Documentation
¶
Overview ¶
Package aibom discovers evidence of AI coding agents and AI-SDK usage in a codebase and maps it to a CycloneDX AI Bill of Materials.
All detection is driven by a declarative catalog (internal/aibom/catalog/*.json) so the rules — env-var names, tool directories/files, SDK import patterns and the SDK parameters that carry model names — can be maintained over time without code changes. The catalog is embedded in the binary and can be extended or overridden at runtime with --catalog.
Index ¶
- func Detect(opts Options) (cdx.AIDetections, error)
- type CRDDef
- type CRDFieldDef
- type Catalog
- type CompiledCatalog
- type CompiledExtractor
- type CompiledFamily
- type CompiledInfraRuntime
- type CompiledInfrastructure
- type CompiledLibrary
- type CompiledModelExtractor
- type CompiledPathRule
- type CompiledTerraformSignal
- type CompiledTool
- type ConfigExtractor
- type FamilyDef
- type InfraRuntimeDef
- type InfrastructureDef
- type LibraryDef
- type ModelExtractor
- type Options
- type TerraformSignalDef
- type ToolDef
- type WorkloadEnvSignal
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type CRDDef ¶ added in v3.65.0
type CRDDef struct {
ID string `json:"id"`
Name string `json:"name"`
APIVersionPrefix string `json:"api_version_prefix"` // e.g. "serving.kserve.io/"
Kind string `json:"kind"`
Category string `json:"category"`
Homepage string `json:"homepage,omitempty"`
Fields []CRDFieldDef `json:"fields,omitempty"`
}
CRDDef matches a Kubernetes custom resource kind that declares AI workloads.
type CRDFieldDef ¶ added in v3.65.0
type CRDFieldDef struct {
Path string `json:"path"` // dot-path, e.g. spec.predictor.model.storageUri
As string `json:"as"` // model | runtime | runtime_version | runtime_ref | service_account
}
CRDFieldDef pulls one string field out of a matched CRD document.
type Catalog ¶
type Catalog struct {
Version string `json:"version"`
Tools []ToolDef `json:"tools"`
Libraries []LibraryDef `json:"libraries"`
Families []FamilyDef `json:"model_families"`
Infrastructure *InfrastructureDef `json:"infrastructure,omitempty"`
}
Catalog is the raw (uncompiled) detection catalog.
func DefaultCatalog ¶
DefaultCatalog parses and merges the embedded catalog files.
func LoadCatalog ¶
LoadCatalog returns the catalog to use for a scan. When noBuiltin is false the embedded catalog is loaded first; when overridePath is non-empty that file is merged on top (entries with a matching id replace the builtin; new ids are appended).
func (*Catalog) Compile ¶
func (c *Catalog) Compile() (*CompiledCatalog, error)
Compile compiles and validates every regex/glob in the catalog. It is the single validation gate used by both the runtime detector and the docs generator, so a malformed pattern fails fast and identically in both.
type CompiledCatalog ¶
type CompiledCatalog struct {
Version string
Tools []CompiledTool
Libraries []CompiledLibrary
Families []CompiledFamily
Infra *CompiledInfrastructure // nil when the catalog has no infrastructure section
}
CompiledCatalog is the catalog with all regexes compiled and validated.
type CompiledExtractor ¶
type CompiledFamily ¶
type CompiledInfraRuntime ¶ added in v3.65.0
type CompiledInfraRuntime struct {
Def InfraRuntimeDef
Images []*regexp.Regexp
}
type CompiledInfrastructure ¶ added in v3.65.0
type CompiledInfrastructure struct {
Runtimes []CompiledInfraRuntime
ModelEnvVars map[string]bool
ModelArgFlags map[string]bool
ModelMountPrefixes []string
DatasetVolumeNames map[string]bool
DatasetMountPrefixes []string
EnvSignals map[string]WorkloadEnvSignal // env var name -> signal
AnnotationPrefixes []string
CRDs []CRDDef
CategoryRank map[string]int // lower = higher priority
GPUResourceKeys map[string]bool
Terraform []CompiledTerraformSignal
ModelFileExts map[string]bool
}
CompiledInfrastructure holds the validated IaC detection rules.
