inventory

type Tree struct {
	// Dependencies are the files that declare or pin packages.
	Dependencies []manifests.File
	// Unresolved are the dependency files a manifest scanner takes no packages from: a declared
	// manifest with no lockfile, a requirements file with no exact version.
	Unresolved []manifests.Unread
	// TrivyUnread are dependency files Trivy does not read and Grype does.
	TrivyUnread []manifests.File
	// TrivyByPattern are the requirements files Trivy reads only where trivyFs.filePatterns names
	// them: its pip analyzer opens requirements.txt and no other name.
	TrivyByPattern []manifests.File
	// Go are the directories holding a go.mod, whether or not it requires anything: standard-library
	// code still has SAST findings, and still builds with a toolchain that has advisories of its own.
	Go []string
	// VendoredJS are JavaScript files committed as copies of a library rather than written here.
	VendoredJS []string
	// Terraform are the directories holding a .tf file.
	Terraform []string
	// Kubernetes are manifests outside a Helm chart.
	Kubernetes []string
	// Helm are the directories holding a Chart.yaml.
	Helm []string
	// Dockerfiles are the files an image is built from.
	Dockerfiles []string
	// OpenAPI are OpenAPI and Swagger documents.
	OpenAPI []string
	// Parts are the directories below the root that hold their own dependency file or go.mod, the
	// units a monorepo is made of. A JavaScript workspace member, a directory the root package.json
	// or pnpm-workspace.yaml names, is not one by its package.json alone: the lockfile at the
	// workspace root resolves it, so it stays with that root.
	Parts []string
}