data

package
v0.32.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 15, 2026 License: Apache-2.0 Imports: 31 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var APIBase = "https://api.github.com"
View Source 
var ErrRateLimited = errors.New("request was rate limited (403)")

ErrRateLimited is returned when GitHub responds 403, which the retry layer treats as permanent rather than transient. A caller basing a verdict on a missing signal should treat this differently from "the signal is absent", since a rate-limited scan cannot observe the signal at all.

View Source 
var ErrRefUnresolvable = errors.New("ref does not resolve to a commit")

ErrRefUnresolvable is returned by RefExists when GitHub reports no commit at the given ref (a deleted or re-pointed tag). Distinguishing this from "ref exists but has no license file" matters because a 404 from the license-at-ref endpoint means the same thing in both cases.

View Source 
var MaturityLevelAliases = map[string]string{
	"Maturity Level 1": "maturity-1",
	"maturity-1":       "maturity-1",
	"Maturity Level 2": "maturity-2",
	"maturity-2":       "maturity-2",
	"Maturity Level 3": "maturity-3",
	"maturity-3":       "maturity-3",
}

MaturityLevelAliases maps every spelling of an OSPS maturity level seen in catalog data or released results files to the canonical maturity-N form.

View Source 
var SupportedCatalogIDs = []string{
	"osps-baseline",
	"osps-baseline-2025-10",
	"osps-baseline-2026-02",
	"osps-baseline-2026-08",
}

SupportedCatalogIDs is the declared compatibility contract for catalog IDs that must continue to exist in bundled catalog data.

Functions

func Loader 

func Loader(config *config.Config) (payload any, err error)

func ObservedUnprotected added in v0.29.0 

func ObservedUnprotected(metadata RepositoryMetadata) bool

ObservedUnprotected reports whether the scan positively observed that the default branch has no protection of any kind. Unlike the admin-only protection details, this negative holds for any token, so callers may fail on it rather than report it as unobservable.

Types

type BinaryAnalysis added in v0.27.0 

type BinaryAnalysis struct {
	Suspected    []string // suspected executable binary artifacts
	Unreviewable []string // unreviewable binary artifacts
	Err          error
}

BinaryAnalysis holds information about binaries found in the repo

type ClientMock 

type ClientMock struct {
	Response *http.Response
	Err      error
}

func (*ClientMock) Do 

func (c *ClientMock) Do(req *http.Request) (*http.Response, error)

type DocumentationFile added in v0.29.0 

type DocumentationFile struct {
	Path    string
	Content string
}

DocumentationFile is a decoded text document from an established repository documentation location.

type GitHubRepositoryMetadata 

type GitHubRepositoryMetadata struct {
	Releases []ReleaseData
	// contains filtered or unexported fields
}

func (*GitHubRepositoryMetadata) DefaultBranchProtectedFlag added in v0.29.0 

func (r *GitHubRepositoryMetadata) DefaultBranchProtectedFlag() *bool

DefaultBranchProtectedFlag returns the `protected` boolean from the REST "Get a branch" endpoint, or nil when the branch fetch failed. It is true when either classic branch protection or any ruleset applies, so true is a weak positive (it may reflect only a deletion rule) while false proves neither exists. Readable by any token, including anonymous ones — verified empirically against github.com (2026-08); undocumented, so GHES may differ.

func (*GitHubRepositoryMetadata) DefaultBranchPullRequestReviewRules added in v0.29.0 

func (r *GitHubRepositoryMetadata) DefaultBranchPullRequestReviewRules() PullRequestReviewRules

DefaultBranchPullRequestReviewRules aggregates every applying pull_request rule; see PullRequestReviewRules for the aggregation semantics.

func (*GitHubRepositoryMetadata) DefaultBranchRequiresPRReviews added in v0.19.0 

func (r *GitHubRepositoryMetadata) DefaultBranchRequiresPRReviews() *bool

func (*GitHubRepositoryMetadata) HasBranchRules added in v0.27.0 

func (r *GitHubRepositoryMetadata) HasBranchRules() bool

HasBranchRules reports whether any ruleset at all applies to the default branch, which determines whether rulesets or branch protection are treated as the authoritative source for status check requirements.

func (*GitHubRepositoryMetadata) Homepage added in v0.28.0 

func (r *GitHubRepositoryMetadata) Homepage() string

Homepage returns the repository's configured homepage URL, or "" when unset. It is observable without Security Insights and used as a fallback link to evaluate for HTTPS. GetHomepage is nil-safe on a missing repository.

func (*GitHubRepositoryMetadata) IsActive 

func (r *GitHubRepositoryMetadata) IsActive() bool

func (*GitHubRepositoryMetadata) IsDefaultBranchProtected added in v0.19.0 

func (r *GitHubRepositoryMetadata) IsDefaultBranchProtected() *bool

func (*GitHubRepositoryMetadata) IsDefaultBranchProtectedFromDeletion added in v0.19.0 

func (r *GitHubRepositoryMetadata) IsDefaultBranchProtectedFromDeletion() *bool

func (*GitHubRepositoryMetadata) IsPublic 

func (r *GitHubRepositoryMetadata) IsPublic() bool

func (*GitHubRepositoryMetadata) OrganizationBlogURL 

func (r *GitHubRepositoryMetadata) OrganizationBlogURL() *string

func (*GitHubRepositoryMetadata) RequiredStatusCheckContexts added in v0.27.0 

func (r *GitHubRepositoryMetadata) RequiredStatusCheckContexts() []string

RequiredStatusCheckContexts returns the names of the status checks that the default branch's rulesets mark as required.

func (*GitHubRepositoryMetadata) RequiredStatusChecks added in v0.29.0 

func (r *GitHubRepositoryMetadata) RequiredStatusChecks() []RequiredStatusCheck

RequiredStatusChecks returns ruleset checks without discarding producer pins.

func (*GitHubRepositoryMetadata) RulesetsObserved added in v0.27.0 

func (r *GitHubRepositoryMetadata) RulesetsObserved() bool

RulesetsObserved reports whether the ruleset lookup for the default branch actually completed. The rulesets REST API is publicly readable, so a nil value means the fetch failed rather than that no rulesets exist — this lets callers tell "observed, none configured" from "never observed".

func (*GitHubRepositoryMetadata) ViewerCanAdminister added in v0.27.0 

func (r *GitHubRepositoryMetadata) ViewerCanAdminister() bool

ViewerCanAdminister reports whether the scanning token holds admin on the repository. GitHub exposes classic branch protection (the GraphQL BranchProtectionRule and RefUpdateRule objects) only to admins; for any other token they come back as zero values indistinguishable from "no protection". Callers gate on this to tell an observed absence of protection apart from an invisible one.

type GraphqlRepoData 

type GraphqlRepoData struct {
	Repository struct {
		Name                    string
		HasDiscussionsEnabled   bool
		HasIssuesEnabled        bool
		IsSecurityPolicyEnabled bool

		Object struct {
			Tree struct {
				Entries []struct {
					Name string
					Type string // "blob" for files, "tree" for directories
					Path string
				}
			} `graphql:"... on Tree"`
		} `graphql:"object(expression: \"HEAD:\")"`

		DefaultBranchRef struct {
			Name          string
			RefUpdateRule struct {
				AllowsDeletions              bool
				AllowsForcePushes            bool
				RequiredApprovingReviewCount int
			}
			BranchProtectionRule struct {
				RestrictsPushes             bool // This didn't give an accurate result
				RequiresApprovingReviews    bool // This gave an accurate result
				RequiresCommitSignatures    bool
				RequiresStatusChecks        bool
				RequireLastPushApproval     bool
				DismissesStaleReviews       bool
				RequiredStatusCheckContexts []string
			}

			Target struct {
				OID    string `graphql:"oid"` // Latest commit SHA
				Commit struct {
					Status struct {
						State    string // Overall commit status
						Contexts []struct {
							Context     string
							Description string
							State       string
							TargetURL   string `graphql:"targetUrl"`
						}
					} `graphql:"status"` // Classic status API

					AssociatedPullRequests struct {
						Nodes []struct {
							StatusCheckRollup struct {
								Commit struct {
									CheckSuites struct {
										Nodes []struct {
											CheckRuns struct {
												Nodes []struct {
													Name string `graphql:"name"`
													// Conclusion is empty until the run completes.
													Conclusion string `graphql:"conclusion"`
												}
											} `graphql:"checkRuns(first: 25)"`
										}
									} `graphql:"checkSuites(first: 25)"`
								}
							}
						}
					} `graphql:"associatedPullRequests(last: 1)"`
				} `graphql:"... on Commit"`
			} `graphql:"target"`
		}
		LicenseInfo struct {
			Name   string
			SpdxId string
			Url    string
		}
		LatestRelease struct {
			Description string
			TagName     string
			Name        string
			Assets      struct {
				Nodes []ReleaseAssetNode
			} `graphql:"releaseAssets(first: 100)"`
		}
		ContributingGuidelines struct {
			Body string
		}
		Releases struct {
			Nodes []struct {
				TagName string
				Name    string
				Assets  struct {
					Nodes []struct {
						Name        string
						ContentType string
					}
				} `graphql:"releaseAssets(first: 100)"`
			}
		} `graphql:"releases(first: 1, orderBy: {field: CREATED_AT, direction: DESC})"`

		// Selected here rather than in its own query: it targets the same
		// repository node, so it costs nothing extra to fetch alongside.
		DependencyGraphManifests struct {
			TotalCount int
		}
	} `graphql:"repository(owner: $owner, name: $name)"`
}

GraphqlRepoData is used in a query to get general repository information

type GraphqlRepoTree 

type GraphqlRepoTree struct {
	Repository struct {
		Object struct {
			Tree struct {
				Entries []struct {
					Name   string
					Type   string
					Path   string
					Mode   int
					Object *struct {
						Blob struct {
							IsBinary    *bool
							IsTruncated bool
						} `graphql:"... on Blob"`
						Tree struct {
							Entries []struct {
								Name   string
								Type   string
								Path   string
								Mode   int
								Object *struct {
									Blob struct {
										IsBinary    *bool
										IsTruncated bool
									} `graphql:"... on Blob"`
									Tree struct {
										Entries []struct {
											Name   string
											Type   string
											Path   string
											Mode   int
											Object *struct {
												Blob struct {
													IsBinary    *bool
													IsTruncated bool
												} `graphql:"... on Blob"`
											} `graphql:"object"`
										}
									} `graphql:"... on Tree"`
								} `graphql:"object"`
							}
						} `graphql:"... on Tree"`
					} `graphql:"object"`
				}
			} `graphql:"... on Tree"`
		} `graphql:"object(expression: $branch)"`
	} `graphql:"repository(owner: $owner, name: $name)"`
}

type GraphqlWorkflowFiles added in v0.27.0 

type GraphqlWorkflowFiles struct {
	Repository struct {
		Object struct {
			Tree struct {
				Entries []WorkflowTreeEntry
			} `graphql:"... on Tree"`
		} `graphql:"object(expression: $expression)"`
	} `graphql:"repository(owner: $owner, name: $name)"`
}

GraphqlWorkflowFiles is the query for a single directory's entries, selecting each entry's name, path, and full text in one round trip.

type HttpClient 

type HttpClient interface {
	Do(req *http.Request) (*http.Response, error)
}

type Payload 

type Payload struct {
	*GraphqlRepoData
	*RestData
	*pluginkit.APICallCounter // Enable Privateer benchmarking for API calls
	Evidence                  *gemara.EvidenceCollector
	Config                    *config.Config
	RepositoryMetadata        RepositoryMetadata
	DependencyManifestsCount  int
	IsCodeRepo                bool
	// GraphqlPartialData is true when the GraphQL repo query returned a
	// field-level error alongside a resolved repository node: the failed
	// fields decoded to their zero values, so steps reading them cannot
	// distinguish "absent" from "not resolved" without consulting this flag.
	GraphqlPartialData bool
	SecurityPosture    SecurityPosture
	Binaries           BinaryAnalysis
	VexDocuments       []string
	VexDocumentsErr    error
	// contains filtered or unexported fields
}

func NewPayloadWithHTTPMock 

func NewPayloadWithHTTPMock(base Payload, body []byte, statusCode int, httpErr error) Payload

func NewPayloadWithRepoContents added in v0.28.0 

func NewPayloadWithRepoContents(base Payload, root []*github.RepositoryContent, subContents map[string][]*github.RepositoryContent) Payload

