remediate

Documentation

Overview

Package remediate turns scan findings into concrete, reviewable source patches. It only emits transforms that are provably safe — currently raising a sub-floor RSA key size, a single integer-literal change that always compiles. Algorithm swaps (MD5->SHA-256) and hybrid schemes change semantics and break downstream consumers, so they stay as migration guidance and are never auto-applied.

Index

• func OpenPR(root string, patches []Patch, opts PROptions, r Runner) (string, error)
• type Config
• type GitCLI
  • func (GitCLI) Add(files []string) error
  • func (GitCLI) BaseBranch() (string, error)
  • func (GitCLI) Commit(message string) error
  • func (GitCLI) CreateBranch(name string) error
  • func (GitCLI) CreatePR(title, body, base string) (string, error)
  • func (GitCLI) Dirty(files []string) (bool, error)
  • func (GitCLI) Push(branch string) error
• type PROptions
• type Patch
  • func Plan(res *scan.Result, minRSABits int) ([]Patch, error)
• type Runner

Functions

func OpenPR

func OpenPR(root string, patches []Patch, opts PROptions, r Runner) (string, error)

OpenPR applies the patches onto a new branch and opens a pull request whose body explains each change. It checks the working tree is clean for the target files *before* writing (so the dirty guard catches pre-existing unrelated edits, not our own), then branches, writes, commits, pushes and PRs. root is the scan root that Patch.File paths are relative to.

Types

type Config

type Config struct {
	MinRSABits int
}

Config tunes the rules.

type GitCLI

type GitCLI struct{}

GitCLI is the production Runner: it shells out to git and gh. It holds no logic beyond invoking commands and wrapping their stderr — all decisions live in OpenPR so they stay testable.

func (GitCLI) Add

func (GitCLI) Add(files []string) error

func (GitCLI) BaseBranch

func (GitCLI) BaseBranch() (string, error)

func (GitCLI) Commit

func (GitCLI) Commit(message string) error

func (GitCLI) CreateBranch

func (GitCLI) CreateBranch(name string) error

func (GitCLI) CreatePR

func (GitCLI) CreatePR(title, body, base string) (string, error)

func (GitCLI) Dirty

func (GitCLI) Dirty(files []string) (bool, error)

func (GitCLI) Push

func (GitCLI) Push(branch string) error

type PROptions

type PROptions struct {
	Branch string // optional branch name; empty -> generated
	// contains filtered or unexported fields
}

PROptions tunes OpenPR.

type Patch

type Patch struct {
	File       string // path relative to the scan root
	Rule       string // rule(s) that produced it
	Rationale  string // why, human-readable
	OldContent string
	NewContent string
	Diff       string // unified diff (old -> new)
}

Patch is a proposed change to one file.

func Plan

func Plan(res *scan.Result, minRSABits int) ([]Patch, error)

Plan derives safe patches from a scan result. minRSABits is the floor that sub-floor RSA keys are raised to. Unreadable files are skipped, not fatal.

type Runner

type Runner interface {
	// Dirty reports whether any of files has uncommitted changes.
	Dirty(files []string) (bool, error)
	// BaseBranch returns the current branch, used as the PR base.
	BaseBranch() (string, error)
	CreateBranch(name string) error
	Add(files []string) error
	Commit(message string) error
	Push(branch string) error
	// CreatePR opens the PR and returns its URL.
	CreatePR(title, body, base string) (string, error)
}

Runner is the test seam for opening a pull request. The real implementation (GitCLI) shells out to git and gh; tests use a fake that records calls. All side effects of OpenPR go through this interface so the orchestration is unit-tested without a live remote.