suppress

package

v3.77.1 Latest Latest Go to latest Published: Jul 27, 2026 License: AGPL-3.0 Imports: 2 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/vulnetix/cli

Links

Open Source Insights

Documentation ¶

Overview ¶

Package suppress holds the shared "ignore rule" matching logic used by every scanner pipeline (SAST family, SCA, license, malscan) to drop findings that an org-level or local Suppression covers, before report output is generated.

A rule is anchored by one or more of: rego rule id (the rego file id), a finding id (CVE/vuln id), or a file path. A finding is suppressed when every anchor the rule specifies matches the finding and the rule is active and unexpired.

Index ¶

func RepoFullName(remotes []string) string
type Finding
type Rule
- func FromMemory(recs []memory.SuppressionRecord) []Rule
type Set
- func NewSet(rules []Rule, now int64) *Set

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func RepoFullName ¶

func RepoFullName(remotes []string) string

RepoFullName derives "owner/repo" from the first parseable git remote URL. Supports scp-style (git@github.com:owner/repo.git) and URL-style (https://host/owner/repo.git) remotes. Returns "" when none parse.

Types ¶

type Finding ¶

type Finding struct {
	Category  string
	RuleID    string
	FindingID string
	FilePath  string
}

Finding is the subset of any scanner result the matcher inspects.

type Rule ¶

type Rule struct {
	UUID               string
	RuleID             string
	Category           string
	Type               string
	Reason             string
	FindingID          string
	FilePath           string
	LineRange          string
	RepositoryFullName string
	Branch             string
	ExpiresAt          int64
	IsActive           bool
}

Rule is the normalized form a Set matches against. It is produced from a memory.SuppressionRecord (local) or a backend Suppression (remote).

func FromMemory ¶

func FromMemory(recs []memory.SuppressionRecord) []Rule

FromMemory converts local suppression records to matcher rules.

type Set ¶

type Set struct {
	// contains filtered or unexported fields
}

Set is a matchable collection of rules.

func NewSet ¶

func NewSet(rules []Rule, now int64) *Set

NewSet builds a Set from rules, keeping only those active and unexpired at now.

func (*Set) Empty ¶

func (s *Set) Empty() bool

Empty reports whether the set has no active rules.

func (*Set) Match ¶

func (s *Set) Match(f Finding) (Rule, bool)

Match returns the first rule that suppresses f, and whether one was found.

func (*Set) Suppresses ¶

func (s *Set) Suppresses(f Finding) bool

Suppresses is Match without the matched rule.

Source Files ¶

View all Source files

suppress.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL