sarif

type Finding struct {
	// RuleID is the tool's rule identifier (e.g., "CKV_AWS_19").
	RuleID string
	// Severity is the normalized severity bucket.
	Severity Severity
	// Message is the human-readable finding description. We prefer the
	// rule's shortDescription (when SARIF includes it — most tools do)
	// because tools like trivy stuff a multi-line envelope of metadata
	// into result.message.text instead of a short description.
	Message string
	// File is the file path (relative to scanned root) the finding refers to.
	File string
	// Line is the 1-based line number; 0 if unknown.
	Line int
	// Tool is the producer's driver name (e.g., "checkov", "trivy", "kics").
	Tool string
	// HelpURI is the per-rule remediation link from SARIF's
	// tool.driver.rules[].helpUri, when present. Renderers turn the
	// rule ID into a clickable link to this URL so users can jump to
	// the official guideline page directly from the summary.
	HelpURI string
}

type Findings struct {
	// Tool is the driver name from the first run (most SARIF docs have one run).
	Tool string
	// Findings is the flattened list across all runs in the document.
	Findings []Finding
}

type HandlerOptions struct {
	// Kind is the registered hook kind name (e.g., "checkov", "trivy", "kics").
	Kind string
	// OutputPath returns the file path to read SARIF from given the
	// ExecContext. Use DefaultOutputFile for tools that write to a single
	// file (checkov, trivy). KICS needs a custom path because it writes
	// `results.sarif` inside ATMOS_OUTPUT_DIR rather than to ATMOS_OUTPUT_FILE.
	OutputPath func(ctx *hooks.ExecContext) string
	// MaxFindings caps how many individual findings appear in the markdown
	// table. Defaults to 10 when zero.
	MaxFindings int
}

type RenderMarkdownOptions struct {
	// MaxFindings caps how many individual findings appear in the table.
	// Defaults to defaultMaxFindings when zero.
	MaxFindings int
	// Tool is shown in the header (e.g., "trivy", "checkov"). Falls back to
	// Findings.Tool when empty.
	Tool string
	// RepoBaseURL, when set, turns the Location column into a real link to the file
	// on GitHub: "<RepoBaseURL>/<file>#L<line>" (e.g.
	// "https://github.com/org/repo/blob/<sha>"). Populated only when running in
	// GitHub Actions (see githubBlobBaseURL), since a local filesystem path is
	// meaningless as a link anywhere but the machine that produced it — locally the
	// Location column renders as styled inline code instead, with no link at all, so
	// glamour doesn't pull the (useless) href out into a footnote.
	RepoBaseURL string
}

type Severity int