status

Documentation

Overview

Package status assigns status labels (new, baseline, excepted, expired_exception, fixed) to findings by comparing against a baseline and exception set.

Index

• func Assign(findings []finding.Finding, accepted AcceptedSet, ...) []finding.Finding
• type AcceptedEntry
• type AcceptedSet
• type DeltaResult
  • func DeltaBuckets(findings []finding.Finding, accepted AcceptedSet, changed []string) DeltaResult
  • func (r DeltaResult) Empty() bool

Functions

func Assign

func Assign(
	findings []finding.Finding,
	accepted AcceptedSet,
	exceptions config.ExceptionSet,
	now time.Time,
	forKind string,
) []finding.Finding

Assign labels each finding with its lifecycle status by comparing against the accepted set and exception set. It also emits a finding per accepted fingerprint that is no longer present in the current run (status=fixed).

forKind scopes fixed-finding emission: only baseline entries whose Kind field matches forKind are emitted as fixed. Entries with an empty Kind field are treated as "gate" (backward compatibility with pre-Kind baseline files).

Algorithm per finding f:

1. Fingerprint in base.Accepted → StatusBaseline
2. Matches an exception (rule, from glob, to glob) and not expired → StatusExcepted
3. Matches an exception but expiry has passed → StatusExpiredException
4. No match → StatusNew (default)

now is the reference time for expiry checks; pass time.Now() in production.

Types

type AcceptedEntry

type AcceptedEntry struct {
	Fingerprint string
	RuleID      string
	Kind        string
	Severity    string
}

AcceptedEntry is one accepted finding from a prior run: the fingerprint that identifies it, the rule that produced it, the finding kind (gate or advisory; empty means "gate" for backward compatibility), and the severity recorded when it was accepted (empty for baselines written before severity was tracked).

type AcceptedSet

type AcceptedSet interface {
	// HasFingerprint reports whether the fingerprint was accepted.
	HasFingerprint(fingerprint string) bool
	// Entries returns all accepted findings, in stored order.
	Entries() []AcceptedEntry
}

AcceptedSet is the read-only view of previously accepted findings that status assignment needs. The persistence layer (internal/baseline) implements it; status never touches storage concerns — the dependency points outward-in.

type DeltaResult

type DeltaResult struct {
	New             []string
	Existing        []string
	Resolved        []string
	SeverityChanged []string
	TouchedByDelta  []string
}

DeltaResult groups finding IDs by delta bucket. Buckets are mutually exclusive (precedence: resolved > new > severity_changed > touched_by_delta > existing) and each slice is sorted for deterministic output.

func DeltaBuckets

func DeltaBuckets(findings []finding.Finding, accepted AcceptedSet, changed []string) DeltaResult

DeltaBuckets categorizes findings for a delta run relative to the baseline and the changed-file set. It reuses the lifecycle status already on each finding and the accepted set's recorded severity — no re-classification. Each finding lands in exactly one bucket:

• Resolved: status fixed (a baseline finding no longer detected).
• New: status new (introduced by this change).
• SeverityChanged: a baseline finding whose severity differs from the severity stored in the baseline (skipped when the baseline predates severity tracking, i.e. the recorded severity is empty).
• TouchedByDelta: a remaining pre-existing finding whose edge endpoints sit on a file in the changed set.
• Existing: any remaining pre-existing finding (untouched by this change).

changed is the sorted list of repo-relative files in the delta scope.

func (DeltaResult) Empty

func (r DeltaResult) Empty() bool

Empty reports whether no finding landed in any bucket.