResourceWhen(fn func(ctx context.Context, target Target, resource Resource, store ResultStore) string) SkipDecision

• SkipAlways / SkipWhen are check-wide: for a ScopePerResource check, a non-empty reason skips the entire check once, before it fans out over resources.
• SkipResourceWhen is evaluated once per resource, so different resources on the same check can be skipped for different reasons (or not at all).
• If a check's Skip has no per-resource decision, per-resource evaluation falls back to the check-wide one.

// Skip the whole check if the target isn't HTTPS.
tlsOnly := harnessx.Check{
    ID:   "hsts-header",
    Skip: harnessx.SkipWhen(func(ctx context.Context, t harnessx.Target, _ harnessx.ResultStore) string {
        if !strings.HasPrefix(t.URL, "https://") {
            return "target is not HTTPS"
        }
        return ""
    }),
    Run: ...,
}

// Skip only resources that opted out via metadata.
endpointAuth := harnessx.Check{
    ID:    "endpoint-auth",
    Scope: harnessx.ScopePerResource,
    Skip: harnessx.SkipResourceWhen(func(ctx context.Context, t harnessx.Target, r harnessx.Resource, _ harnessx.ResultStore) string {
        if r.Metadata["auth"] == "none" {
            return "endpoint declares no auth"
        }
        return ""
    }),
    RunResource: ...,
}

Execution Model

1. Checks are validated and sorted into parallel levels via Kahn's topological sort.
2. All checks within a level execute concurrently, bounded by WithMaxConcurrency.
3. Each level receives a frozen snapshot of the result store taken before any check in that level starts — intra-level races are impossible by design.
4. ScopePerResource checks within a level fan out over all currently known resources, bounded by WithMaxResourceConcurrency (or the check's own Concurrency field).

Scenarios

A Scenario groups a named set of checks to be executed together. Use RunScenario instead of Run to execute only that subset — the engine's registered checks are ignored.

restScenario := harnessx.Scenario{
    ID:   "rest-api",
    Name: "REST API Scan",
    Checks: []harnessx.Check{discoveryCheck, authCheck, schemaCheck},
}

summary, err := engine.RunScenario(ctx, target, restScenario)

To share business logic across scenarios while varying the dependency order, define the Run function as a variable and reference it in multiple Check values with different DependsOn fields:

var checkAuthFn harnessx.CheckFunc = func(...) (harnessx.Result, error) { ... }

// REST: auth after endpoint discovery
restAuth := harnessx.Check{ID: "rest-auth", DependsOn: []harnessx.CheckID{"rest-discovery"}, Run: checkAuthFn}

// GraphQL: same logic, wired after schema introspection
gqlAuth  := harnessx.Check{ID: "gql-auth",  DependsOn: []harnessx.CheckID{"gql-introspection"}, Run: checkAuthFn}

Selecting checks for a run

WithOnly and WithExclude narrow a single Engine.Run call to a subset of the engine's registered checks, without touching the registration itself. Unlike Scenario, the dependency graph is still built from Register/WithChecks — dropping a check that another depends on fails with ErrUnknownDependency, same as RunScenario.

// Only run these checks this time.
summary, err := engine.Run(ctx, target, harnessx.WithOnly("auth-check", "schema-check"))

// Run everything except these.
summary, err := engine.Run(ctx, target, harnessx.WithExclude("slow-check"))

WithExclude wins over WithOnly when both are passed and an ID appears in each.

Selecting by security metadata

Checks carry CVSSVector, CVSSScore, CWEID, CAPECID, and OWASP fields (populated automatically when a check is built from a checkdef.CheckDef). The metadata RunOptions narrow a run by those fields instead of by ID:

// Critical findings only this run.
summary, err := engine.Run(ctx, target, harnessx.WithMinCVSSScore(9.0))

// Only checks mapped to specific OWASP API categories / CWEs.
summary, err := engine.Run(ctx, target,
    harnessx.WithOWASP("API2:2023", "API3:2023"),
    harnessx.WithCWEID("CWE-287"),
)

// Arbitrary predicate.
summary, err := engine.Run(ctx, target, harnessx.WithFilter(func(c harnessx.Check) bool {
    return strings.HasPrefix(c.CAPECID, "CAPEC-1")
}))

Available: WithFilter, WithMinCVSSScore, WithMaxCVSSScore, WithCVSSScoreRange, WithCVSSVector, WithCWEID, WithCAPECID, WithOWASP. They are AND-combined with each other and with WithOnly; WithCWEID / WithCAPECID / WithOWASP match case-insensitively against any of the values passed. Dependencies are never dropped by a metadata filter — when a selected check DependsOn a check that doesn't match, that dependency is pulled back in so the graph stays valid. Only WithExclude removes a dependency.

Reporter

Implement the Reporter interface to receive real-time events:

type Reporter interface {
    OnScanStart(target Target, totalChecks int)
    OnCheckStart(check Check, target Target, resource *Resource)
    OnCheckComplete(result Result)
    OnScanComplete(summary ScanSummary)
}

OnScanStart fires before any check runs with the total registered check count — use it to initialise a progress bar. OnScanComplete is always called — even after a context cancellation or early error.

For a check with Variants, OnCheckComplete still fires once with the merged Result — inspect Result.Attempts to see the outcome of each variant individually (the built-in OTelReporter records one span event per attempt, tagged with its variant).

engine := harnessx.New(
    harnessx.WithReporters(myReporter, otherReporter),
)

Baseline Comparison

Baseline comparison detects the case where an endpoint's response changes in a way that indicates a bug — the canonical example being an endpoint that normally answers 401 Unauthorized but, because of a broken authorization check, answers 200 OK instead.

A Baseline is just a Snapshot{StatusCode int, Header http.Header, Body []byte, Duration time.Duration, Data any} — by default only the status code is compared, but Header/Body/Duration carry the full response, and Data can carry anything else, for custom comparators to inspect.

type Snapshot struct {
    StatusCode int
    Header     http.Header
    Body       []byte
    Duration   time.Duration
    Data       any
}
type Baseline = Snapshot

type BaselineSource func(ctx context.Context, target Target, resource Resource, store ResultStore) (Baseline, bool)
type BaselineComparator func(baseline, current Snapshot) []Observation

A baseline is obtained one of two ways:

• Baseline probe — a dedicated check captures the expected response at scan time and stores it via CaptureBaselineCheck; downstream checks read it back with BaselineFromCheck(id).
• Manual — a fixed value via StaticBaseline(b), or a per-resource value attached to Resource.Data at discovery time and read back with BaselineFromResource().

NewBaselineCheck wires a BaselineSource, a Capture function, and an optional Compare (defaults to CompareStatusCode) into a normal Check:

// Baseline captured once, at runtime, per resource.
probeCheck := harnessx.CaptureBaselineCheck("baseline-probe", "Baseline Probe",
    func(ctx context.Context, t harnessx.Target, r harnessx.Resource, _ harnessx.ResultStore) (harnessx.Snapshot, error) {
        return captureUnauthenticated(ctx, r.URL) // your capture logic
    })

// Compared against a later, potentially malicious, attempt.
bypassCheck := harnessx.NewBaselineCheck(harnessx.BaselineCheckConfig{
    ID:        "auth-bypass",
    DependsOn: []harnessx.CheckID{"baseline-probe"},
    Baseline:  harnessx.BaselineFromCheck("baseline-probe"),
    Capture: func(ctx context.Context, t harnessx.Target, r harnessx.Resource, _ harnessx.ResultStore) (harnessx.Snapshot, error) {
        return captureWithForgedHeader(ctx, r.URL) // your capture logic
    },
    // Compare defaults to CompareStatusCode; override for custom semantics,
    // e.g. only flag a denied -> allowed transition:
    Compare: func(baseline, current harnessx.Snapshot) []harnessx.Observation {
        if baseline.StatusCode >= 400 && current.StatusCode < 300 {
            return []harnessx.Observation{{Title: "Authorization bypass"}}
        }
        return nil
    },
})

For targets with no per-resource dimension (a single token, a single endpoint), use the ScopeGlobal counterparts — NewGlobalBaselineCheck, CaptureGlobalBaselineCheck, StaticGlobalBaseline, BaselineFromGlobalCheck — same shape, minus the Resource param.

