scanopts

func FromCommand ¶

func FromCommand(cmd *cobra.Command) (pipeline.Options, error)

FromCommand reads every scan-family flag that maps directly onto an analysis input and returns the corresponding pipeline.Options.

It covers only what the flags alone determine. Four groups of fields are deliberately left zero for the caller to fill, because the flags do not decide them:

• Files, GitCtx, SysInfo, SeedBOM, VulnetixSeedBOM — discovered by detection and collection passes that run after flag parsing.
• The No* feature booleans — derived from the --evaluate-*/--no-* toggles together with the invoking command's identity.
• LockedKinds — specializedRuleKinds(cmd.Name()).
• RespectGitignore — computed from the --*-include-ignored family, whose policy differs per command.

The gate fields (severity, exploits, block-*, version-lag, cooldown) are populated here but may be overwritten afterwards by org quality-gate policy, which always wins, even over an explicitly passed flag. That override must happen after this call and before any of those values is consumed.

Validation that would otherwise be duplicated per command lives here: --severity and --exploits are normalised and checked against the canonical lists, so an invalid value fails before any work starts rather than being silently ignored deep in a stage.

func NormaliseExploits ¶

func NormaliseExploits(value string) (string, error)

NormaliseExploits lower-cases and validates an --exploits value. An empty value means "no exploit gate" and is returned unchanged.

func NormaliseSeverity ¶

func NormaliseSeverity(value string) (string, error)

NormaliseSeverity lower-cases and validates a --severity value. An empty value means "no severity gate" and is returned unchanged.

func ParseRuleRefs ¶

func ParseRuleRefs(args []string) ([]sast.RuleRef, error)

ParseRuleRefs turns --rule arguments into sast.RuleRefs, failing on the first malformed reference rather than silently dropping it.