cmd

Documentation

Index

• Variables
• func Execute()
• type ComplianceError
  • func (e *ComplianceError) Error() string
• type DegradedError
  • func (e *DegradedError) Error() string
• type IncompleteDataError
  • func (e *IncompleteDataError) Error() string
• type ScoreGateError
  • func (e *ScoreGateError) Error() string

Variables

var (
	Version   = "dev"
	Commit    = "none"
	BuildDate = "unknown"
)

Functions

func Execute

func Execute()

Types

type ComplianceError

type ComplianceError struct {
	Compliance float64
	Threshold  float64
}

ComplianceError is returned when the deprecated --threshold gate is active and the measured percentage of passing controls falls below it. It maps to the same exit code 1 as ScoreGateError and disappears with --threshold.

func (*ComplianceError) Error

func (e *ComplianceError) Error() string

type DegradedError

type DegradedError struct {
	Count int
}

DegradedError is returned when --fail-warnings is set and the run produced one or more "could not verify" warnings — e.g. a known-CVE check skipped because an action's pinned commit could not be resolved to a version (tag list blocked by an org IP allow list, rate limit, or network). The run itself completed; some data could not be checked. It maps to exit code 3 (runtime / data condition), distinct from a gate failure (1) and a configuration error (2), so strict CI can tell "we could not fully verify" apart from "a real control failed".

func (*DegradedError) Error

func (e *DegradedError) Error() string

type IncompleteDataError

type IncompleteDataError struct {
	Reasons []string
}

IncompleteDataError is returned when a run is data-collection-degraded: a GitLab merged-CI fetch failed, or some GitHub workflow files / the branch-protection fetch could not be retrieved. The analysis ran on partial data, so Plumber withholds the verdict — the score banner in the terminal, badge/MR updates — and fails the run rather than pass an incomplete scan. Artifacts are still written but stamped degraded (#220). Maps to exit code 3, the same "could not fully verify" lane as DegradedError, distinct from a real gate failure (1) and a configuration error (2).

func (*IncompleteDataError) Error

func (e *IncompleteDataError) Error() string

type ScoreGateError

type ScoreGateError struct {
	Points    float64
	MinPoints float64
	// PointsGate reports whether the points gate was the one that failed;
	// otherwise the letter gate did.
	PointsGate bool
	Letter     string
	MinLetter  string
	// CiMissing / CiInvalid mark a run with nothing scoreable: no findings
	// means a perfect score, but an absent or unparseable CI configuration
	// must not read as a clean pass. The old GitLab default gate failed this
	// too (compliance zeroed on missing/invalid CI); on GitHub, whose
	// compliance ignored CiMissing, this is an intentional tightening — a
	// repo with no workflows used to pass and now fails.
	CiMissing bool
	CiInvalid bool
	// NoControls marks the config-side variant of nothing-scoreable: the CI
	// was read but zero controls were evaluated (a .plumber.yaml that only
	// configures the other provider, all controls disabled, or a skip-all
	// filter). Zero findings then means "nothing was checked", not "clean" —
	// the old GitLab default failed this too (compliance 0 when no control
	// is considered); on GitHub it is the same intentional tightening as
	// CiMissing.
	NoControls bool
}

ScoreGateError is returned when analysis completes successfully but the Plumber Score falls below the configured gate (--min-points and/or --min-score).

It is distinct from a generic runtime error so that callers (e.g. Execute) can map it to a dedicated exit code:

0 – analysis passed (score gate met)
1 – gate failure (score below --min-points / --min-score)
2 – runtime / configuration error

func (*ScoreGateError) Error

func (e *ScoreGateError) Error() string