aibom

package
v3.83.3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 2, 2026 License: AGPL-3.0 Imports: 17 Imported by: 0

Documentation

Overview

Package aibom discovers evidence of AI coding agents and AI-SDK usage in a codebase and maps it to a CycloneDX AI Bill of Materials.

All detection is driven by a declarative catalog (internal/aibom/catalog/*.json) so the rules — env-var names, tool directories/files, SDK import patterns and the SDK parameters that carry model names — can be maintained over time without code changes. The catalog is embedded in the binary and can be extended or overridden at runtime with --catalog.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Detect

func Detect(opts Options) (cdx.AIDetections, error)

Detect runs the enabled passes and returns CycloneDX-ready detections.

Types

type CRDDef added in v3.65.0

type CRDDef struct {
	ID               string        `json:"id"`
	Name             string        `json:"name"`
	APIVersionPrefix string        `json:"api_version_prefix"` // e.g. "serving.kserve.io/"
	Kind             string        `json:"kind"`
	Category         string        `json:"category"`
	Homepage         string        `json:"homepage,omitempty"`
	Fields           []CRDFieldDef `json:"fields,omitempty"`
}

CRDDef matches a Kubernetes custom resource kind that declares AI workloads.

type CRDFieldDef added in v3.65.0

type CRDFieldDef struct {
	Path string `json:"path"` // dot-path, e.g. spec.predictor.model.storageUri
	As   string `json:"as"`   // model | runtime | runtime_version | runtime_ref | service_account
}

CRDFieldDef pulls one string field out of a matched CRD document.

type Catalog

type Catalog struct {
	Version        string             `json:"version"`
	Tools          []ToolDef          `json:"tools"`
	Libraries      []LibraryDef       `json:"libraries"`
	Families       []FamilyDef        `json:"model_families"`
	Infrastructure *InfrastructureDef `json:"infrastructure,omitempty"`
}

Catalog is the raw (uncompiled) detection catalog.

func DefaultCatalog

func DefaultCatalog() (*Catalog, error)

DefaultCatalog parses and merges the embedded catalog files.

func LoadCatalog

func LoadCatalog(overridePath string, noBuiltin bool) (*Catalog, error)

LoadCatalog returns the catalog to use for a scan. When noBuiltin is false the embedded catalog is loaded first; when overridePath is non-empty that file is merged on top (entries with a matching id replace the builtin; new ids are appended).

func (*Catalog) Compile

func (c *Catalog) Compile() (*CompiledCatalog, error)

Compile compiles and validates every regex/glob in the catalog. It is the single validation gate used by both the runtime detector and the docs generator, so a malformed pattern fails fast and identically in both.

type CompiledCatalog

type CompiledCatalog struct {
	Version   string
	Tools     []CompiledTool
	Libraries []CompiledLibrary
	Families  []CompiledFamily
	Infra     *CompiledInfrastructure // nil when the catalog has no infrastructure section
}

CompiledCatalog is the catalog with all regexes compiled and validated.

type CompiledExtractor

type CompiledExtractor struct {
	FileGlob *regexp.Regexp
	JSONKey  string
	Re       *regexp.Regexp // nil when JSONKey is used
}

type CompiledFamily

type CompiledFamily struct {
	Def FamilyDef
	Re  *regexp.Regexp
}

type CompiledInfraRuntime added in v3.65.0

type CompiledInfraRuntime struct {
	Def    InfraRuntimeDef
	Images []*regexp.Regexp
}

type CompiledInfrastructure added in v3.65.0

type CompiledInfrastructure struct {
	Runtimes             []CompiledInfraRuntime
	ModelEnvVars         map[string]bool
	ModelArgFlags        map[string]bool
	ModelMountPrefixes   []string
	DatasetVolumeNames   map[string]bool
	DatasetMountPrefixes []string
	EnvSignals           map[string]WorkloadEnvSignal // env var name -> signal
	AnnotationPrefixes   []string
	CRDs                 []CRDDef
	CategoryRank         map[string]int // lower = higher priority
	GPUResourceKeys      map[string]bool
	Terraform            []CompiledTerraformSignal
	ModelFileExts        map[string]bool
}

CompiledInfrastructure holds the validated IaC detection rules.

