Documentation
¶
Overview ¶
Package config is Draugr's machine- and organisation-level configuration, kept apart from the Saga on purpose.
A Saga describes an application: which repositories it has, how exposed a component is, which controls must pass. Those are facts about the software, they belong in its repository, and they are meant to differ between projects.
This file describes the machine or the organisation running the scan: which build of a scanner to install, and what a control should default to before any project says otherwise. Those want to be *uniform*, and putting them in a Saga makes them diverge silently — a descriptor that can pin its own scanner version is a descriptor that can downgrade one until a finding disappears.
Index ¶
Constants ¶
const EnvVar = "DRAUGR_CONFIG"
EnvVar names a config file explicitly, which is the organisation-wide lever: set it in a runner image and every pipeline picks up the same defaults with no per-repository change.
const FileName = "draugr.config.yaml"
FileName is the config a project may carry beside its Saga.
Variables ¶
This section is empty.
Functions ¶
func DeepMerge ¶
func DeepMerge(dst, src saga.ControllerSettings) saga.ControllerSettings
DeepMerge lays src over dst, recursing into nested maps so an override replaces only the keys it names. Exported because the same rule applies when these defaults meet a Saga's.
func Set ¶
Set writes key=value into a configuration document, returning the new bytes.
The document is edited as a node tree rather than decoded and re-encoded, so **comments survive**. A `config set` that silently deleted the explanation somebody wrote next to a version pin would teach people not to use it, and they would go back to hand-editing the file this command exists to keep valid.
The key is a dotted path — `tools.trivy.version`, `controllers.sca.mend.policy`. Intermediate mappings are created as needed.
func Unset ¶
Unset removes a key, and any mapping it leaves empty.
The cleanup matters: a `controllers.sca.mend` left behind as an empty mapping after its last setting is removed is not the same file as one that never mentioned mend, and the difference shows up later as a scanner block that exists and configures nothing.
Types ¶
type File ¶
type File struct {
// Tools pins the build of each external scanner. Provisioning rather than behaviour, and
// deliberately not readable from a Saga.
Tools map[string]ToolSettings `yaml:"tools,omitempty"`
// Controllers are default settings merged *underneath* the Saga's, so a project overrides
// only the keys it cares about and inherits the rest.
Controllers map[string]saga.ControllerSettings `yaml:"controllers,omitempty"`
}
File is a parsed configuration.
func Parse ¶
Parse decodes and validates a configuration.
Strict: an unknown key is an error rather than something ignored. A misspelled setting that is silently dropped is a setting somebody believes is in force, and this file exists to make behaviour uniform — a typo that quietly opts one machine out defeats the point of having it.
type Resolved ¶
Resolved is the configuration in effect, and the files it came from, nearest last.
func Load ¶
Load reads the configuration in effect.
An explicit path — `--config` or DRAUGR_CONFIG — is used *alone*. Explicit means explicit: a runner image that names a config expects that config, not that one layered over whatever happens to be in the working directory.
Otherwise the home file is layered under the project file, so a personal default can be overridden by a repository that has an opinion. Missing files are not an error; a machine with no configuration is the normal case.
type Source ¶
Source records where a loaded file came from, so a reader can be told which one to edit.
type ToolSettings ¶
type ToolSettings struct {
// Version is the release to install, e.g. "0.69.3".
Version string `yaml:"version,omitempty"`
}
ToolSettings pins one external tool.
Source Files