For checks that probe by swapping/omitting a credential (token, API key, session ID), harnessx.ProbeAndCompareBaseline takes a probe.RequestBuilder and skips the Capture/Compare wiring entirely:

_, vulnerable, err := harnessx.ProbeAndCompareBaseline(ctx, p,
    func(ctx context.Context) (*http.Request, error) {
        return probe.NewRequest(ctx, http.MethodGet, resource.URL, nil, probe.WithBearerToken(forgedToken))
    }, store, "baseline-probe")

It builds the request via probe.NewRequest plus a named credential mutator (WithBearerToken, WithBasicAuth, WithAPIKeyHeader, WithAPIKeyQuery, WithAuthCookie, WithFormCredential), sends it via probe.Do, and diffs the resulting Snapshot against the baseline stored under "baseline-probe".

See the Baseline Comparison guide and examples/baseline-scan for a full runnable scenario.

Examples

• Advanced Scan: A comprehensive example demonstrating multi-level dependencies, resource discovery, custom conditions, and a pretty-printing reporter.
• Multi-Scenario Scan: REST API and GraphQL API scenarios sharing business logic with different dependency graphs. Select a scenario at runtime via CLI argument.
• Baseline Scan: Detects an authorization bypass by comparing live HTTP responses against a per-resource baseline — one captured at runtime, one defined manually.

API Reference

Engine

// New creates a new Engine with the given options.
func New(opts ...Option) *Engine

// Register adds checks to the engine. Returns ErrDuplicateCheckID if any ID conflicts.
func (e *Engine) Register(checks ...Check) error

// Run executes all registered checks against target, optionally narrowed
// by WithOnly / WithExclude for this call only.
// Always calls Reporter.OnScanComplete before returning.
func (e *Engine) Run(ctx context.Context, target Target, opts ...RunOption) (ScanSummary, error)

// WithOnly restricts a Run call to the given check IDs.
func WithOnly(ids ...CheckID) RunOption

// WithExclude removes the given check IDs from a Run call.
func WithExclude(ids ...CheckID) RunOption

// RunScenario executes only the checks in scenario against target.
// Ignores checks registered via Register or WithChecks.
// Always calls Reporter.OnScanComplete before returning.
func (e *Engine) RunScenario(ctx context.Context, target Target, scenario Scenario) (ScanSummary, error)

Skip Decisions

// SkipAlways always returns reason — the check (or resource) is always skipped.
func SkipAlways(reason string) SkipDecision

// SkipWhen evaluates fn once for the whole check.
func SkipWhen(fn func(ctx context.Context, target Target, store ResultStore) string) SkipDecision

// SkipResourceWhen evaluates fn once per resource, for ScopePerResource checks.
func SkipResourceWhen(fn func(ctx context.Context, target Target, resource Resource, store ResultStore) string) SkipDecision

Baseline Comparison

type Snapshot struct { StatusCode int; Header http.Header; Body []byte; Duration time.Duration; Data any }
type Baseline = Snapshot

// BaselineSource resolves the baseline for a resource; ok=false skips the check.
type BaselineSource func(ctx context.Context, target Target, resource Resource, store ResultStore) (Baseline, bool)

func StaticBaseline(b Baseline) BaselineSource
func BaselineFromResource() BaselineSource
func BaselineFromCheck(id CheckID) BaselineSource

// BaselineComparator judges the baseline against a freshly captured snapshot.
type BaselineComparator func(baseline, current Snapshot) []Observation

// CompareStatusCode is the default BaselineComparator.
func CompareStatusCode(baseline, current Snapshot) []Observation

type BaselineCheckConfig struct {
    ID, Name, Description string
    DependsOn             []CheckID
    Baseline              BaselineSource
    Capture               func(ctx context.Context, target Target, resource Resource, store ResultStore) (Snapshot, error)
    Compare               BaselineComparator // nil -> CompareStatusCode
    Timeout               time.Duration
    Concurrency           int
}

