Documentation
¶
Overview ¶
Package audit runs language-specific dependency audits on behalf of codefly Builder agents. Each language has a Scan(ctx, dir) entry point that shells out to the canonical CVE scanner + outdated-dep reporter for that ecosystem and returns structured findings.
Required scanners fail explicitly when they cannot run. A missing scanner must never be represented as a successful empty result: release gates need to distinguish "clean" from "not scanned".
Index ¶
- Constants
- type NodeOptions
- type Result
- func Docker(ctx context.Context, image string) (*Result, error)
- func Golang(ctx context.Context, dir string, includeOutdated bool) (*Result, error)
- func Node(ctx context.Context, dir string, includeOutdated bool) (*Result, error)
- func NodeWithOptions(ctx context.Context, dir string, options NodeOptions) (*Result, error)
- func OSVLockfile(ctx context.Context, dir, lockfile, language string) (*Result, error)
- func Python(ctx context.Context, dir string, includeOutdated bool) (*Result, error)
- func Rust(ctx context.Context, dir string) (*Result, error)
Constants ¶
const ( TrivyVersion = "v0.72.0" TrivyImage = "aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f" )
const ( OSVScannerVersion = "v2.4.0" OSVScannerImage = "ghcr.io/google/osv-scanner@sha256:5116601dedc01c1c580eb92371883ec052fc4c13c3fbc109d621a63ac416d475" )
const GovulncheckVersion = "v1.6.0"
GovulncheckVersion is the scanner revision Codefly resolves when no operator-provided binary is present. Pinning it makes release evidence reproducible and avoids the old host-PATH-dependent silent skip.
const PipAuditVersion = "2.10.1"
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type NodeOptions ¶ added in v0.2.40
NodeOptions controls the dependency scope and update evidence returned by a Node audit.
type Result ¶
type Result struct {
Findings []*builderv0.AuditFinding
Outdated []*builderv0.OutdatedDep
Tool string
Language string
}
Result is the language-agnostic shape returned by every Scan* function. Tool identifies what produced it ("govulncheck+go-list-u", "npm-audit+outdated", "uv-export+pip-audit", "osv-scanner", or "trivy").
func Docker ¶
Docker scans a container image (e.g. postgres:16, redis:7) for known CVEs using trivy. Used by Docker-only agents (postgres, redis, neo4j, temporal, vault) where the codefly service is the official upstream image — there is no application code to scan, just the distribution itself.
trivy must be available; missing tooling is an incomplete audit and fails.
func Golang ¶
Golang scans a Go module rooted at dir.
Vulnerabilities: govulncheck -json ./... (callgraph-aware; only reports vulns the binary can actually reach). Outdated: go list -m -u -json all (returns each module with its current + Update fields).
A PATH-installed govulncheck is honored for hermetic/operator-managed environments. Otherwise Codefly runs the pinned scanner through the Go tool, which uses Go's content-addressed module/build cache without modifying the audited module. If neither path is possible the audit fails explicitly.
func Node ¶
Node scans a Node package rooted at dir (must contain package.json + lockfile), preserving the original all-dependencies behavior for existing callers.
func NodeWithOptions ¶ added in v0.2.40
NodeWithOptions scans vulnerabilities with `npm audit --json` and optionally reports `npm outdated --json`. Runtime-only mode passes `--omit=dev` to both commands so release gates describe dependencies shipped with the service; development dependencies remain available as an explicit broader audit.
Both commands exit non-zero on findings, which is normal — we still parse the JSON output. Missing npm is an incomplete audit and fails.
func OSVLockfile ¶ added in v0.2.23
OSVLockfile scans one authoritative ecosystem lockfile. A host-installed osv-scanner is honored; otherwise Codefly runs the official multi-platform image pinned by manifest-list digest with the project mounted read-only. The scanner submits package names and versions to OSV.dev, never source.
func Python ¶
Python scans a Python project rooted at dir. Vulnerabilities are read from a hashed requirements snapshot exported from uv.lock with --frozen. Outdated dependencies are resolved from the same frozen uv graph; neither operation inspects the ambient interpreter or site-packages.
Required tools must be present. Missing vulnerability tooling is an incomplete audit and fails instead of returning a false clean result.
Source Files