stackpolicy

package

v1.0.0-rc.5 Latest Latest Go to latest Published: Nov 8, 2026 License: Apache-2.0 Imports: 17 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/gridctl/gridctl

Links

Open Source Insights

Documentation ¶

Rendered for

Overview ¶

Package stackpolicy evaluates captured stack declarations against a versioned offline policy file selected by gridctl validate --policy.

It does not authorize deployment, inspect runtime state, or change ordinary validate, apply, REST, or reload behavior.

Index ¶

Constants
func ExitCode(r *Report) int
func FormatJSON(w io.Writer, r *Report) error
func FormatText(w io.Writer, r *Report) error
type Coverage
type Diagnostic
type Exclusion
type Location
type Outcome
type PolicyInfo
type Report
- func Evaluate(ctx context.Context, stackPath, policyPath string) *Report
type Result
type Status
type Warning

Constants ¶

View Source

const (
	PolicyVersion  = "1"
	CheckerVersion = "1"
	SchemaVersion  = 1
)

View Source

const (
	RuleExplicitImageDigests    = "explicit-image-digests"
	RuleDenyLocalCommandServers = "deny-local-command-servers"
	RuleDenySSHServers          = "deny-ssh-servers"
	RuleSchemaPinningEnabled    = "schema-pinning-enabled"
	RuleSchemaPinningBlock      = "schema-pinning-block"
	RuleNonemptyServerToolLists = "nonempty-server-tool-lists"
)

View Source

const WarningLiteralToolNameNotPattern = "literal-tool-name-not-pattern"

Variables ¶

This section is empty.

Functions ¶

func ExitCode ¶

func ExitCode(r *Report) int

ExitCode returns the validate-family exit: 0 accepted, 1 not accepted, 2 accepted with warnings only.

func FormatJSON ¶

func FormatJSON(w io.Writer, r *Report) error

FormatJSON writes one versioned JSON document. It buffers first so a failed encode does not emit a partial report.

func FormatText ¶

func FormatText(w io.Writer, r *Report) error

FormatText writes the stable human report. Findings use aliases and structural paths rather than raw candidate values.

Types ¶

type Coverage ¶

type Coverage struct {
	RulesSelected    int         `json:"rules_selected"`
	ApplicableChecks int         `json:"applicable_checks"`
	NotApplicable    int         `json:"not_applicable"`
	Exclusions       []Exclusion `json:"exclusions"`
}

type Diagnostic ¶

type Diagnostic struct {
	Code     string   `json:"code"`
	Location Location `json:"location"`
	Message  string   `json:"message"`
}

type Exclusion ¶

type Exclusion struct {
	Rule       string `json:"rule"`
	ReasonCode string `json:"reason_code"`
	Count      int    `json:"count"`
}

type Location ¶

type Location struct {
	Source string `json:"source"`
	Path   string `json:"path,omitempty"`
	Line   int    `json:"line,omitempty"`
	Column int    `json:"column,omitempty"`
}

type Outcome ¶

type Outcome string

const (
	OutcomePass          Outcome = "pass"
	OutcomeViolation     Outcome = "violation"
	OutcomeUnknown       Outcome = "unknown"
	OutcomeNotApplicable Outcome = "not_applicable"
)

type PolicyInfo ¶

type PolicyInfo struct {
	Version string   `json:"version"`
	Digest  string   `json:"digest"`
	Enabled []string `json:"enabled"`
}

type Report ¶

type Report struct {
	SchemaVersion      int          `json:"schema_version"`
	CheckerVersion     string       `json:"checker_version"`
	Policy             PolicyInfo   `json:"policy"`
	Accepted           bool         `json:"accepted"`
	EvaluationComplete bool         `json:"evaluation_complete"`
	Status             Status       `json:"status"`
	Coverage           Coverage     `json:"coverage"`
	Results            []Result     `json:"results"`
	Warnings           []Warning    `json:"warnings"`
	Diagnostics        []Diagnostic `json:"diagnostics"`
}

func Evaluate ¶

func Evaluate(ctx context.Context, stackPath, policyPath string) *Report

Evaluate captures the selected policy and candidate stack graph, then reports per-subject outcomes for the enabled rules. It always returns a report; callers should use ExitCode and FormatJSON or FormatText.

type Result ¶

type Result struct {
	Rule        string   `json:"rule"`
	Outcome     Outcome  `json:"outcome"`
	Location    Location `json:"location"`
	ReasonCode  string   `json:"reason_code"`
	Message     string   `json:"message"`
	Remediation string   `json:"remediation,omitempty"`
}

type Status ¶

type Status string

const (
	StatusAccepted      Status = "accepted"
	StatusRejected      Status = "rejected"
	StatusIndeterminate Status = "indeterminate"
	StatusError         Status = "error"
)

type Warning ¶

type Warning struct {
	Code     string   `json:"code"`
	Location Location `json:"location"`
	Message  string   `json:"message"`
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL