Documentation
¶
Overview ¶
Package github implements the github source plugin: lists repositories and organization members from a single GitHub organization and emits two evidence types — github_repository and github_org_member — suitable for SOC 2 branch-protection and 2FA coverage policies.
Per the KISS-no-DRY axiom (docs/architecture/04-source-plugins.md §The plugin contract), the plugin caches nothing across Collect calls. N policies bound to this plugin → N invocations of Collect.
Test injection: the API interface mirrors the pattern used by internal/sources/aws/iam — the concrete *httpAPI satisfies it, and unit tests inject an in-memory fake. The real HTTP adapter has no integration tests today (deferred — live API integration tests are out of scope for this batch).
Index ¶
Constants ¶
const ( EvidenceTypeRepository = "github_repository" EvidenceTypeOrgMember = "github_org_member" )
Evidence type IDs this plugin emits.
const SourceID = "github"
SourceID is the registered ID for the github plugin instance.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type API ¶
type API interface {
// ListRepos returns all repos in the configured organization.
// Implementations must page transparently — callers receive the
// full list in one slice.
ListRepos(ctx context.Context) ([]Repo, error)
// ListOrgMembers returns all members of the configured org along
// with their 2FA state and role. 2FA state requires admin scope.
ListOrgMembers(ctx context.Context) ([]Member, error)
}
API is the subset of the GitHub REST API the plugin uses. Defining it as an interface lets tests inject a fake without making real network calls; the concrete *httpAPI satisfies it.
type Options ¶
type Options struct {
API API
Org string
// Now is injected so tests can produce deterministic CollectedAt
// values. Production callers leave it nil → time.Now().UTC().
Now func() time.Time
}
Options is the constructor input.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin is the in-process github source.
func New ¶
New constructs a Plugin around an explicit API implementation. Callers using the real GitHub REST API should use NewFromToken.
func NewFromToken ¶
NewFromToken constructs a Plugin backed by the real GitHub REST API using the supplied personal-access or app token. The plugin issues requests against api.github.com. Live integration tests are deferred.
func (*Plugin) Collect ¶
func (p *Plugin) Collect(ctx context.Context, req core.SlotRequest) ([]core.EvidenceRecord, error)
Collect dispatches by req.EvidenceType — a plugin emits multiple evidence types and returns records of the type the SlotRequest asks for. Records are sorted by ID before return so envelope bytes are stable across runs against stable org state.
Source Files