Documentation
¶
Overview ¶
Package engine evaluates a ruleset against collected facts using CEL and produces findings. It is pure and deterministic: same facts + same rules + same config always yield the same findings. No network, no model.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Engine ¶
type Engine struct {
// contains filtered or unexported fields
}
Engine evaluates a single scope's rules. Build one per scope via New.
func New ¶
New compiles the given rules against a CEL environment whose top-level variables are `varNames` (the union of fact-field names for the scope) plus `cfg`. A compile error in any expression is returned — this is the lint that catches a typo'd field name or a non-boolean rule before evaluation.
func (*Engine) Evaluate ¶
Evaluate runs every compiled rule against every target, resolving per-target config via cfg layered enterprise→org→repo. The org and repo keys are derived from each target: for org scope the org is the target's own name; for repo scope (Name "owner/repo") the org is the owner. This lets one Evaluate span multiple orgs, each resolving its own overrides. Disabled rules and not-applicable targets emit no finding.
type Finding ¶
type Finding struct {
ID string `json:"id"`
Scope string `json:"scope"`
Severity string `json:"severity"`
Title string `json:"title"`
Target string `json:"target"`
Status Status `json:"status"`
Notes string `json:"notes,omitempty"`
FixHint string `json:"fix_hint,omitempty"`
}
Finding is the result of one rule against one target.
Source Files