sast

type BuildOptions struct {
	MaxDepth int
	Excludes []string

	// IgnoreGit, when true, skips the .git directory entirely. The default
	// is false: the secrets subcommand walks .git to surface credentials
	// that exist only in past commits.
	IgnoreGit bool

	// IgnoreGlobs is an additional set of glob patterns to exclude. The
	// patterns are matched against the relative path and the base name
	// (mirroring --exclude). The CLI's --ignore flag is wired into this
	// slice so that a single --ignore "fixtures/**" is enough.
	IgnoreGlobs []string

	// IgnoreBinaries, when true, skips binary files entirely. When false
	// (the default for the secrets subcommand), binary files are inspected
	// with strings + EXIF and the result is added to FileContents.
	IgnoreBinaries bool

	// GitHistory, when true, walks the git history at rootPath and adds
	// each file version to FileContents under the __git_history__/ prefix.
	// Requires that IgnoreGit be false; if both are set, IgnoreGit wins.
	GitHistory bool

	// GitHistoryMaxCommits caps the number of commits walked.
	GitHistoryMaxCommits int
	// GitHistoryMaxFiles caps the number of file versions emitted.
	GitHistoryMaxFiles int

	// RespectGitignore, when true, prunes files and directories matched by
	// .gitignore files. Defaults false for backwards compatibility; the
	// sast/secrets/containers/iac/cbom/aibom commands set it true unless the
	// user passes their --*-include-ignored override.
	RespectGitignore bool
}

type Engine struct {
	// contains filtered or unexported fields
}

type EvalOptions struct {
	MaxDepth int
	Excludes []string

	// IgnoreGit, IgnoreGlobs, IgnoreBinaries, GitHistory, etc. are
	// forwarded to BuildScanInputWithOptions / LoadFileContentsWithOptions
	// so the secrets subcommand can enable binary and history scanning
	// without affecting the generic scan command's behaviour.
	IgnoreGit            bool
	IgnoreGlobs          []string
	IgnoreBinaries       bool
	GitHistory           bool
	GitHistoryMaxCommits int
	GitHistoryMaxFiles   int
	MinStringLength      int

	// RespectGitignore prunes files/dirs matched by .gitignore. The
	// sast/secrets/containers/iac commands set it true by default; the
	// user opts out with --<mode>-include-ignored.
	RespectGitignore bool
}

type Finding struct {
	RuleID      string        `json:"rule_id"`
	Message     string        `json:"message"`
	ArtifactURI string        `json:"artifact_uri"`
	Severity    string        `json:"severity"`
	Level       string        `json:"level"`
	StartLine   int           `json:"start_line"`
	EndLine     int           `json:"end_line,omitempty"`
	Snippet     string        `json:"snippet"`
	Fingerprint string        `json:"-"`
	Metadata    *RuleMetadata `json:"-"`

	// Test-suite attribution, set post-evaluation by internal/testsuite when the
	// finding's file belongs to the project's test suite. IsTestSuite drives the
	// SARIF `vulnetix/test-*` result properties and the typed wire fields.
	IsTestSuite        bool     `json:"-"`
	TestFramework      string   `json:"-"`
	TestLanguage       string   `json:"-"`
	TestConfidence     string   `json:"-"`
	TestMatchedPattern string   `json:"-"`
	TestEvidence       []string `json:"-"`
}

type LoadOptions struct {
	// MaxFileSize is the upper bound for any single file's text content
	// (raw or extracted). Files larger than this are skipped entirely.
	MaxFileSize int64
	// IgnoreBinaries, when true, skips binary files. When false (the
	// default for the secrets subcommand), binary files are inspected:
	// printable strings are extracted with the secretscan package and any
	// EXIF/IPTC/XMP metadata is added under __exif__/.
	IgnoreBinaries bool
	// MinStringLength is the minimum run length to surface when extracting
	// strings from binaries. Defaults to secretscan.StringMin (4).
	MinStringLength int
}

type NosecHit struct {
	File      string
	StartLine int
	EndLine   int
	RuleID    string
	Kind      string
	WholeFile bool
	Snippet   string
}

type RuleMetadata struct {
	ID          string   `json:"id"`
	Name        string   `json:"name"`
	Description string   `json:"description"`
	HelpURI     string   `json:"help_uri"`
	Languages   []string `json:"languages"`
	Severity    string   `json:"severity"`
	Level       string   `json:"level"`
	Kind        string   `json:"kind"`
	CWE         []int    `json:"cwe"`
	CAPEC       []string `json:"capec"`
	ATTACKTech  []string `json:"attack_technique"`
	CVSSv4      string   `json:"cvssv4"`
	CWSS        string   `json:"cwss"`
	Tags        []string `json:"tags"`
}

type RuleRef struct {
	Org  string
	Repo string
}

type SARIFArtifact = sarif.Artifact

type SARIFArtifactLocation = sarif.ArtifactLocation

type SARIFInvocation = sarif.Invocation

type SARIFLocation = sarif.Location

type SARIFLog = sarif.Log

type SARIFMessage = sarif.Message

type SARIFNotification = sarif.Notification

type SARIFPhysicalLocation = sarif.PhysicalLocation

type SARIFPropertyBag = sarif.PropertyBag

type SARIFRegion = sarif.Region

type SARIFReportingDescriptor = sarif.ReportingDescriptor

type SARIFResult = sarif.Result

type SARIFRun = sarif.Run

type SARIFSnippet = sarif.Snippet

type SARIFTool = sarif.Tool

type SARIFToolDriver = sarif.ToolComponent

type SASTReport struct {
	Findings    []Finding
	Rules       []RuleMetadata
	RulesLoaded int // rules after filtering (kind/id) that were evaluated
	RulesTotal  int // rules loaded pre-filter (builtin + --rule repos)
	// Degradations lists capabilities that ran reduced or not at all during
	// this evaluation ("couldn't verify X because Y"). They are surfaced as
	// SARIF toolExecutionNotifications so a report consumer can distinguish
	// "scanned clean" from "not fully scanned".
	Degradations []string
}

type ScanInput struct {
	// FileSet maps each relative file path to true for O(1) existence checks in Rego.
	FileSet map[string]bool `json:"file_set"`
	// DirsByLanguage maps language name to directories containing that language's indicator files.
	DirsByLanguage map[string][]string `json:"dirs_by_language"`
	// FileContents maps relative path to file text. Populated lazily for small files
	// when content-level rules are present. Files over MaxFileSize and binary files are
	// skipped unless binary inspection is enabled (see FileScanOptions).
	FileContents map[string]string `json:"file_contents,omitempty"`
	// ScanRoot is the absolute path being scanned (for display; rules use relative paths).
	ScanRoot string `json:"scan_root"`
}