type CompiledLibrary

type CompiledLibrary struct {
	Def     LibraryDef
	Langs   map[string]bool
	Imports []*regexp.Regexp
	Models  []CompiledModelExtractor
}

type CompiledModelExtractor

type CompiledModelExtractor struct {
	Param string
	Task  string
	Re    *regexp.Regexp
}

type CompiledPathRule

type CompiledPathRule struct {
	Category string
	Raw      string
	Re       *regexp.Regexp // nil when Exact
	Exact    bool
}

type CompiledTerraformSignal added in v3.65.0

type CompiledTerraformSignal struct {
	Def        TerraformSignalDef
	ResourceRe *regexp.Regexp
	AttrRe     *regexp.Regexp // nil when no attr gate
}

type CompiledTool

type CompiledTool struct {
	Def        ToolDef
	EnvExact   map[string]bool
	EnvGlobs   []*regexp.Regexp
	Paths      []CompiledPathRule
	Extractors []CompiledExtractor
	Commits    []*regexp.Regexp
}

type ConfigExtractor

type ConfigExtractor struct {
	FileGlob string `json:"file_glob"`
	JSONKey  string `json:"json_key,omitempty"`
	Pattern  string `json:"pattern,omitempty"`
}

ConfigExtractor extracts a model name from a tool config file, either by a JSON/YAML key or a regex with a single capture group.

type FamilyDef

type FamilyDef struct {
	PrefixRegex string `json:"prefix_regex"`
	Provider    string `json:"provider"`
	Family      string `json:"family"`
}

FamilyDef maps a model-name prefix pattern to a provider/family. It only enriches confidence — it never suppresses an unknown literal.

type InfraRuntimeDef added in v3.65.0

type InfraRuntimeDef struct {
	ID       string `json:"id"`
	Name     string `json:"name"`
	Vendor   string `json:"vendor,omitempty"`
	Category string `json:"category"` // inference | agent | training | evaluation | vector-database | managed-ai | accelerator
	Homepage string `json:"homepage,omitempty"`
	// ImagePatterns are anchored RE2 regexes matched against the image NAME
	// (repository incl. registry, tag/digest already split off). Patterns are
	// deliberately narrow (official orgs/registries only): mirrored or private
	// copies are a documented false negative, not a guess.
	ImagePatterns []string `json:"image_patterns"`
}

InfraRuntimeDef describes one AI infrastructure runtime (model server, agent platform, vector database, training/eval framework) identified by container image reference patterns in IaC files.

type InfrastructureDef added in v3.65.0

type InfrastructureDef struct {
	Runtimes             []InfraRuntimeDef    `json:"runtimes,omitempty"`
	ModelEnvVars         []string             `json:"model_env_vars,omitempty"`
	ModelArgFlags        []string             `json:"model_arg_flags,omitempty"`
	ModelMountPrefixes   []string             `json:"model_mount_prefixes,omitempty"`
	DatasetVolumeNames   []string             `json:"dataset_volume_names,omitempty"`
	DatasetMountPrefixes []string             `json:"dataset_mount_prefixes,omitempty"`
	WorkloadEnvSignals   []WorkloadEnvSignal  `json:"workload_env_signals,omitempty"`
	AnnotationPrefixes   []string             `json:"annotation_prefixes,omitempty"`
	CRDs                 []CRDDef             `json:"crds,omitempty"`
	CategoryPriority     []string             `json:"category_priority,omitempty"`
	GPUResourceKeys      []string             `json:"gpu_resource_keys,omitempty"`
	TerraformSignals     []TerraformSignalDef `json:"terraform_signals,omitempty"`
	ModelFileExtensions  []string             `json:"model_file_extensions,omitempty"`
}

InfrastructureDef is the IaC detection section of the catalog.

type LibraryDef

type LibraryDef struct {
	ID        string            `json:"id"`
	Name      string            `json:"name"`
	Provider  string            `json:"provider"`
	Languages []string          `json:"languages"`
	PurlNames map[string]string `json:"purl_names,omitempty"` // ecosystem -> package name
	// ImportPatterns confirm the library is in use (import/require/use lines).
	ImportPatterns []string `json:"import_patterns"`
	// ModelExtractors capture the model-name literal bound to a known SDK
	// parameter. Anchoring on the parameter (not the value) is what makes
	// unknown/future model names detectable.
	ModelExtractors []ModelExtractor `json:"model_extractors,omitempty"`
}

