Documentation
¶
Overview ¶
Package pipeline orchestrates the scan, resolve, check, and report flow for a single run.
Index ¶
- Constants
- func CollectLiveDirectReachDeps(parsed []checks.ParsedWorkflow, live []dep.Dependency) []dep.Dependency
- func CollectLiveMovedReachDeps(parsed []checks.ParsedWorkflow, live []dep.Dependency) []dep.Dependency
- func CollectReachDeps(parsed []checks.ParsedWorkflow, live []dep.Dependency) []dep.Dependency
- func CollectResolvable(parsed []checks.ParsedWorkflow) ([]parserlock.ActionRef, []dep.Dependency)
- func CollectUnrecordedResolvable(parsed []checks.ParsedWorkflow, recordedKeys map[string]bool) ([]parserlock.ActionRef, []dep.Dependency)
- func Diagnose(ctx context.Context, paths []string, r *resolve.Resolver, ...) *checks.Report
- func DiagnoseParsed(ctx context.Context, parsed []checks.ParsedWorkflow, r *resolve.Resolver, ...) *checks.Report
- func DocURLFor(c checks.Category) string
- func ParseAll(paths []string, store *lockfile.State) []checks.ParsedWorkflow
- func ReleasesURL(owner, repo, ref string) string
- type RunOptions
- type RunResult
Constants ¶
const ImpostorCommitContext = "Off-branch commits are indistinguishable from impostor commits"
ImpostorCommitContext explains why off-branch commits are dangerous. Shown just before the escalation copy so users understand the risk.
const PublisherEscalationCopy = "Ask the action maintainer to tag releases from a branch"
PublisherEscalationCopy is the standardized one-liner shown in any block where a SHA fell off-branch on the publisher side. Phrased as direct guidance so users know what to do next: ask the maintainer to tag from a branch.
const PublisherTagReleasesDocURL = "https://docs.github.com/en/actions/how-tos/create-and-publish-actions/manage-custom-actions#using-tags-for-release-management"
PublisherTagReleasesDocURL points to GitHub's guidance for action publishers on tagging releases from a branch. It's surfaced alongside impostor-commit findings to help users escalate to the action's maintainer when the pinned SHA is orphaned (off any branch) — a publisher behavior the consumer can't fix locally beyond re-pinning to a sane release.
Variables ¶
This section is empty.
Functions ¶
func CollectLiveDirectReachDeps ¶
func CollectLiveDirectReachDeps(parsed []checks.ParsedWorkflow, live []dep.Dependency) []dep.Dependency
CollectLiveDirectReachDeps is the cmd-level pre-warm analogue of liveDirectReachDeps. Returns the deduplicated set of synthetic live deps across all parsed workflows that need a fresh reachability check because they're outside both the locked-SHA and live-moved sweeps. On a fully steady-state lockfile this is empty; on a brand-new repo (no lockfile yet) it's the full live set.
func CollectLiveMovedReachDeps ¶
func CollectLiveMovedReachDeps(parsed []checks.ParsedWorkflow, live []dep.Dependency) []dep.Dependency
CollectLiveMovedReachDeps returns the deduplicated set of synthetic dependencies (NWO, Ref + LIVE SHA) for which a reachability check should be pre-warmed. Each entry pairs an existing lockfile dep with the LIVE SHA it currently resolves to, when they differ — the input that lets the engine emit checks.ImpostorCommit for the tag-hijacked-to-fork-network shape. Pass live as the result of a single ResolveAllRecursive over the union of refs.
func CollectReachDeps ¶
func CollectReachDeps(parsed []checks.ParsedWorkflow, live []dep.Dependency) []dep.Dependency
CollectReachDeps returns the deduplicated union of existing deps across the given parsed workflows that will need a fresh reachability network check once diagnostics runs. It mirrors the per-workflow partition diagnose performs internally (see partitionReachByLive) but operates over the union, so callers can pre-warm CheckReachabilityAll once across every unresolved workflow instead of paying the per-workflow repo-warmup + per-dep concurrency cost serially. Pass live as the result of a single ResolveAllRecursive over the union of refs (the resolver cache makes the per-workflow re-lookups inside diagnose free).
func CollectResolvable ¶
func CollectResolvable(parsed []checks.ParsedWorkflow) ([]parserlock.ActionRef, []dep.Dependency)
CollectResolvable returns the deduplicated union of refs and existing deps across all parsed workflows. Use the returned slices to pre-warm the resolver caches once before per-workflow diagnostics.
func CollectUnrecordedResolvable ¶
func CollectUnrecordedResolvable(parsed []checks.ParsedWorkflow, recordedKeys map[string]bool) ([]parserlock.ActionRef, []dep.Dependency)
CollectUnrecordedResolvable is like CollectResolvable but excludes refs whose NWO@Ref key appears in recordedKeys. Deps whose key is in recordedKeys are also excluded. Use this when per-dep lockfile trust has already seeded the resolver cache for recorded deps, so only genuinely new refs need network resolution.
func Diagnose ¶
func Diagnose(ctx context.Context, paths []string, r *resolve.Resolver, store *lockfile.State, pool *pinpool.Pool) *checks.Report
Diagnose scans workflows and produces findings for each.
It is a backward-compatible wrapper around ParseAll, resolver pre-warming, and DiagnoseParsed. Newer callers can drive those phases directly to control UI progress.
func DiagnoseParsed ¶
func DiagnoseParsed(ctx context.Context, parsed []checks.ParsedWorkflow, r *resolve.Resolver, store *lockfile.State, pool *pinpool.Pool) *checks.Report
DiagnoseParsed runs the engine diagnostics for each pre-parsed workflow. Assumes the resolver caches have already been warmed (calls into the resolver will hit cache and stay silent). Returns a checks.Report aggregating per- workflow findings in input order.
func DocURLFor ¶
DocURLFor returns the documentation URL for a finding category, or "" when the category has no associated URL (e.g. checks.Valid).
func ParseAll ¶
func ParseAll(paths []string, store *lockfile.State) []checks.ParsedWorkflow
ParseAll loads and parses every workflow path, returning a slice in input order. onScan, if non-nil, fires with 1-based progress before each workflow is parsed so the UI can render i/N without leaking resolver detail.
func ReleasesURL ¶
ReleasesURL returns the GitHub releases URL for an action. When ref looks like a tag, links to the specific release; otherwise links to the releases index so users can pick one.
Types ¶
type RunOptions ¶
type RunOptions struct {
WorkflowPaths []string
Resolver *resolve.Resolver
Tagger *tag.Lister
Store *lockfile.State
Pool *pinpool.Pool
Rescan bool // re-verify all pins end-to-end
// Resolver UX hooks — set these for interactive spinner mode.
OnResolveProgress func(done, total int)
// Profile receives phase timing when profiling is enabled.
Profile *profile.Session
}
RunOptions configures the Run pipeline.
Source Files
Directories