norn

type ControlOutcome ¶

type ControlOutcome struct {
	Control         string
	Verdict         Verdict
	Highest         sarif.Severity
	HighestPriority string
	Counts          sarif.Counts
	Threshold       sarif.Severity
}

ControlOutcome is the verdict for a single control.

type Policy ¶

type Policy struct {
	FailOn         sarif.Severity
	PerControl     map[string]sarif.Severity
	FailOnPriority string
	// PerControlBand overrides the band for named controls, and is the band gate's half of
	// PerControl.
	//
	// Two maps rather than one, because a threshold is only meaningful in the vocabulary the gate
	// asks in, and FailOn and FailOnPriority are already a pair for the same reason. A single map
	// would hold values that mean nothing to the gate reading it, which is how a per-control
	// threshold came to be written, reviewed, and dropped without a word.
	PerControlBand map[string]string
}

Policy decides verdicts from findings. A control fails when its most severe finding is at least as severe as the applicable threshold. FailOn is the default threshold; PerControl overrides it for named controls.

**A run has one gate.** Either it asks what a finding's own severity is, or it asks what band that finding lands in for this component, and those are two different questions about the same finding. Answering both meant a verdict had two possible reasons, and "why did this fail" could not be answered from the policy alone, which is how a failure on the default severity threshold came to be read as the priority gate somebody had actually configured.

So FailOn and FailOnPriority are exclusive. The zero value gates on **P1**, which is the product's own ranking rather than the scanner's, and setting FailOn is how a caller says it wants the scanner's number instead.

Thresholds are severity bands, the ladder the report prints, rather than SARIF levels. The two are not interchangeable: a finding with a CVSS score takes its band from the score, so one a scanner emitted as `warning` can be `high`. Gating on the level let such a finding pass a gate its reader believed was set to catch it, with the report beside it saying `high`.

FailOnPriority adds component-aware gating: when set (e.g. "P1"), a control also fails if any of its findings has a priority band at least that urgent. Because a finding's priority already combines its severity with its component's exposure and criticality, this gates per component without a separate per-component threshold.

func (p Policy) Evaluate(reports map[string]sarif.Report) Result

func (p Policy) GatesOnSeverity() bool

func (p Policy) PriorityBand() string

type Result ¶

type Result struct {
	Verdict  Verdict
	Controls []ControlOutcome
}

Result is the overall evaluation across all controls.

type Verdict ¶

type Verdict string

Verdict is the outcome of a policy evaluation.

const (
	Pass Verdict = "pass"
	Fail Verdict = "fail"
)