rules

type Config ¶

type Config struct {
	Enterprises map[string]map[string]map[string]any `yaml:"enterprises"`
	Orgs        map[string]map[string]map[string]any `yaml:"orgs"`
	Repos       map[string]map[string]map[string]any `yaml:"repos"`
}

Config holds per-target rule overrides, layered most-specific-wins on top of each rule's built-in defaults:

rule.Config  ->  enterprises[slug]  ->  orgs[name]  ->  repos[owner/repo]

Each override block is keyed by rule id. Within a block the reserved keys `enabled` (bool) and `severity` (string) tune the rule itself; every other key is merged into the rule's `cfg` map available to its CEL expressions.

func LoadConfig(data []byte) (*Config, error)

func (c *Config) Resolve(r Rule, enterprise, org, repo string) Resolved

type Resolved ¶

type Resolved struct {
	Enabled  bool
	Severity string
	Cfg      map[string]any
}

Resolved is a rule's effective settings for one specific target.

type Rule ¶

type Rule struct {
	ID       string         `yaml:"id"`
	Scope    Scope          `yaml:"scope"`
	Severity string         `yaml:"severity"`
	Title    string         `yaml:"title"`
	Pass     string         `yaml:"pass"`         // true => compliant
	Applies  string         `yaml:"applies_when"` // optional: false => skip (no row)
	Config   map[string]any `yaml:"config"`       // default knobs, overridable per target
	Enabled  *bool          `yaml:"enabled"`      // baseline on/off; nil => on. Config can override per target.
	FixHint  string         `yaml:"fix_hint"`
}

Rule is one policy check. The CEL expressions all evaluate to bool and read fact fields as top-level variables plus `cfg` (the rule's merged config).

type Ruleset ¶

type Ruleset struct {
	Rules []Rule `yaml:"rules"`
}

Ruleset is the full ordered list of rules.

func Load(data []byte) (*Ruleset, error)

func (rs *Ruleset) ByScope(s Scope) []Rule

type Scope ¶

type Scope string

Scope identifies which facts object a rule runs against.

const (
	ScopeEnterprise Scope = "enterprise"
	ScopeOrg        Scope = "org"
	ScopeRepo       Scope = "repo"
)