Documentation
¶
Overview ¶
Package scan generates Scorecard results on demand by wrapping pkg/scorecard.Run (design D8). Following the upstream ScorecardWorker pattern, the OSS-Fuzz, CII, and vulnerabilities clients are created once and reused across scans, while the SCM repo client is created per scan (it is stateful per repository and unsafe to share across concurrent scans). Results are formatted to canonical JSON2 via AsJSON2.
The orchestrator (design D2) depends on the Scanner interface — not the concrete engine — so it is testable with a fake, and live scans are bounded by a Bounded worker pool and paced by internal/tokens.
Coverage: the engine runs all default checks against any repository the configured SCM token can access (including private repos); it requires no opt-in. The server advertises this at /capabilities (design D7).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrSkipped = errors.New("scan: repository skipped (unreachable or blocked)")
ErrSkipped indicates the repository could not be scanned for a non-fatal reason (unreachable, blocked, or behind an IP allow list). Callers treat it as "no result available", distinct from a scan failure (design task 4.3).
Functions ¶
func Complete ¶
Complete reports whether every check produced a conclusive score. A negative score (-1) is Scorecard's "inconclusive" sentinel, so its presence means the result is not fully complete. This one source-agnostic rule is applied to cached, live, and upstream results alike, so a token-limited local scan and an upstream result are judged by the same standard (design F4).
Types ¶
type Bounded ¶
type Bounded struct {
// contains filtered or unexported fields
}
Bounded limits the number of concurrent operations to a fixed size using a semaphore. It bounds live scans in a single process (design D9) so a burst of cache misses cannot spawn unbounded goroutines or overwhelm SCM rate limits. A broker-backed pool can later replace it behind the same Scanner seam.
func NewBounded ¶
NewBounded returns a Bounded permitting at most size concurrent operations. size is floored at 1.
type EngineConfig ¶
type EngineConfig struct {
// Limiter paces scans per SCM host. Nil means unlimited.
Limiter *tokens.HostLimiter
// LogLevel is the Scorecard engine log level (e.g. "info").
LogLevel string
// Checks optionally restricts the checks to run; empty means all default checks.
Checks []string
// Backoff governs retries of a scan. A zero value uses tokens.DefaultBackoff.
Backoff tokens.BackoffConfig
}
EngineConfig configures an EngineScanner.
type EngineScanner ¶
type EngineScanner struct {
// contains filtered or unexported fields
}
EngineScanner is the live Scanner backed by pkg/scorecard.Run. The OSS-Fuzz, CII, and vulnerabilities clients are created once and reused across scans; the SCM repo client is created per scan because it is stateful per repository.
func NewEngineScanner ¶
func NewEngineScanner(cfg EngineConfig) (*EngineScanner, error)
NewEngineScanner constructs a live scanner, creating and reusing the auxiliary clients. It reads the check documentation once. The OSS-Fuzz client fetches its status data lazily on first use (during a scan), not here, so this performs no network I/O and the server can start offline.
func (*EngineScanner) Close ¶
func (s *EngineScanner) Close() error
Close releases the reused clients.
type FakeScanner ¶
type FakeScanner struct {
// ScanFunc, when set, implements Scan. When nil, Scan returns a minimal
// successful result echoing the requested commit.
ScanFunc func(ctx context.Context, ref model.RepoRef, commit string) (*Result, error)
// contains filtered or unexported fields
}
FakeScanner is a configurable Scanner for tests (design task 4.6). It counts calls and is safe for concurrent use, so the orchestrator's single-flight and coalescing behavior can be exercised without the live engine.
func (*FakeScanner) Calls ¶
func (f *FakeScanner) Calls() int
Calls reports how many times Scan has been invoked.
type Result ¶
type Result struct {
// ResolvedCommit is the commit SHA the scan actually ran against.
ResolvedCommit string
// JSON2 is the canonical Scorecard JSON2 body, served and cached verbatim.
JSON2 []byte
// Complete reports whether every check produced a conclusive score.
Complete bool
}
Result is a produced Scorecard result. Field order is chosen for pointer packing (govet fieldalignment), not readability.
Source Files