Documentation
¶
Overview ¶
Package scanopts builds a pipeline.Options from a cobra command's flags.
It exists so there is exactly one place that knows how a scan-family flag becomes an analysis input. The language server never calls it: it fills pipeline.Options from LSP client settings instead. That is the point of the split, and it is why this package depends on cobra while internal/pipeline does not.
Index ¶
- Constants
- func AddAuthorshipFlags(flags *pflag.FlagSet)
- func AddDeploymentFlags(f *pflag.FlagSet)
- func FromCommand(cmd *cobra.Command) (pipeline.Options, error)
- func LifecycleOverrideFromCommand(cmd *cobra.Command) ([]cdx.LifecyclePhase, error)
- func ManufacturerSourcesFromCommand(cmd *cobra.Command) cdx.ManufacturerSources
- func NormaliseExploits(value string) (string, error)
- func NormaliseSeverity(value string) (string, error)
- func ParseRuleRefs(args []string) ([]sast.RuleRef, error)
- func StampDeploymentJSON(data []byte, d DeploymentContext) ([]byte, error)
- type DeploymentContext
Constants ¶
const ( // ManufacturerFlag names the organization that created the BOM. ManufacturerFlag = "bom-manufacturer" // ManufacturerEnv is the environment equivalent, for a runner that sets it // once per job rather than per invocation. ManufacturerEnv = "VULNETIX_BOM_MANUFACTURER" // LifecycleFlag overrides the capture stages the engine would derive. LifecycleFlag = "lifecycle" )
Variables ¶
This section is empty.
Functions ¶
func AddAuthorshipFlags ¶ added in v3.99.0
AddAuthorshipFlags registers the authoring-identity flags on a command.
func AddDeploymentFlags ¶ added in v3.97.0
AddDeploymentFlags registers the deployment-context flags on a flag set.
Registered on the whole scan family via addScanFlags, plus cdx, bom import and upload. AGENTS.md requires a family-wide flag to be honoured family-wide, and these are read in exactly one place — deploymentContextFromFlags — so no subcommand can quietly ignore them.
func FromCommand ¶
FromCommand reads every scan-family flag that maps directly onto an analysis input and returns the corresponding pipeline.Options.
It covers only what the flags alone determine. Four groups of fields are deliberately left zero for the caller to fill, because the flags do not decide them:
- Files, GitCtx, SysInfo, SeedBOM, VulnetixSeedBOM — discovered by detection and collection passes that run after flag parsing.
- The No* feature booleans — derived from the --evaluate-*/--no-* toggles together with the invoking command's identity.
- LockedKinds — specializedRuleKinds(cmd.Name()).
- RespectGitignore — computed from the --*-include-ignored family, whose policy differs per command.
The gate fields (severity, exploits, block-*, version-lag, cooldown) are populated here but may be overwritten afterwards by org quality-gate policy, which always wins, even over an explicitly passed flag. That override must happen after this call and before any of those values is consumed.
Validation that would otherwise be duplicated per command lives here: --severity and --exploits are normalised and checked against the canonical lists, so an invalid value fails before any work starts rather than being silently ignored deep in a stage.
func LifecycleOverrideFromCommand ¶ added in v3.99.0
func LifecycleOverrideFromCommand(cmd *cobra.Command) ([]cdx.LifecyclePhase, error)
LifecycleOverrideFromCommand reads --lifecycle. Nil means "derive from what the scan read"; an unknown phase is rejected rather than treated as a custom one, because a typo silently becoming a custom lifecycle name is indistinguishable downstream from a deliberate one.
func ManufacturerSourcesFromCommand ¶ added in v3.99.0
func ManufacturerSourcesFromCommand(cmd *cobra.Command) cdx.ManufacturerSources
ManufacturerSourcesFromCommand gathers every candidate for metadata.manufacturer that flags and the environment can supply.
The git fallback is deliberately left unset here and filled in where git context is already collected, so resolving the manufacturer never causes the repository to be walked a second time.
func NormaliseExploits ¶
NormaliseExploits lower-cases and validates an --exploits value. An empty value means "no exploit gate" and is returned unchanged.
func NormaliseSeverity ¶
NormaliseSeverity lower-cases and validates a --severity value. An empty value means "no severity gate" and is returned unchanged.
func ParseRuleRefs ¶
ParseRuleRefs turns --rule arguments into sast.RuleRefs, failing on the first malformed reference rather than silently dropping it.
func StampDeploymentJSON ¶ added in v3.97.0
func StampDeploymentJSON(data []byte, d DeploymentContext) ([]byte, error)
StampDeploymentJSON applies deployment labels to already-serialised CycloneDX, for callers that hold bytes rather than a document.
This used to be a second, map-based implementation of ApplyDeploymentContext. The reason was real at the time: the CLI's own CycloneDX model did not declare most of the specification, so decoding a document into it and re-encoding silently dropped everything it did not know about — and a function asked only to label a document has no business narrowing it.
The model is now the shared one in vdb-cyclonedx, which round-trips unmodelled members rather than discarding them, so the duplicate is gone and this is a decode, the one implementation, and an encode. The guarantee is pinned by TestStampDeploymentJSONPreservesUnknownFields.
Types ¶
type DeploymentContext ¶ added in v3.97.0
type DeploymentContext = cdx.DeploymentContext
DeploymentContext is the deployment label set. Aliased from internal/cdx so call sites read naturally without a second type to keep in step.
func DeploymentFromCommand ¶ added in v3.97.0
func DeploymentFromCommand(cmd *cobra.Command) DeploymentContext
DeploymentFromCommand reads the deployment flags, falling back to CI.
Source Files