Documentation
¶
Overview ¶
Package format renders check reports for the `check` command.
Index ¶
- func DepReleaseURL(dep string, isTagObject TagObjectCheck) string
- func IsAlertedCategory(c checks.Category) bool
- func IsAutoFixable(c checks.Category) bool
- func PresentReadOnlyFailures(out *ui.UI, report *checks.Report) (hasFixable bool)
- func PresentResults(out *ui.UI, report *checks.Report, valid bool, willRemediate bool, ...)
- func ValidateJSONFields(fieldsCSV string) error
- func WorkflowsForDep(report *checks.Report, depKey string) []string
- func WriteJSON(w io.Writer, report *checks.Report, valid bool, ...) error
- type Dependency
- type Finding
- type TagObjectCheck
- type Workflow
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DepReleaseURL ¶
func DepReleaseURL(dep string, isTagObject TagObjectCheck) string
DepReleaseURL derives a GitHub URL from a dep key of the form "owner/repo[/path]@ref". Commit-SHA pins link to /commit/<sha> (the diff view). Annotated-tag-object SHAs link to /tree/<sha> instead — /commit/<tagobject-sha> returns 404 because the tag object is not a commit. Non-SHA refs link to /releases/tag/<ref>. A nil isTagObject (or one that returns false) falls back to the plain /commit/<sha> path.
func IsAlertedCategory ¶
IsAlertedCategory reports whether a finding category has no auto-fix and requires human investigation (already surfaced in PresentResults — the remediator should not re-print it in non-interactive mode).
func IsAutoFixable ¶ added in v0.1.6
IsAutoFixable reports whether a plain `gh actions-lock` run (no --no-fix) re-pins the finding without operator intervention. Only structural drift qualifies: a missing, changed, or orphaned lock entry. Integrity failures (unreachable-pin, misleading-sha) need investigation or --accept-moved, and local-path actions aren't supported at all — so none of those should trigger the "Re-run without --no-fix to apply fixes" hint.
func PresentReadOnlyFailures ¶ added in v0.1.6
PresentReadOnlyFailures renders error-level findings directly to the terminal for read-only modes (--no-fix / --verify). Those modes return before the fix-mode summary (renderPinSummary) runs, so the error block that renderErrorFindings emits via the narration helpers is discarded when the log sink is io.Discard. This uses the Term* family instead so failures actually reach the operator.
It reports whether any failing finding is auto-fixable (i.e. not an investigation-only category) so the caller can decide whether the "re-run to fix" hint is honest.
func PresentResults ¶
func PresentResults(out *ui.UI, report *checks.Report, valid bool, willRemediate bool, excludeCategories ...checks.Category)
PresentResults renders human-readable output from a check report.
Warning surfaces (RepoFindings, ParseWarnings, not-pinned, sha-as-ref, ref-moved, inconclusive) use the Term* family so they reach the terminal even when check.go has routed the narration log to io.Discard. The error block and the "All N valid" success line still use narration helpers — both are re-rendered by check.go's post-remediation Term* summary, so we'd duplicate output if we surfaced them here too.
func ValidateJSONFields ¶
ValidateJSONFields checks that every comma-separated entry in fieldsCSV is a recognized --json output field. An empty selection is valid (no JSON output requested). Wire this into a command's PreRunE so a bad --json list is rejected before any workflow or lockfile mutation runs, instead of failing late in WriteJSON after side effects.
func WorkflowsForDep ¶
WorkflowsForDep returns workflow paths whose findings reference the given dependency key (ordered as they appear in the report, deduplicated).
func WriteJSON ¶
func WriteJSON(w io.Writer, report *checks.Report, valid bool, fieldsCSV, cliVersion, lockfileVersion string) error
WriteJSON writes the unified JSON output for `check --json`. fieldsCSV is the comma-separated user selection (e.g. "valid,findings,workflows"). cliVersion and lockfileVersion are emitted as top-level fields so consumers can pin behavior to a known schema.
Types ¶
type Dependency ¶
type Dependency struct {
NWO string `json:"nwo"`
Ref string `json:"ref"`
SHA string `json:"sha"`
HashAlgo string `json:"hash_algo,omitempty"`
Direct bool `json:"direct"`
RequiredBy []string `json:"required_by,omitempty"`
}
Dependency is the JSON-safe view of a resolved dependency, deduplicated across workflows in the JSON output.
type Finding ¶
type Finding struct {
Workflow string `json:"workflow"`
Category string `json:"category"`
Severity string `json:"severity"`
Confidence string `json:"confidence,omitempty"`
Dependency string `json:"dependency,omitempty"`
RequiredBy string `json:"required_by,omitempty"`
Detail string `json:"detail"`
Remediation string `json:"remediation,omitempty"`
DocURL string `json:"doc_url,omitempty"`
}
Finding is the JSON-safe view of a checks.Finding.
type TagObjectCheck ¶
TagObjectCheck reports whether the given SHA is a known annotated-tag object in owner/repo. Used by DepReleaseURL so it can pick /tree/<sha> over /commit/<sha> for tag objects (which 404 under /commit/). Pass nil to skip the check and always use /commit/<sha>. *resolve.Resolver's IsKnownTagObject method satisfies the signature directly.
Source Files