NewPayloadWithRepoContents builds a Payload whose RestData is backed by the given root and subdirectory listings, so that other packages' tests can exercise contents-based fallbacks (checkFile, FindFile, FindFileInDirs) without a live GitHub client. subContents maps a directory path such as ".github" or "docs" to its file listing.

func NewPayloadWithWorkflowCache added in v0.29.0 

func NewPayloadWithWorkflowCache(base Payload, files []WorkflowFile) Payload

NewPayloadWithWorkflowCache builds a Payload whose workflow cache is pre-seeded with the given files, so that other packages' tests can exercise workflow-content checks (via GetWorkflowFiles) without a live GitHub client. The cache is marked loaded so GetWorkflowFiles returns files as-is, even when empty, without attempting a fetch.

func (Payload) AddEvidence added in v0.28.0 

func (p Payload) AddEvidence(evidence gemara.Evidence)

AddEvidence, GetEvidence, and ClearEvidence implement gemara.HasEvidence. Nil-safe: a payload without a collector silently drops evidence.

func (Payload) ClearEvidence added in v0.28.0 

func (p Payload) ClearEvidence()

func (*Payload) GetDeclaredDocumentation added in v0.31.0 

func (p *Payload) GetDeclaredDocumentation(rawURL string) (DocumentationFile, error)

GetDeclaredDocumentation reads only the same-repository text artifact named by a Security Insights URL, at its declared ref. Results, including errors and empty documents, are shared across steps through the payload cache.

func (*Payload) GetDocumentationFiles added in v0.29.0 

func (p *Payload) GetDocumentationFiles() ([]DocumentationFile, error)

GetDocumentationFiles returns repository documentation once per payload. VM-05 has three controls that inspect the same documents, so caching avoids repeating a potentially large sequence of GitHub content requests. Unlike GetWorkflowFiles, errors are cached deliberately: the walk is expensive and returns whatever partial files it gathered alongside the error, so all three controls observe the same partial evidence rather than re-running the walk.

func (Payload) GetEvidence added in v0.28.0 

func (p Payload) GetEvidence() []gemara.Evidence

func (*Payload) GetLicenseAtRef added in v0.30.0 

func (p *Payload) GetLicenseAtRef(ref string) (RefLicense, bool, error)

GetLicenseAtRef returns the license GitHub detects at the given git ref, fetched once per payload per ref. Errors are cached deliberately, like GetDocumentationFiles: more than one control reads the same ref, and a lookup that just failed should surface the same evidence to all of them rather than being retried within one run. A payload without a cache (as built directly in tests) simply calls through uncached.

func (*Payload) GetWorkflowFiles added in v0.27.0 

func (p *Payload) GetWorkflowFiles() ([]WorkflowFile, error)

GetWorkflowFiles returns the decoded contents of every file in .github/workflows using a single GraphQL call, cached for reuse across the several build/release checks that inspect workflows.

type PrivateVulnReporting added in v0.28.0 

type PrivateVulnReporting struct {
	Enabled bool
	Known   bool
}

PrivateVulnReporting captures the repository's private-vulnerability-reporting setting as observed through the GitHub REST API. GitHub only answers this for public repositories and returns 404 otherwise, so Known distinguishes an observed value from "could not observe": an error or missing endpoint leaves Known false rather than reporting a confident Enabled=false. Steps rely on that distinction to choose NeedsReview over Failed when the signal is absent.

type PullRequestReviewRules added in v0.29.0 

type PullRequestReviewRules struct {
	Observed                bool
	RequiredApprovals       int
	RequireLastPushApproval bool
	DismissStaleReviews     bool
}

PullRequestReviewRules summarizes the pull_request rules the repository's rulesets enforce on the default branch. Observed distinguishes a completed ruleset lookup from one that never happened. When several rulesets apply, GitHub enforces all of them, so RequiredApprovals is the maximum declared count and the booleans are true when any applying rule sets them.

type RefLicense added in v0.30.0 

type RefLicense struct {
	// SpdxId is GitHub's classification of the license file, or "NOASSERTION"
	// when a license file exists but could not be identified.
	SpdxId string
	// Path is the location of the license file within the tree at the ref.
	Path string
}

RefLicense describes the license GitHub detects in the repository tree at a specific git ref.

