Documentation
¶
Overview ¶
Package golang is the Go LanguageProvider. It backs its analysis with the stdlib go/ast parser (no CGO, no external dependency — see ADR 0001) and is codefit's self-audit bootstrap: codefit audits its own Go code from day one.
Index ¶
- type Option
- type Provider
- func (*Provider) AnalyzePractices(src providers.SourceFile) ([]findings.Finding, error)
- func (*Provider) AnalyzeSecurity(src providers.SourceFile) ([]findings.Finding, error)
- func (pr *Provider) AnalyzeSurface(src providers.SourceFile) ([]findings.SurfaceItem, error)
- func (*Provider) Capability() providers.Capability
- func (*Provider) DefaultPathCriticality() config.PathCriticality
- func (*Provider) FileExtensions() []string
- func (*Provider) Frameworks() []string
- func (*Provider) Language() string
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶ added in v0.2.9
type Option func(*Provider)
Option configures a Provider at construction.
func WithAuthzHelpers ¶ added in v0.2.9
WithAuthzHelpers registers project-specific authorization helper names the provider recognizes in a handler body. The names come from the committed baseline (a human-approved decision), never from guessing — Go has no built-in helper vocabulary (unlike TypeScript's NextAuth-style set): a invented name list would be exactly the name-driven over-promise CLAUDE.md flags as a known-limit smell.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements providers.LanguageProvider for Go. authzHelpers holds the project's registered custom authz helper names (ADR 0013), threaded in by the registry so the "authz" surface item's known_authz_detected fact reflects per-project knowledge instead of a built-in vocabulary Go has none of. Empty for the stateless file-level surface tools; populated by the project-scan path from the baseline.
func New ¶
New returns a Go language provider. With no options it recognizes no authz helpers (the stateless default — every existing New() call site keeps compiling since Option is variadic).
func (*Provider) AnalyzePractices ¶
AnalyzePractices runs the Go best-practice checks.
func (*Provider) AnalyzeSecurity ¶
AnalyzeSecurity runs the static (go/ast) security checks for Go.
func (*Provider) AnalyzeSurface ¶
func (pr *Provider) AnalyzeSurface(src providers.SourceFile) ([]findings.SurfaceItem, error)
AnalyzeSurface maps the auditable structural surface of a Go file.
func (*Provider) Capability ¶ added in v0.2.9
func (*Provider) Capability() providers.Capability
Capability declares what the Go provider implements, measured against security.go/practices.go/surface.go at main@ee0b263: 6 security rule IDs, 4 practices rule IDs, and exactly ONE surface category (authz — HTTP handlers, surface.go). Both RuleSets are Enumerable:false: Go's detectors have no All()/ID() rule-registry loader (unlike TypeScript's YAML-backed security rules), so Declared is a hand-maintained mirror of the switch in security.go/practices.go, not a derived list — Control A (internal/providers/typescript's Enumerable:true declaration) does not apply here. CoverageManifest is false: the Go provider implements no CoverageManifest() method today (P1-4b's coverage-manifest half stays open; R1, ADR 0065, makes codefit-coverage derive an honest answer for go without one).
Practices.Excluded carries PRAC-004 — permanently dropped per ADR 0056, not merely unimplemented: it fired on every `go` statement claiming "no visible WaitGroup or channel" with zero synchronization detection, because go/ast without go/types cannot see synchronization living in a callee, a struct field, or an errgroup, and the practices dimension is deterministic by spec (no surface channel to route an uncertain signal into). This is P1-4b's owed manifest entry: the drop was recorded only in the ADR and the CHANGELOG until now, so an agent asking what codefit covers for Go was left to infer the hole from PRAC-004's absence.
func (*Provider) DefaultPathCriticality ¶
func (*Provider) DefaultPathCriticality() config.PathCriticality
Source Files