LibraryDef describes one AI SDK / framework and how to detect its use and extract the model names passed to it.

type ModelExtractor

type ModelExtractor struct {
	Param   string `json:"param"`
	Pattern string `json:"pattern"`
	Task    string `json:"task,omitempty"` // chat | embedding | image | completion | ...
}

ModelExtractor is a regex with exactly one capture group = the model literal.

type Options

type Options struct {
	Root        string
	MaxDepth    int
	Ignore      []string
	ScanEnv     bool
	IncludeHome bool
	ScanSource  bool
	ScanCommits bool
	// ScanIaC scans Kubernetes manifests, docker-compose files and
	// Dockerfiles for the AI infrastructure they would produce.
	ScanIaC bool
	// CommitMax bounds how many commits the commit-history pass inspects (<=0
	// uses defaultCommitScanMax).
	CommitMax int
	Catalog   *CompiledCatalog
	// Environ is injectable for tests; defaults to os.Environ() when nil.
	Environ []string
	// RespectGitignore prunes .gitignored paths (default off; the aibom command
	// sets it true unless --aibom-include-ignored is passed).
	RespectGitignore bool
}

Options controls a detection run.

type TerraformSignalDef added in v3.65.0

type TerraformSignalDef struct {
	ID       string `json:"id"`
	Name     string `json:"name"`
	Category string `json:"category"` // managed-ai | accelerator
	Provider string `json:"provider,omitempty"`
	// ResourcePattern matches the resource TYPE (first label of a resource
	// block), e.g. ^google_vertex_ai_.
	ResourcePattern string `json:"resource_pattern"`
	// AttrPattern optionally further gates on block content (e.g. kind = "OpenAI").
	AttrPattern string `json:"attr_pattern,omitempty"`
}

TerraformSignalDef matches a managed-AI or accelerator resource in Terraform/OpenTofu files (regex over content — consistent with the rest of the IaC scanning, which does not structurally parse HCL).

type ToolDef

type ToolDef struct {
	ID       string `json:"id"`
	Name     string `json:"name"`
	Vendor   string `json:"vendor"`
	Type     string `json:"type"` // cli-agent | ide-extension | ide | service
	Homepage string `json:"homepage,omitempty"`
	// Env are environment variable names (exact, or globs with '*') that this
	// tool sets. Only the NAME and presence are ever recorded — never the value.
	Env []string `json:"env,omitempty"`
	// Paths maps an evidence category (config, instructions, ignore, skills,
	// hooks, plugins, steering, memory, prompts, agents, commands, marketplace)
	// to a list of repo-relative path globs ('*', '**', '?' supported).
	Paths map[string][]string `json:"paths,omitempty"`
	// ModelConfigExtractors pull model-name literals out of this tool's own
	// config files.
	ModelConfigExtractors []ConfigExtractor `json:"model_config_extractors,omitempty"`
	// CommitPatterns are regexes matched against each commit's author/committer
	// identity and message (e.g. a "Co-Authored-By: Claude <noreply@anthropic.com>"
	// trailer, a "Claude-Session:" line, an agent bot author, or a "Generated
	// with <tool>" marker). They identify commits authored by this agent in git
	// history. No capture group required — these are presence signals.
	CommitPatterns []string `json:"commit_patterns,omitempty"`
}

ToolDef describes one AI coding agent / assistant and the on-disk + environment evidence that identifies it.

type WorkloadEnvSignal added in v3.65.0

type WorkloadEnvSignal struct {
	Env       string `json:"env"`
	Framework string `json:"framework"` // infra id reported when this signal fires
	Name      string `json:"name"`      // display name
	Category  string `json:"category"`
}

WorkloadEnvSignal maps an environment variable NAME observed on a workload container to an AI framework. Only the name is ever matched — values are never read.

Directories

Path Synopsis
Command aibomgen renders the AIBOM detection documentation from the single source of truth: the embedded catalog (internal/aibom/catalog/*.json).
Command aibomgen renders the AIBOM detection documentation from the single source of truth: the embedded catalog (internal/aibom/catalog/*.json).

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL