prioritization

package

v0.50.0 Latest Latest Go to latest Published: Jul 31, 2026 License: Apache-2.0 Imports: 2 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/draugr-dev/draugr

Links

Open Source Insights

Documentation ¶

Overview ¶

Package prioritization turns a finding's severity and its component's risk classification (exposure × business criticality) into a single Priority band. It is the engine behind "what do I fix first": two small, auditable lookup matrices —

re × bc      → context tier (C1–C4)   "how much we care about any issue here"
context × severity → priority (P1–P4) "this finding's rank"

The default matrices ship opinionated and are overridable. See docs/concepts.md (prioritization).

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Context ¶

type Context string

Context is the "how much we care about this component" tier (C1 highest concern, C4 lowest), derived from exposure × criticality.

const (
	C1 Context = "C1"
	C2 Context = "C2"
	C3 Context = "C3"
	C4 Context = "C4"
)

Context tiers, from most to least concerning.

type Matrices ¶

type Matrices struct {
	// ContextTier maps exposure → criticality → context tier.
	ContextTier map[saga.Exposure]map[saga.Criticality]Context
	// PriorityBand maps context tier → normalized severity → priority.
	PriorityBand map[Context]map[sarif.Severity]Priority
}

Matrices holds the two lookup tables. The maps are exported so callers can start from DefaultMatrices and override individual cells (e.g. from Saga config).

func DefaultMatrices ¶

func DefaultMatrices() Matrices

DefaultMatrices returns the shipped, opinionated matrices (a fresh copy, safe to mutate for overrides). Both are monotonic: raising exposure, criticality, or severity never lowers priority, and P1 is deliberately scarce. See docs/concepts.md (prioritization).

func (Matrices) ContextOf ¶

func (m Matrices) ContextOf(exposure saga.Exposure, criticality saga.Criticality) Context

ContextOf returns the context tier for a component's classification. Unclassified or unknown exposure/criticality is treated as the most severe level (public / critical), so findings on unclassified components surface rather than hide.

func (Matrices) Prioritize ¶

func (m Matrices) Prioritize(exposure saga.Exposure, criticality saga.Criticality, severity sarif.Severity) Priority

Prioritize combines both matrices: it ranks a finding of the given severity on a component with the given exposure and criticality.

func (Matrices) PriorityOf ¶

func (m Matrices) PriorityOf(ctx Context, severity sarif.Severity) Priority

PriorityOf returns the priority band for a context tier and a normalized severity. An unknown severity is treated as low.

type Priority ¶

type Priority string

Priority is a finding's action band (P1 most urgent, P4 least).

const (
	P1 Priority = "P1"
	P2 Priority = "P2"
	P3 Priority = "P3"
	P4 Priority = "P4"
)

Priority bands: P1 act now/block · P2 this cycle · P3 backlog · P4 track/accept.

func (Priority) Rank ¶

func (p Priority) Rank() int

Rank orders priorities by urgency (higher is more urgent): P1=4 … P4=1, unknown=0. Sort findings by descending Rank to put the most urgent first.

Source Files ¶

View all Source files

prioritization.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL