Documentation
¶
Overview ¶
Package dependabot discovers and audits Dependabot configuration files.
Dependabot configuration is a distinct input type from CI workflows: it does not describe jobs or steps, but it does govern how third-party code enters the repository. Because its schema shares nothing with a workflow, it is parsed and audited through a parallel pipeline rather than being coerced into the workflow model.
Index ¶
Constants ¶
const DefaultCooldownDays = 7
DefaultCooldownDays is the minimum cooldown this analyzer recommends.
Dependabot's own default is shorter. A week is used here because the opportunistic package compromises this protects against are typically detected and yanked by the registry within a few days of publication.
Variables ¶
This section is empty.
Functions ¶
func CheckAll ¶
func CheckAll(files []ConfigFile, cfg rules.ConfigInterface) []rules.Finding
CheckAll runs every Dependabot rule against every discovered config file, honouring the enabled/disabled and ignore settings from configuration.
The config parameter may be nil, in which case all rules run unfiltered.
Types ¶
type Config ¶
Config models the subset of the Dependabot schema relevant to security auditing. Unknown fields are ignored so that unrelated schema additions do not break parsing.
type ConfigFile ¶
type ConfigFile struct {
// Path is the location of the file, relative to the repository root where
// possible, for use in findings and report URLs.
Path string
Name string
// Content is the raw file bytes, retained for line-number resolution.
Content []byte
Config Config
}
ConfigFile is a discovered and parsed Dependabot configuration file.
func FindConfigs ¶
func FindConfigs(repoPath string) ([]ConfigFile, error)
FindConfigs locates and parses Dependabot configuration in a repository.
A repository with no Dependabot configuration is a normal, valid state, so this returns an empty slice rather than an error in that case. Callers should treat "no configuration" as "nothing to audit", not as a failure.
func LoadConfig ¶
func LoadConfig(path string) (ConfigFile, error)
LoadConfig reads and parses a single Dependabot configuration file.
type Cooldown ¶
type Cooldown struct {
DefaultDays int `yaml:"default-days"`
SemverMajorDays int `yaml:"semver-major-days"`
SemverMinorDays int `yaml:"semver-minor-days"`
SemverPatchDays int `yaml:"semver-patch-days"`
}
Cooldown describes the delay applied before a newly released version is proposed.
type Rule ¶
type Rule struct {
ID string
Name string
Description string
Severity rules.Severity
Category rules.Category
Check func(file ConfigFile) []rules.Finding
}
Rule is a security rule that operates on a Dependabot configuration file.
It mirrors rules.Rule but takes a ConfigFile, because Dependabot config has no jobs or steps to fit the workflow rule signature.
func StandardRules ¶
func StandardRules() []Rule
StandardRules returns the built-in Dependabot configuration rules.
type Schedule ¶
type Schedule struct {
Interval string `yaml:"interval"`
}
Schedule describes how often Dependabot checks for updates.
type Update ¶
type Update struct {
PackageEcosystem string `yaml:"package-ecosystem"`
Directory string `yaml:"directory"`
Directories []string `yaml:"directories"`
Schedule Schedule `yaml:"schedule"`
// Cooldown delays adoption of newly published releases. A nil pointer
// distinguishes "absent" from "explicitly set to zero".
Cooldown *Cooldown `yaml:"cooldown"`
// InsecureExternalCodeExecution opts in to running dependency manifest code
// during resolution. Valid values are "allow" and "deny".
InsecureExternalCodeExecution string `yaml:"insecure-external-code-execution"`
Registries interface{} `yaml:"registries"`
}
Update is a single entry in the `updates:` list, describing one ecosystem.
func (Update) EcosystemLabel ¶
EcosystemLabel returns a human-readable identifier for an update entry, used to make findings actionable when a config declares several ecosystems.
Source Files