Documentation
¶
Overview ¶
Package diff compares two Draugr scan results and classifies every finding as new, fixed, or unchanged — the security delta of a change (typically a PR's head vs the base branch). It powers `draugr diff` and its differential gate ("fail only on findings this change introduces").
Inputs are SARIF reports (the results.sarif that `draugr scan -o` writes): SARIF is Draugr's complete, structured result currency, whereas the JSON summary can be trimmed by --min-priority.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type PriorityCounts ¶
type PriorityCounts struct {
P1 int `json:"p1"`
P2 int `json:"p2"`
P3 int `json:"p3"`
P4 int `json:"p4"`
}
PriorityCounts tallies findings by action band. Unprioritized findings are not counted here.
type Result ¶
type Result struct {
New []sarif.Result // present in head, absent in base
Fixed []sarif.Result // present in base, absent in head
Unchanged []sarif.Result // present in both (head copy)
}
Result is the classified delta between a base and a head report.
type SeverityCounts ¶ added in v0.63.0
type SeverityCounts struct {
Critical int `json:"critical"`
High int `json:"high"`
Medium int `json:"medium"`
Low int `json:"low"`
}
SeverityCounts tallies findings by Draugr's normalized severity band.
Bands rather than SARIF levels, because a diff is read next to the scan report it came from and the two have to agree. error/warning/note is the wire vocabulary of the file; a reader deciding whether a pull request made things worse is thinking in critical/high/medium/low.
Source Files