type CompiledLibrary ¶
type CompiledLibrary struct {
Def LibraryDef
Langs map[string]bool
Imports []*regexp.Regexp
Models []CompiledModelExtractor
}
type CompiledModelExtractor ¶
type CompiledPathRule ¶
type CompiledTerraformSignal ¶ added in v3.65.0
type CompiledTerraformSignal struct {
Def TerraformSignalDef
ResourceRe *regexp.Regexp
AttrRe *regexp.Regexp // nil when no attr gate
}
type CompiledTool ¶
type CompiledTool struct {
Def ToolDef
EnvExact map[string]bool
EnvGlobs []*regexp.Regexp
Paths []CompiledPathRule
Extractors []CompiledExtractor
Commits []*regexp.Regexp
}
type ConfigExtractor ¶
type ConfigExtractor struct {
FileGlob string `json:"file_glob"`
JSONKey string `json:"json_key,omitempty"`
Pattern string `json:"pattern,omitempty"`
}
ConfigExtractor extracts a model name from a tool config file, either by a JSON/YAML key or a regex with a single capture group.
type FamilyDef ¶
type FamilyDef struct {
PrefixRegex string `json:"prefix_regex"`
Provider string `json:"provider"`
Family string `json:"family"`
}
FamilyDef maps a model-name prefix pattern to a provider/family. It only enriches confidence — it never suppresses an unknown literal.
type InfraRuntimeDef ¶ added in v3.65.0
type InfraRuntimeDef struct {
ID string `json:"id"`
Name string `json:"name"`
Vendor string `json:"vendor,omitempty"`
Category string `json:"category"` // inference | agent | training | evaluation | vector-database | managed-ai | accelerator
Homepage string `json:"homepage,omitempty"`
// ImagePatterns are anchored RE2 regexes matched against the image NAME
// (repository incl. registry, tag/digest already split off). Patterns are
// deliberately narrow (official orgs/registries only): mirrored or private
// copies are a documented false negative, not a guess.
ImagePatterns []string `json:"image_patterns"`
}
InfraRuntimeDef describes one AI infrastructure runtime (model server, agent platform, vector database, training/eval framework) identified by container image reference patterns in IaC files.
type InfrastructureDef ¶ added in v3.65.0
type InfrastructureDef struct {
Runtimes []InfraRuntimeDef `json:"runtimes,omitempty"`
ModelEnvVars []string `json:"model_env_vars,omitempty"`
ModelArgFlags []string `json:"model_arg_flags,omitempty"`
ModelMountPrefixes []string `json:"model_mount_prefixes,omitempty"`
DatasetVolumeNames []string `json:"dataset_volume_names,omitempty"`
DatasetMountPrefixes []string `json:"dataset_mount_prefixes,omitempty"`
WorkloadEnvSignals []WorkloadEnvSignal `json:"workload_env_signals,omitempty"`
AnnotationPrefixes []string `json:"annotation_prefixes,omitempty"`
CRDs []CRDDef `json:"crds,omitempty"`
CategoryPriority []string `json:"category_priority,omitempty"`
GPUResourceKeys []string `json:"gpu_resource_keys,omitempty"`
TerraformSignals []TerraformSignalDef `json:"terraform_signals,omitempty"`
ModelFileExtensions []string `json:"model_file_extensions,omitempty"`
}
InfrastructureDef is the IaC detection section of the catalog.
type LibraryDef ¶
type LibraryDef struct {
ID string `json:"id"`
Name string `json:"name"`
Provider string `json:"provider"`
Languages []string `json:"languages"`
PurlNames map[string]string `json:"purl_names,omitempty"` // ecosystem -> package name
// ImportPatterns confirm the library is in use (import/require/use lines).
ImportPatterns []string `json:"import_patterns"`
// ModelExtractors capture the model-name literal bound to a known SDK
// parameter. Anchoring on the parameter (not the value) is what makes
// unknown/future model names detectable.
