remediate

type Format string

type Registry struct {
	// contains filtered or unexported fields
}

type RiskClass string

type Snippet struct {
	// CheckID is the finding this snippet remediates. Mirrors
	// compliancekit.Finding.CheckID exactly.
	CheckID string `json:"check_id"`

	// Format is the language of Content.
	Format Format `json:"format"`

	// Resource is a copy of the originating finding's ResourceRef.
	// Carried on the Snippet so downstream writers don't need to
	// re-join against the findings slice.
	Resource compliancekit.ResourceRef `json:"resource"`

	// Risk classifies how aggressive the change is. Operators
	// triage by risk before reading the body.
	Risk RiskClass `json:"risk"`

	// Idempotent reports whether re-applying the snippet leaves
	// system state unchanged. True for most Terraform / kubectl
	// patches; false for stateful operations like key rotation.
	Idempotent bool `json:"idempotent"`

	// Content is the executable text (HCL, bash, YAML, …). UTF-8.
	Content string `json:"content"`

	// VerifyCmd is an optional bash one-liner the operator can run
	// to confirm the fix landed. Empty when verification is not
	// expressible as a single command.
	VerifyCmd string `json:"verify_cmd,omitempty"`

	// RollbackCmd is an optional bash one-liner that undoes the
	// fix. Empty for safe / manual changes where rollback is
	// either unnecessary (safe) or non-trivial (manual).
	RollbackCmd string `json:"rollback_cmd,omitempty"`

	// Notes is short operator-facing prose: caveats, prerequisites
	// (e.g. "requires kms:CreateKey permission"), or context the
	// snippet itself doesn't communicate. Rendered above Content
	// in the runbook.
	Notes string `json:"notes,omitempty"`

	// Refs links to authoritative docs (provider guides, CIS
	// benchmark sections, CVE advisories).
	Refs []string `json:"refs,omitempty"`
}

type Strategy interface {
	// Name is a short identifier for the strategy, e.g.
	// "aws-s3-public-access". Used in error messages, debug logs,
	// and the runbook's "rendered by" footer. Lowercase, kebab-case.
	Name() string

	// CheckIDs returns the catalog IDs this strategy handles. May
	// return ["*"] to register as a fallback for unmatched IDs —
	// fallbacks are tried after exact matches and only if no
	// concrete strategy claims the CheckID.
	CheckIDs() []string

	// Formats returns the Format values this strategy can render.
	// MUST be non-empty; a strategy that can render nothing should
	// not be registered.
	Formats() []Format

	// Render produces a Snippet for the given (finding, format)
	// pair. Returns ErrFormatUnsupported when format is not in
	// Formats(); returns a Snippet with Risk=RiskManual + empty
	// Content for findings the strategy recognizes but cannot
	// auto-remediate.
	Render(f compliancekit.Finding, format Format) (Snippet, error)
}