type ReleaseAsset 

type ReleaseAsset struct {
	Name        string `json:"name"`
	DownloadURL string `json:"browser_download_url"`
}

type ReleaseAssetNode added in v0.29.0 

type ReleaseAssetNode struct {
	Name string
}

ReleaseAssetNode is one asset of the GraphQL latest release.

type ReleaseData 

type ReleaseData struct {
	Id      int    `json:"id"`
	Name    string `json:"name"`
	TagName string `json:"tag_name"`
	URL     string `json:"url"`
	Draft   bool   `json:"draft"`
	// Prerelease is GitHub's own flag for a release marked as not
	// production-ready; it must be excluded from "latest published release"
	// selection alongside drafts.
	Prerelease bool `json:"prerelease"`
	// PublishedAt is an RFC3339 timestamp. The /releases listing endpoint is
	// ordered by creation time, not publish time, so selecting "the latest"
	// release requires comparing this field rather than trusting list order.
	PublishedAt string         `json:"published_at"`
	Assets      []ReleaseAsset `json:"assets"`
}

type RepoContent 

type RepoContent struct {
	Content    []*github.RepositoryContent
	SubContent map[string]RepoContent
}

type RepoSecurityPosture 

type RepoSecurityPosture struct {
	// contains filtered or unexported fields
}

func (*RepoSecurityPosture) DefinesPolicyForHandlingSecrets 

func (rsp *RepoSecurityPosture) DefinesPolicyForHandlingSecrets() bool

func (*RepoSecurityPosture) InsightsDeclaresSecretScanning added in v0.28.0 

func (rsp *RepoSecurityPosture) InsightsDeclaresSecretScanning() bool

func (*RepoSecurityPosture) PreventsPushingSecrets 

func (rsp *RepoSecurityPosture) PreventsPushingSecrets() bool

func (*RepoSecurityPosture) ScansForSecrets 

func (rsp *RepoSecurityPosture) ScansForSecrets() bool

func (*RepoSecurityPosture) SecretScanningObservable added in v0.28.0 

func (rsp *RepoSecurityPosture) SecretScanningObservable() bool

type RepositoryMetadata 

type RepositoryMetadata interface {
	IsActive() bool
	IsPublic() bool
	Homepage() string
	OrganizationBlogURL() *string
	IsDefaultBranchProtected() *bool
	DefaultBranchRequiresPRReviews() *bool
	IsDefaultBranchProtectedFromDeletion() *bool
	HasBranchRules() bool
	RequiredStatusCheckContexts() []string
	RulesetsObserved() bool
	DefaultBranchPullRequestReviewRules() PullRequestReviewRules
	ViewerCanAdminister() bool
	DefaultBranchProtectedFlag() *bool
}

type RequiredStatusCheck added in v0.29.0 

type RequiredStatusCheck struct {
	Context       string
	IntegrationID *int64
}

RequiredStatusCheck retains the optional GitHub App pin attached to a ruleset check. A matching context produced by another app is not equivalent.

type RestData 

type RestData struct {
	Config              *config.Config
	WorkflowsEnabled    bool
	WorkflowPermissions WorkflowPermissions
	// WorkflowPermissionsObserved is true only when both admin-only Actions
	// endpoints were fetched and parsed successfully. When false, WorkflowsEnabled
	// and WorkflowPermissions are unset defaults rather than observed values, and
	// callers must not read "Actions disabled" or "write default" into them.
	WorkflowPermissionsObserved bool
	Insights                    si.SecurityInsights
	InsightsError               bool
	PrivateVulnReporting        PrivateVulnReporting
	SecurityAdvisories          SecurityAdvisories
	SecurityPolicy              SecurityPolicy
	Releases                    []ReleaseData
	ReleasesError               error `json:"-" yaml:"-"`

	HttpClient HttpClient `json:"-" yaml:"-"`
	// contains filtered or unexported fields
}

func NewRestDataWithContents added in v0.28.0 

func NewRestDataWithContents(contents RepoContent) *RestData

NewRestDataWithContents returns a RestData seeded with canned repository contents so file-presence checks can be exercised without a GitHub client. Pre-populating SubContent (e.g. for ".github") lets checkFile answer from the cache instead of making an API call. Security Insights is initialized to its empty-but-non-nil shape, matching the state Setup leaves it in.

func NewRestDataWithFailingClient added in v0.28.0 

func NewRestDataWithFailingClient(err error) *RestData

NewRestDataWithFailingClient returns a RestData whose GitHub REST client always fails with err, letting other packages' tests exercise transient fetch-error paths (e.g. GetFileContent) without a live GitHub API.

func (*RestData) DependencyToolingConfig added in v0.28.0 

func (r *RestData) DependencyToolingConfig() string

DependencyToolingConfig returns the path to the first automated dependency-update tool config found in the repository root or .github directory, or "" when none is present. checkFile probes .github case-insensitively, which is where Dependabot configs live.

func (*RestData) FindFile added in v0.27.0 

func (r *RestData) FindFile(names ...string) string

FindFile returns the repository path of the first of the given filenames found in the repository root or .github directory, matched case-insensitively. It reuses the REST contents fetched during Setup, so once .github has been probed it costs no additional API call. Returns "" when none of the names is present.

It exists so evaluation steps in other packages can run deterministic filesystem fallbacks without reaching into RestData's unexported checkFile.

func (*RestData) FindFileInDirs added in v0.28.0 

func (r *RestData) FindFileInDirs(dirs, names []string) string

FindFileInDirs returns the repository path of the first of the given filenames found in any of the given directories, matched case-insensitively. The empty string denotes the repository root. Directories absent from the cached root listing are skipped rather than fetched, and the search reuses the REST contents gathered during Setup. Returns "" when none of the names is present.

It exists so evaluation steps in other packages can run deterministic filesystem fallbacks (root, .github, docs) without reaching into RestData's unexported helpers.

func (*RestData) GetDocumentationFiles added in v0.29.0 

func (r *RestData) GetDocumentationFiles() ([]DocumentationFile, error)

GetDocumentationFiles reads text documentation from the repository root and the conventional .github, doc, docs, and documentation directories. It returns successfully decoded files even when another document could not be retrieved; callers can use that evidence while treating the returned error as an incomplete inspection.

func (*RestData) GetFileContent 

func (r *RestData) GetFileContent(path string) (content *github.RepositoryContent, err error)

GetFileContent retrieves the repository content at path. It returns an error when the fetch fails or when no file is found, so callers can distinguish a transient failure from an absent file.

func (*RestData) HasBuildInstructions added in v0.28.0 

func (r *RestData) HasBuildInstructions() bool

HasBuildInstructions returns true when the repository documents how to build the software from source. It is satisfied by a well-known build automation or build documentation file (e.g. Makefile, BUILDING.md) in the repository root, .github, or docs directory, or by a build-related section heading in the README or CONTRIBUTING guide.

func (*RestData) HasSupportMarkdown 

func (r *RestData) HasSupportMarkdown() bool

returns true when a file with case insensitive name matching support.md is found in the root or forge directories or when the readme.md contains a heading named "Support"

func (*RestData) IsCodeRepo 

func (r *RestData) IsCodeRepo() (bool, error)

IsCodeRepo returns true if the repository contains any programming languages.

TODO: Consider using GitHub Linguist metadata (https://github.com/github-linguist/linguist/blob/main/lib/linguist/languages.yml) to distinguish between programming, markup, data, and prose content types for more nuanced repository classification.

func (*RestData) LicenseAtRef added in v0.30.0 

func (r *RestData) LicenseAtRef(ref string) (license RefLicense, found bool, err error)

LicenseAtRef fetches the license GitHub detects for the repository at the given git ref (typically a release tag). GitHub's auto-generated release archives contain the tree at the tag, so this observes the license actually shipped with a release, which the default-branch license may no longer match.

A 404 means GitHub found no license file at that ref; it is reported as found=false with a nil error, distinct from request failures. MakeApiCall is not used here because its uniform non-200 error cannot make that distinction. A 403 is reported as ErrRateLimited rather than a generic error, since a caller basing a verdict on this lookup's absence needs to tell "checked and found nothing" apart from "could not check".

func (*RestData) MakeApiCall 

func (r *RestData) MakeApiCall(endpoint string, isGithub bool) (body []byte, err error)

func (*RestData) RefExists added in v0.30.0 

func (r *RestData) RefExists(ref string) (bool, error)

RefExists reports whether ref resolves to a commit. It is used to disambiguate a 404 from the license-at-ref endpoint: GitHub returns the same 404 whether the ref has no recognized license file or the ref itself no longer resolves (e.g. a tag deleted or force-moved after a release was published), and only the latter should be reported as ambiguous rather than "no license found".

func (*RestData) Setup 

func (r *RestData) Setup() error

Setup fetches every REST-backed data domain and returns any failures joined together (#42). Each domain degrades independently (checks fall back to NeedsReview on missing data), so the caller can log the error and continue the scan rather than aborting. Expected absences — the 403/404 an optional feature returns when it is not available for a repository — are not failures and are handled inside each fetcher.

type SecurityAdvisories added in v0.29.0 

type SecurityAdvisories struct {
	Count             int
	Known             bool
	CountIsLowerBound bool
}

SecurityAdvisories captures the repository's published GitHub security advisories (GHSAs) as observed through the REST API. Like PrivateVulnReporting, Known distinguishes an observed value from "could not observe": GitHub returns 403/404 for repositories without the advisory database enabled or without permission, which leaves Known false rather than reporting a confident Count of zero. Steps rely on that distinction to choose NeedsReview over a confident result when the signal is absent.

Only the first page of results is fetched (one is enough to answer "are there any?"), so CountIsLowerBound is set when that page came back full and the true total may be higher; callers use it to phrase the count as "at least".

type SecurityPolicy added in v0.28.0 

type SecurityPolicy struct {
	Present bool
	Content string
}

SecurityPolicy holds the repository's SECURITY.md as discovered through the GitHub API. Present is set when checkFile locates the file in the root or .github directory; Content holds its decoded body when it could be fetched.

type SecurityPosture 

type SecurityPosture interface {
	// PreventsPushingSecrets and ScansForSecrets report the push-protection and
	// secret-scanning settings observed in GitHub's security_and_analysis block.
	// They are false when the block was not readable — check SecretScanningObservable.
	PreventsPushingSecrets() bool
	ScansForSecrets() bool
	DefinesPolicyForHandlingSecrets() bool
	// SecretScanningObservable reports whether GitHub's security_and_analysis block
	// was readable. GitHub returns it only to callers with admin access to the
	// repository, so for repositories we do not administer the observed settings
	// are unreadable — distinct from being disabled.
	SecretScanningObservable() bool
	// InsightsDeclaresSecretScanning reports a Security Insights self-declaration of
	// secret-scanning tooling, independent of (and possibly instead of) GitHub's
	// native settings.
	InsightsDeclaresSecretScanning() bool
}

SecurityPosture defines an interface for accessing security-related metadata about a repository.

The secret-scanning signals come from two independent sources kept separate so callers can report which was found: PreventsPushingSecrets/ScansForSecrets are the settings GitHub actually observed, and InsightsDeclaresSecretScanning is a project self-declaration. SecretScanningObservable reports whether GitHub's settings were readable at all.

type WorkflowBlob added in v0.27.0 

type WorkflowBlob struct {
	Text        string
	IsTruncated bool
}

type WorkflowBlobObject added in v0.27.0 

type WorkflowBlobObject struct {
	Blob WorkflowBlob `graphql:"... on Blob"`
}

type WorkflowFile added in v0.27.0 

type WorkflowFile struct {
	Name      string
	Path      string
	Content   string
	Truncated bool
}

WorkflowFile is a single workflow definition with its contents already decoded.

Truncated marks a file GitHub declined to return in full. It is reported rather than dropped so callers can tell "inspected and clean" apart from "never inspected" — see checkAllWorkflows.

type WorkflowPermissions 

type WorkflowPermissions struct {
	DefaultPermissions    string `json:"default_workflow_permissions"`
	CanApprovePullRequest bool   `json:"can_approve_pull_request_reviews"`
}

type WorkflowTreeEntry added in v0.27.0 

type WorkflowTreeEntry struct {
	Name   string
	Path   string
	Type   string
	Mode   int
	Object *WorkflowBlobObject `graphql:"object"`
}

WorkflowTreeEntry is one entry in the fetched directory. Type is "blob" for files; Object is nil for entries with no inspectable contents.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.