// NewBaselineCheck builds a ScopePerResource Check from cfg.
func NewBaselineCheck(cfg BaselineCheckConfig) Check

// CaptureBaselineCheck builds a ScopePerResource Check that captures a
// Snapshot per resource and stores it as Result.Data — the "baseline probe".
func CaptureBaselineCheck(id CheckID, name string, capture func(ctx context.Context, target Target, resource Resource, store ResultStore) (Snapshot, error)) Check

// ScopeGlobal counterparts, for targets with no per-resource dimension.
type GlobalBaselineSource func(ctx context.Context, target Target, store ResultStore) (Baseline, bool)
type GlobalCapture func(ctx context.Context, target Target, store ResultStore) (Snapshot, error)

func StaticGlobalBaseline(b Baseline) GlobalBaselineSource
func BaselineFromGlobalCheck(id CheckID) GlobalBaselineSource

type GlobalBaselineCheckConfig struct {
    ID, Name, Description string
    DependsOn              []CheckID
    Baseline               GlobalBaselineSource
    Capture                GlobalCapture
    Compare                BaselineComparator // nil -> CompareStatusCode
    Timeout                time.Duration
}

func NewGlobalBaselineCheck(cfg GlobalBaselineCheckConfig) Check
func CaptureGlobalBaselineCheck(id CheckID, name string, capture GlobalCapture) Check

// probe package: build a request from method+URL, then apply small
// composable mutators to it.
type RequestMutator func(*http.Request) error
type RequestBuilder func(ctx context.Context) (*http.Request, error)

func NewRequest(ctx context.Context, method, target string, body io.Reader, mutators ...RequestMutator) (*http.Request, error)
func WithHeader(name, value string) RequestMutator
func WithCookie(cookie *http.Cookie) RequestMutator
func WithQuery(name, value string) RequestMutator

// Named credential mutators — one per auth use case.
func WithBearerToken(token string) RequestMutator
func WithBasicAuth(username, password string) RequestMutator
func WithAPIKeyHeader(name, value string) RequestMutator
func WithAPIKeyQuery(name, value string) RequestMutator
func WithAuthCookie(name, value string) RequestMutator
func WithFormCredential(name, value string) RequestMutator

// NewRequestFromResource builds a request for r, defaulting to GET when
// r.Method is empty.
func NewRequestFromResource(ctx context.Context, r Resource, mutators ...probe.RequestMutator) (*http.Request, error)

// ProbeAndCompareBaseline sends the request returned by build via probe.Do,
// and compares the resulting Snapshot against the baseline stored under baselineID.
func ProbeAndCompareBaseline(ctx context.Context, p *probe.Probe, build probe.RequestBuilder, store ResultStore, baselineID CheckID) (Snapshot, bool, error)

Variants

type VariantCheckFunc func(ctx context.Context, target Target, variant string, store ResultStore) (Result, error)
type VariantResourceCheckFunc func(ctx context.Context, target Target, resource Resource, variant string, store ResultStore) (Result, error)

type VariantMode int
const (
    VariantsSequential VariantMode = iota // default: variants run one at a time, in order
    VariantsParallel                      // variants run concurrently
)

// Attempt records the outcome of a single variant run.
type Attempt struct {
    Variant      string
    Observations []Observation
    Resources    []Resource
    Duration     time.Duration
    Data         any
    Err          error
}

// checkdef helpers, same wiring as NewCheck / NewResourceCheck.
func checkdef.NewVariantCheck(def CheckDef, run harnessx.VariantCheckFunc, opts ...checkdef.Option) harnessx.Check
func checkdef.NewVariantResourceCheck(def CheckDef, run harnessx.VariantResourceCheckFunc, opts ...checkdef.Option) harnessx.Check
func checkdef.WithVariants(variants ...string) checkdef.Option
func checkdef.WithVariantMode(mode harnessx.VariantMode) checkdef.Option

Options

Errors

License

This repository is licensed under the MIT License @ CerberAuth.