querying

type DataSource ¶

type DataSource interface {
	CollectFindings(
		*ProjectCollection,
		*sync.WaitGroup,
	) error
}

A DataSource represents an single source (service) for discovering projects and their associated findings.

CollectFindings must add all discovered projects and findings to the shared ProjectCollection object, using the ProjectCollection.GetProject and Project.GetFinding methods. These handle all necessary locking and merging of data between data sources, as they will all be processing their data simultaneously.

Upon completion of collection, CollectFindings must call `Done()` on the sync.WaitGroup, to indicate it is done.

type Finding ¶

type Finding struct {
	Identifiers FindingIdentifierMap
	Ecosystem   configs.FindingEcosystemType
	Severity    configs.FindingSeverityType
	Description string
	PackageName string
	// contains filtered or unexported fields
}

A Finding represents a single finding / vulnerability in a project. For example, a CVE. A Project must never have duplicates of the same Finding.

type FindingIdentifierMap ¶

type FindingIdentifierMap map[FindingIdentifierType]string

type FindingIdentifierType ¶

type FindingIdentifierType string

const (
	FindingIdentifierCVE  FindingIdentifierType = "CVE"
	FindingIdentifierGHSA FindingIdentifierType = "GHSA"
)

type GithubDataSource ¶

type GithubDataSource struct {
	GhClient githubClient
	// contains filtered or unexported fields
}

GithubDataSource is used to pull Dependabot alerts for an individual organization.

func NewGithubDataSource(conf *configs.Config) GithubDataSource

func (gh *GithubDataSource) CollectFindings(projects *ProjectCollection, wg *sync.WaitGroup) error

type Project ¶

type Project struct {
	Name     string
	Findings []*Finding
	Link     string
	Owners   mapset.Set[configs.TeamConfig]
	// contains filtered or unexported fields
}

A Project represents a single project which contains findings.

Examples of a Project would be a GitHub repository, or an Amazon ECR image.

Links represents where the Project can be found. For example, if a Project exists in a GitHub repository, then it would contain a Links entry with a key of "GitHub" and value of "https://github.com/org-name/project-name". These links are meant to be displayed out by reporters, to give users quick access to the projects and their findings.

func NewProject(name string) *Project

func (p *Project) GetFinding(identifiers FindingIdentifierMap) *Finding

type ProjectCollection ¶

type ProjectCollection struct {
	Projects []*Project
	// contains filtered or unexported fields
}

func NewProjectCollection() *ProjectCollection

func (c *ProjectCollection) GetProject(name string) *Project