audit

package
v0.18.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 20, 2026 License: MIT Imports: 16 Imported by: 0

Documentation

Overview

Package audit reports workflow-conformance findings over a branch's git history. The range rules are advisory (ADR-0017): standalone, never wired into the gate. The shared CheckConventionalCommit rule is the exception - it is also consumed at commit time by the commit-gate and at plan time by `awf check` (ADR-0111). Most rules are pure over the commit range; the uncommitted-changes rule (ADR-0025) additionally inspects the live working tree.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Action

type Action int

Action is how a file changed in a commit.

const (
	Added Action = iota
	Modified
	Deleted
)

type Commit

type Commit struct {
	Hash    string
	Subject string
	Body    string
	IsMerge bool
	Changes []FileChange
}

Commit is a neutral view of one range commit. The rule engine reads only this.

func Collect

func Collect(repoRoot, base, head string) ([]Commit, error)

Collect returns the commits reachable from head but not from base, as neutral Commit values. The range is always caller-supplied (ADR-0127): there is no default and no configured base. Empty range -> nil. Not-a-repo, an unresolvable base or head, and unrelated histories are errors.

type FileChange

type FileChange struct {
	Path             string // repo-relative path (the new path; old path for a delete)
	OldPath          string // repo-relative pre-image path (differs only on rename)
	Action           Action
	Added, Deleted   int
	OldText, NewText string
}

FileChange is one file touched by a commit. OldText/NewText are populated only for ".md" files (cheap; the rules need ADR frontmatter), empty otherwise.

type Finding

type Finding struct {
	Severity Severity
	Rule     string
	Commit   string // short hash, "" for a branch-level finding
	Subject  string
	Detail   string
}

Finding is one reported conformance issue.

func CheckConventionalCommit added in v0.3.0

func CheckConventionalCommit(c Commit, s Settings) []Finding

CheckConventionalCommit validates one commit's subject against the Conventional Commits settings and returns any violations. It is the single definition of the rule - consumed by the audit range loop above, by the blocking `awf commit-gate` command (ADR-0036), and by the plan-time planned-subject check (CheckPlannedSubject, ADR-0111) - so none re-implements the regex, the type/scope allow-lists, or the subject-length limit. Merge commits are exempt. invariant: audit-conventional-commits touches-invariant: commit-gate-shared-rule - shared conventional-commit rule consumed by commit-gate; proof in commitgate_test.go

func CheckPlannedSubject added in v0.18.0

func CheckPlannedSubject(subject string, s Settings) []Finding

CheckPlannedSubject validates a commit subject a plan proposes (not yet committed) against the same rule, but relaxes a disallowed scope to a Warning: a plan may be the change that adds the scope (ADR-0111), so scope conformance is advisory at plan time while length, type, and malformed shape stay hard (Error).

func Run

func Run(repoRoot, base, head string, in Inputs) ([]Finding, int, error)

Run collects the caller-supplied commit range and evaluates the rules. The range arrives as parameters rather than Inputs fields because no config key supplies it (ADR-0127 Decision 3). It also returns the number of commits the range resolved to, so the caller can report the scope it evaluated rather than a bare verdict (ADR-0127 Decision 9).

type Inputs

type Inputs struct {
	Settings
	GeneratedPaths    map[string]bool
	ADRDir            string   // e.g. "docs/decisions"
	DocsDir           string   // e.g. "docs"; the authored-prose root (ADRDir and PlansDir sit under it)
	ActiveMd          string   // e.g. "docs/decisions/ACTIVE.md"
	PlansDir          string   // e.g. "docs/plans"
	ConfiguredDomains []string // config.Domains; staleness limited to these, undocumented-domain fires outside them
	DomainsPartsDir   string   // e.g. ".awf/domains/parts"
	DomainsIndexDir   string   // e.g. "docs/domains"; rendered per-domain index dir (adr-domain-cochange)
	// DomainPaths maps a configured domain to its sidecar-declared anchored
	// path globs (ADR-0077); empty = the domain-code-staleness rule is inert.
	DomainPaths map[string][]string
}

Inputs are the resolved audit settings plus the project-derived layout the rules need. The embedded Settings carries the resolved knobs (AllowedTypes, AllowedScopes, SubjectMaxLength, DependencyManifests, DiffThreshold, DomainDocStaleness, DomainCodeStaleness, UndocumentedDomain, UncommittedChanges, PlainPunctuation), promoted so the rules read in.AllowedTypes etc. directly.

type Settings

type Settings struct {
	AllowedTypes        []string
	AllowedScopes       []config.ScopeSpec
	DependencyManifests []string
	SubjectMaxLength    int
	DiffThreshold       int
	DomainDocStaleness  bool
	DomainCodeStaleness bool
	UndocumentedDomain  bool
	PlainPunctuation    bool
	UncommittedChanges  bool
}

Settings is the resolved, default-applied audit configuration the rules consume.

func Resolve

func Resolve(a *config.AuditConfig) Settings

Resolve resolves the effective audit settings from the raw config, applying defaults. A nil AuditConfig yields the full default set.

func (Settings) ScopeNames added in v0.8.0

func (s Settings) ScopeNames() []string

ScopeNames returns just the allowed scope names, for gate matching.

type Severity

type Severity int

Severity ranks a finding. Only Error findings make the command exit non-zero.

const (
	Warning Severity = iota
	Error
)

func (Severity) String

func (s Severity) String() string

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL