constant

Documentation

Overview

Package constant holds clover's shared string vocabulary - the literal spellings of directive grammar that appear across more than one package (constraint keywords now; provider names, source selectors, and value kinds as they land). Centralising them turns a misspelling into a compile error rather than a silent mismatch between the parser, formatter, providers, and CLI. It is a leaf: it imports nothing, so any package may depend on it.

Index

• Constants

Constants

const (
	BoolFalse = "false"
	BoolTrue  = "true"
)

Boolean directive values. A boolean key's value must be exactly one of these - strict, so a typo like disabled=yes is rejected rather than silently treated as false.

const (
	ConstraintMajor = "major"
	ConstraintMinor = "minor"
	ConstraintPatch = "patch"
)

Constraint keyword values. The constraint key accepts either one of these bump-ceiling keywords or a go-version range expression; these name the keyword dialect. Referenced by the version package's constraint parser today and, as they land, the format canonicaliser and the CLI --constraint enum.

const (
	DirectiveDisabled = "disabled" // disable this marker
	DirectiveFind     = "find"     // explicit find pattern (glob with <placeholders>, or /regex/)
	DirectiveFrom     = "from"     // follow the producer with this id
	DirectiveID       = "id"       // publish this marker's result under this id
	DirectiveOffset   = "offset"   // lines below the comment where the governed line (or the target= search) starts; default 1
	DirectiveProvider = "provider" // upstream source; omitted ⇒ follow
	DirectiveReplace  = "replace"  // explicit replace template, pairs with find
	DirectiveSelect   = "select"   // follow the old or new value
	DirectiveTags     = "tags"     // comma-separated labels for --tags filtering
	DirectiveTarget   = "target"   // glob or /regex/ anchoring the governed line: the first match below the comment
	DirectiveTrack    = "track"    // track a floating ref (docker tag, github branch); * infers it from the line
	DirectiveValue    = "value"    // what a follower projects
	DirectiveVerify   = "verify"   // deep-verify this marker's secure pin against upstream

	DirectiveVerifyBranch   = "verify-branch"   // allowed source-branch glob or /regex/ for deep verify (default: the repo's default branch)
	DirectiveVerifyIdentity = "verify-identity" // signer certificate SAN glob or /regex/ a digest pin's Sigstore attestation must match
	DirectiveVerifyIssuer   = "verify-issuer"   // OIDC issuer URL for verify-identity (default: GitHub Actions)

	DirectivePattern      = "pattern"       // asset filename glob for value=sha256
	DirectiveSha256Source = "sha256-source" // how to source a value=sha256 (see constant/value.go)
	DirectiveSha256URL    = "sha256-url"    // checksum-file URL (templated with <version>) for value=sha256
)

Directive targeting and control keys: who resolves the marker and how it relates to others.

const (
	DirectiveURL       = "url"        // endpoint the http provider GETs (http)
	DirectiveJQ        = "jq"         // jq program over a JSON response body (http)
	DirectiveExtract   = "extract"    // glob-with-<version> or /regex/ over a text response body (http)
	DirectiveUserAgent = "user-agent" // User-Agent header for the request (http); defaults to clover
)

HTTP provider keys: the endpoint to fetch and how to extract version candidate(s) from the response. Exactly one extraction key is set.

const (
	DirectiveBuild      = "build"      // hashicorp build-metadata flavor, e.g. ent.hsm.fips1403 (hashicorp)
	DirectiveChannel    = "channel"    // release channel to track: stable (default) or beta (rust)
	DirectiveChart      = "chart"      // helm chart name (helm)
	DirectiveDeprecated = "deprecated" // keep deprecated versions eligible (npm)
	DirectiveDistTag    = "dist-tag"   // registry dist-tag to track, e.g. beta (npm)
	DirectiveEnterprise = "enterprise" // track enterprise-licensed builds (hashicorp)
	DirectiveFlavor     = "flavor"     // gitea forge flavor: codeberg (default), forgejo, or gitea
	DirectiveHost       = "host"       // forge host for a self-managed instance (github, gitlab)
	DirectiveLTS        = "lts"        // restrict to LTS release lines (node)
	DirectivePackage    = "package"    // package name, scoped npm names included (crates, npm, pypi)
	DirectivePlatform   = "platform"   // OCI platform os/arch for per-arch digest resolution (docker)
	DirectiveProduct    = "product"    // hashicorp product name, e.g. terraform (hashicorp)
	DirectiveRegistry   = "registry"   // container registry host (docker); chart repository URL or oci:// base (helm); registry base URL (npm)
	DirectiveSource     = "source"     // provider source address namespace/name (terraform, opentofu)
	DirectiveTool       = "tool"       // mise registry tool name, resolved to the repository it tracks (github)
	DirectiveRepository = "repository" // repository path (github, docker)
)

Provider parameters shared beyond a single provider: the auto-inference injects them and the relevant providers read them.

const (
	FollowNew = "new"
	FollowOld = "old"
)

Follow value selectors: whether a follow marker reads the producer's value from before the run (Old) or after it resolved (New, the default).

