Documentation
¶
Overview ¶
Package pipeline orchestrates the scan, resolve, check, and report flow for a single run.
Index ¶
- Constants
- func CollectResolvable(parsed []checks.ParsedWorkflow) ([]parserlock.ActionRef, []dep.Dependency)
- func CollectUnrecordedResolvable(parsed []checks.ParsedWorkflow, recordedKeys map[string]bool) ([]parserlock.ActionRef, []dep.Dependency)
- func Diagnose(ctx context.Context, paths []string, r *resolve.Resolver, ...) *checks.Report
- func DiagnoseParsed(ctx context.Context, parsed []checks.ParsedWorkflow, r *resolve.Resolver, ...) *checks.Report
- func DocURLFor(c checks.Category) string
- func ParseAll(paths []string, store *lockfile.State) []checks.ParsedWorkflow
- func ReleasesURL(owner, repo, ref string) string
- func VerifyLocalCoverage(parsed []checks.ParsedWorkflow, store *lockfile.State) *checks.Report
- type RunOptions
- type RunResult
Constants ¶
const PublisherEscalationCopy = "Ask the action maintainer to tag releases from a branch"
PublisherEscalationCopy is the standardized one-liner shown in any block where a SHA fell off-branch on the publisher side. Phrased as direct guidance so users know what to do next: ask the maintainer to tag from a branch.
const PublisherTagReleasesDocURL = "https://docs.github.com/en/actions/how-tos/create-and-publish-actions/manage-custom-actions#using-tags-for-release-management"
PublisherTagReleasesDocURL points to GitHub's guidance for action publishers on tagging releases from a branch. It's surfaced alongside unreachable-pin findings to help users escalate to the action's maintainer when the pinned SHA is orphaned (off any branch) — a publisher behavior the consumer can't fix locally beyond re-pinning to a sane release.
Variables ¶
This section is empty.
Functions ¶
func CollectResolvable ¶
func CollectResolvable(parsed []checks.ParsedWorkflow) ([]parserlock.ActionRef, []dep.Dependency)
CollectResolvable returns the deduplicated union of refs and existing deps across all parsed workflows. Use the returned slices to pre-warm the resolver caches once before per-workflow diagnostics.
func CollectUnrecordedResolvable ¶
func CollectUnrecordedResolvable(parsed []checks.ParsedWorkflow, recordedKeys map[string]bool) ([]parserlock.ActionRef, []dep.Dependency)
CollectUnrecordedResolvable is like CollectResolvable but excludes refs whose NWO@Ref key appears in recordedKeys. Deps whose key is in recordedKeys are also excluded. Use this when per-dep lockfile trust has already seeded the resolver cache for recorded deps, so only genuinely new refs need network resolution.
func Diagnose ¶
func Diagnose(ctx context.Context, paths []string, r *resolve.Resolver, store *lockfile.State, pool *pinpool.Pool) *checks.Report
Diagnose scans workflows and produces findings for each.
It is a backward-compatible wrapper around ParseAll, resolver pre-warming, and DiagnoseParsed. Newer callers can drive those phases directly to control UI progress.
func DiagnoseParsed ¶
func DiagnoseParsed(ctx context.Context, parsed []checks.ParsedWorkflow, r *resolve.Resolver, store *lockfile.State, pool *pinpool.Pool) *checks.Report
DiagnoseParsed runs engine diagnostics for each pre-parsed workflow, assuming the resolver caches are warm (calls hit cache and stay silent). Returns a checks.Report aggregating per-workflow findings in input order.
func DocURLFor ¶
DocURLFor returns the documentation URL for a finding category, or "" when the category has no associated URL (e.g. checks.Valid).
func ParseAll ¶
func ParseAll(paths []string, store *lockfile.State) []checks.ParsedWorkflow
ParseAll loads and parses every workflow path, returning a slice in input order. onScan, if non-nil, fires with 1-based progress before each workflow is parsed so the UI can render i/N without leaking resolver detail.
func ReleasesURL ¶
ReleasesURL returns the GitHub releases URL for an action. When ref looks like a tag, links to the specific release; otherwise links to the releases index so users can pick one.
func VerifyLocalCoverage ¶ added in v0.1.6
VerifyLocalCoverage performs a zero-network static check: every action ref in the parsed workflows must have a matching lockfile entry. Returns a Report with NotPinned findings for any uncovered refs, suitable for rendering with the standard terminal or JSON formatters.
Types ¶
type RunOptions ¶
type RunOptions struct {
WorkflowPaths []string
Resolver *resolve.Resolver
Store *lockfile.State
Pool *pinpool.Pool
// Relock re-resolves every ref live instead of trusting the lockfile.
Relock bool
// Verify also checks that each pin on a mutable ref is still in that
// ref's history, at one Compare call per ref that moved.
Verify bool
// Resolver UX hooks — set these for interactive spinner mode.
OnResolveProgress func(done, total int)
// Profile receives phase timing when profiling is enabled.
Profile *profile.Session
}
RunOptions configures the Run pipeline.
Source Files
Directories