ModelExtractors []ModelExtractor `json:"model_extractors,omitempty"`
}
LibraryDef describes one AI SDK / framework and how to detect its use and extract the model names passed to it.
type ModelExtractor ¶
type ModelExtractor struct {
Param string `json:"param"`
Pattern string `json:"pattern"`
Task string `json:"task,omitempty"` // chat | embedding | image | completion | ...
}
ModelExtractor is a regex with exactly one capture group = the model literal.
type Options ¶
type Options struct {
Root string
MaxDepth int
Ignore []string
ScanEnv bool
IncludeHome bool
ScanSource bool
ScanCommits bool
// ScanIaC scans Kubernetes manifests, docker-compose files and
// Dockerfiles for the AI infrastructure they would produce.
ScanIaC bool
// CommitMax bounds how many commits the commit-history pass inspects (<=0
// uses defaultCommitScanMax).
CommitMax int
Catalog *CompiledCatalog
// Environ is injectable for tests; defaults to os.Environ() when nil.
Environ []string
// RespectGitignore prunes .gitignored paths (default off; the aibom command
// sets it true unless --aibom-include-ignored is passed).
RespectGitignore bool
}
Options controls a detection run.
type TerraformSignalDef ¶ added in v3.65.0
type TerraformSignalDef struct {
ID string `json:"id"`
Name string `json:"name"`
Category string `json:"category"` // managed-ai | accelerator
Provider string `json:"provider,omitempty"`
// ResourcePattern matches the resource TYPE (first label of a resource
// block), e.g. ^google_vertex_ai_.
ResourcePattern string `json:"resource_pattern"`
// AttrPattern optionally further gates on block content (e.g. kind = "OpenAI").
AttrPattern string `json:"attr_pattern,omitempty"`
}
TerraformSignalDef matches a managed-AI or accelerator resource in Terraform/OpenTofu files (regex over content — consistent with the rest of the IaC scanning, which does not structurally parse HCL).
type ToolDef ¶
type ToolDef struct {
ID string `json:"id"`
Name string `json:"name"`
Vendor string `json:"vendor"`
Type string `json:"type"` // cli-agent | ide-extension | ide | service
Homepage string `json:"homepage,omitempty"`
// Env are environment variable names (exact, or globs with '*') that this
// tool sets. Only the NAME and presence are ever recorded — never the value.
Env []string `json:"env,omitempty"`
// Paths maps an evidence category (config, instructions, ignore, skills,
// hooks, plugins, steering, memory, prompts, agents, commands, marketplace)
// to a list of repo-relative path globs ('*', '**', '?' supported).
Paths map[string][]string `json:"paths,omitempty"`
// ModelConfigExtractors pull model-name literals out of this tool's own
// config files.
ModelConfigExtractors []ConfigExtractor `json:"model_config_extractors,omitempty"`
// CommitPatterns are regexes matched against each commit's author/committer
// identity and message (e.g. a "Co-Authored-By: Claude <noreply@anthropic.com>"
// trailer, a "Claude-Session:" line, an agent bot author, or a "Generated
// with <tool>" marker). They identify commits authored by this agent in git
// history. No capture group required — these are presence signals.
CommitPatterns []string `json:"commit_patterns,omitempty"`
}
ToolDef describes one AI coding agent / assistant and the on-disk + environment evidence that identifies it.
type WorkloadEnvSignal ¶ added in v3.65.0
type WorkloadEnvSignal struct {
Env string `json:"env"`
Framework string `json:"framework"` // infra id reported when this signal fires
Name string `json:"name"` // display name
Category string `json:"category"`
}
WorkloadEnvSignal maps an environment variable NAME observed on a workload container to an AI framework. Only the name is ever matched — values are never read.
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Command aibomgen renders the AIBOM detection documentation from the single source of truth: the embedded catalog (internal/aibom/catalog/*.json).
|
Command aibomgen renders the AIBOM detection documentation from the single source of truth: the embedded catalog (internal/aibom/catalog/*.json). |