const (
	Ignore      = DirectiveKeyword + "ignore"       // clover:ignore
	IgnoreEnd   = DirectiveKeyword + "ignore-end"   // clover:ignore-end
	IgnoreFile  = DirectiveKeyword + "ignore-file"  // clover:ignore-file
	IgnoreStart = DirectiveKeyword + "ignore-start" // clover:ignore-start
)

clover:ignore control comments suppress directive scanning. The bare form ignores the next line; the -start/-end pair brackets a block; -file ignores the whole file. They are full keyword tokens so the scanner matches them the same way it finds any directive.

const (
	// ProviderAuto asks clover to infer the real provider from context (e.g. a
	// GitHub Actions uses: pin in a workflow file resolves to github).
	ProviderAuto = "auto"
	// ProviderManual is a human-owned root: it publishes the value already on
	// the target line under an id for followers, contacting no upstream.
	ProviderManual = "manual"

	ProviderCrates    = "crates"
	ProviderDocker    = "docker"
	ProviderFollow    = "follow"
	ProviderGitea     = "gitea"
	ProviderGithub    = "github"
	ProviderGitlab    = "gitlab"
	ProviderGo        = "go"
	ProviderHashicorp = "hashicorp"
	ProviderHelm      = "helm"
	ProviderHTTP      = "http"
	ProviderNode      = "node"
	ProviderNpm       = "npm"
	ProviderOpentofu  = "opentofu"
	ProviderPypi      = "pypi"
	ProviderPython    = "python"
	ProviderRust      = "rust"
	ProviderSwift     = "swift"
	ProviderTerraform = "terraform"
	ProviderZig       = "zig"
)

Provider names, as written in a directive's provider= and used by the registry and rewriter dispatch.

const (
	RuleAsset      = "asset"
	RuleBehind     = "behind"
	RuleConstraint = "constraint"
	RuleCooldown   = "cooldown"
	RuleDowngrade  = "downgrade"
	RuleExclude    = "exclude"
	RuleInclude    = "include"
	RulePrerelease = "prerelease"
	RuleTagPrefix  = "tag-prefix"
)

Rule keys: the selection-policy half of a directive, shared by the rule compiler today and the format canonicaliser and lint later.

const (
	SchemeHTTP  = "http://"
	SchemeHTTPS = "https://"
)

URL scheme prefixes, shared wherever a registry or host value is built or stripped.

const (
	ValueCommit  = "commit"
	ValueSha256  = "sha256"
	ValueVersion = "version"
)

Follow value kinds: what a follow marker projects from the producer it follows (value=). Version and Commit are read straight from the producer's candidate; Sha256 is fetched using the producer's version.

const (
	Sha256Auto      = "auto"      // digest, then checksums, then download (default)
	Sha256Digest    = "digest"    // the provider's asset digest, no download
	Sha256Checksums = "checksums" // a published checksums file (sha256-url or a sibling asset)
	Sha256Download  = "download"  // download the asset and hash it
	Sha256Verify    = "verify"    // require the digest and checksums file to agree
)

Sha256 sources: how a value=sha256 follower obtains its checksum (sha256-source=). Auto tries them in order; verify cross-checks the provider digest against a published checksums file and fails on a mismatch.

const DigestSha256 = "sha256:"

DigestSha256 is the algorithm prefix for a sha256 content digest ("sha256:<hex>").

const DirectiveAutoKeyword = "@" + DirectiveStem

DirectiveAutoKeyword is the shorthand sigil for auto mode: a bare `@clover` means `clover: provider=auto`. Pairs may follow after a colon (`@clover: key=value`) and are parsed as usual; an explicit provider pair overrides the implied auto.

const DirectiveColon = ':'

DirectiveColon closes a directive keyword before its pairs. It mirrors DirectiveEqual: a rune, used via string(DirectiveColon) where a string is needed.

const DirectiveEqual = '='

DirectiveEqual separates a directive key from its value. It is a rune because the parser scans character by character; use string(DirectiveEqual) where a string is needed (e.g. rendering a directive in format mode).

const DirectiveKeyword = DirectiveStem + string(DirectiveColon)

DirectiveKeyword is the sigil clover scans for inside a comment. Everything after it on the line is the directive the user wrote.

const DirectiveSeparator = ' '

DirectiveSeparator separates a rendered directive's key=value pairs from one another and from the comment marker. It mirrors DirectiveEqual: a rune, used via string(DirectiveSeparator) where a string is needed.

const DirectiveStem = "clover"

DirectiveStem is the directive word without its closing colon. It is the prefilter needle: the substring every directive form (DirectiveKeyword, DirectiveAutoKeyword, the clover:ignore controls) contains.

const DockerDigestMarker = "@" + DigestSha256

DockerDigestMarker is the separator plus digest prefix for a digest-pinned container image reference ("@sha256:<hex>").

const TrackInfer = "*"

TrackInfer is the track= value that infers the floating ref from the target line (the literal tag or branch already written there) rather than naming it.

const VersionDash = '-'

VersionDash separates a version's numeric core from its prerelease or variant suffix (1.27-alpine, 2.0.0-rc.1). It is a rune because the recognizer scans byte by byte; use string(VersionDash) where a string is needed.