Documentation
¶
Overview ¶
Package git provides repository checkouts for scanners that operate on source trees.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Checkout ¶
func Checkout(ctx context.Context, url, revision string, scope Scope) (dir string, cleanup func(), err error)
Checkout clones url into a fresh temporary directory, materialising only what scope allows. With an empty revision it does a shallow clone of the default branch; otherwise it clones and checks out revision. The returned cleanup removes the directory (call it even on error paths that returned a dir).
Types ¶
type Scope ¶ added in v0.52.0
type Scope struct {
// Paths restricts the checkout to these directories. Empty means the whole repository.
//
// Directory prefixes, not general globs: `services/web` and `services/web/**` both mean the
// same subtree. That is what sparse checkout can express, and expressing it any other way
// would mean downloading the repository to throw most of it away.
Paths []string
// Ignore removes matching paths after checkout, applied last so it can carve out of Paths.
// Gitignore-style: a trailing `/` matches a directory and everything under it, `*` matches
// within a path segment, `**` matches across them.
Ignore []string
}
Scope restricts which of a repository's files a checkout materialises.
Shaping the tree rather than passing flags to each tool is deliberate. Every repository scanner is handed the checkout directory and points its tool at it — Trivy, Semgrep, Gitleaks and gosec all take a root and walk it. Translating a descriptor's scope into each tool's own include and exclude syntax would be a mapping per tool, wrong in a different way for each, and absent for the next scanner someone adds. A tree that already contains what was asked for needs no translation and cannot be forgotten.
Source Files