Documentation
¶
Overview ¶
Package scanopts builds a pipeline.Options from a cobra command's flags.
It exists so there is exactly one place that knows how a scan-family flag becomes an analysis input. The language server never calls it: it fills pipeline.Options from LSP client settings instead. That is the point of the split, and it is why this package depends on cobra while internal/pipeline does not.
Index ¶
- func AddDeploymentFlags(f *pflag.FlagSet)
- func FromCommand(cmd *cobra.Command) (pipeline.Options, error)
- func NormaliseExploits(value string) (string, error)
- func NormaliseSeverity(value string) (string, error)
- func ParseRuleRefs(args []string) ([]sast.RuleRef, error)
- func StampDeploymentJSON(data []byte, d DeploymentContext) ([]byte, error)
- type DeploymentContext
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AddDeploymentFlags ¶ added in v3.97.0
AddDeploymentFlags registers the deployment-context flags on a flag set.
Registered on the whole scan family via addScanFlags, plus cdx, bom import and upload. AGENTS.md requires a family-wide flag to be honoured family-wide, and these are read in exactly one place — deploymentContextFromFlags — so no subcommand can quietly ignore them.
func FromCommand ¶
FromCommand reads every scan-family flag that maps directly onto an analysis input and returns the corresponding pipeline.Options.
It covers only what the flags alone determine. Four groups of fields are deliberately left zero for the caller to fill, because the flags do not decide them:
- Files, GitCtx, SysInfo, SeedBOM, VulnetixSeedBOM — discovered by detection and collection passes that run after flag parsing.
- The No* feature booleans — derived from the --evaluate-*/--no-* toggles together with the invoking command's identity.
- LockedKinds — specializedRuleKinds(cmd.Name()).
- RespectGitignore — computed from the --*-include-ignored family, whose policy differs per command.
The gate fields (severity, exploits, block-*, version-lag, cooldown) are populated here but may be overwritten afterwards by org quality-gate policy, which always wins, even over an explicitly passed flag. That override must happen after this call and before any of those values is consumed.
Validation that would otherwise be duplicated per command lives here: --severity and --exploits are normalised and checked against the canonical lists, so an invalid value fails before any work starts rather than being silently ignored deep in a stage.
func NormaliseExploits ¶
NormaliseExploits lower-cases and validates an --exploits value. An empty value means "no exploit gate" and is returned unchanged.
func NormaliseSeverity ¶
NormaliseSeverity lower-cases and validates a --severity value. An empty value means "no severity gate" and is returned unchanged.
func ParseRuleRefs ¶
ParseRuleRefs turns --rule arguments into sast.RuleRefs, failing on the first malformed reference rather than silently dropping it.
func StampDeploymentJSON ¶ added in v3.97.0
func StampDeploymentJSON(data []byte, d DeploymentContext) ([]byte, error)
StampDeploymentJSON applies deployment labels to already-serialised CycloneDX.
The document arrives as bytes from the shared vdb-cyclonedx builder, so it is round-tripped through a generic map rather than the internal model: decoding into cdx.BOM and re-encoding would silently drop every field the internal model does not declare, and this function has no business narrowing a document it was only asked to label.
Types ¶
type DeploymentContext ¶ added in v3.97.0
type DeploymentContext = cdx.DeploymentContext
DeploymentContext is the deployment label set. Aliased from internal/cdx so call sites read naturally without a second type to keep in step.
func DeploymentFromCommand ¶ added in v3.97.0
func DeploymentFromCommand(cmd *cobra.Command) DeploymentContext
DeploymentFromCommand reads the deployment flags, falling back to CI.
Source Files