engine

type Engine struct {
	// contains filtered or unexported fields
}

type Option func(*Engine)

type PlannedJob struct {
	Control string
	Job     plugin.ScanJob
	// Component names the part of the application being scanned, empty for a project-scoped
	// control. Carried alongside the classification rather than derived from it: exposure and
	// criticality say what a component is worth, and a reader also has to know which one it was.
	Component   string
	Exposure    saga.Exposure
	Criticality saga.Criticality
}

type Prioritizer func(control string, exposure saga.Exposure, criticality saga.Criticality, res sarif.Result) string

type Registry struct {
	// contains filtered or unexported fields
}

type Result struct {
	Controls map[string]plugin.ControlResult
	Stats    Stats
	// Suppressed counts findings a config.exclude rule matched. They are still present in the
	// reports, marked with their justification — this is how many stopped counting.
	Suppressed int
	// LapsedExclusions are exclusions past their expiry date, which no longer suppress anything.
	// Reported so a finding that used to be accepted does not simply reappear with nothing to
	// say why.
	LapsedExclusions []saga.ExcludeRule
	// Effects records what this run did to its targets beyond reading them, deduplicated. Only
	// scans that actually executed count: a cache hit means the traffic was not sent this time,
	// and a record of effects has to describe what happened rather than what was configured.
	Effects []plugin.Effect
	// SBOMs are the Software Bills of Materials produced when the Saga enables config.sbom.
	// Evidence rather than judgement: they carry no findings and never affect the verdict.
	SBOMs []sbom.Document
	// ScanErrors records, per control, what stopped it completing — a missing scanner binary, a
	// tool that exited badly, a plan that couldn't be built. A control listed here checked less
	// than it was asked to, so its absence of findings is not evidence of absence, and callers
	// that treat an empty report as "clean" would be wrong.
	ScanErrors map[string][]string
}

type Stats struct {
	Jobs      int
	Scans     int
	CacheHits int
	// Deduped counts jobs that reused an identical scan already running/completed in this run
	// (in-run singleflight), rather than scanning or hitting the persistent cache.
	Deduped int
	// Concurrency is the maximum number of scan jobs run in parallel for this run (the
	// effective value after applying WithConcurrency or the NumCPU default).
	Concurrency int
	// Duration is wall-clock for the whole run, and ByControl is how long each control's jobs
	// took summed across them. Reported because "why is this slow" is a question a job count
	// cannot answer: with concurrency the parts do not add up to the whole, and the control
	// worth attention is the slowest one rather than the one with the most jobs.
	Duration  time.Duration
	ByControl map[string]time.Duration
}