policy

Documentation

Index

• func LoadVEX(path string) (map[string]string, error)
• type Policy
  • func New(failOn string, ignoreIDs []string) *Policy
  • func (p *Policy) ExitCode(findings []model.Finding) model.ExitCode
  • func (p *Policy) Filter(findings []model.Finding) []model.Finding

Functions

func LoadVEX

func LoadVEX(path string) (map[string]string, error)

LoadVEX parses an OpenVEX JSON document and returns a map of vuln ID → status. NOTE: The OpenVEX "products" field is intentionally ignored; filtering is by vulnerability ID only. Product-scoped suppression is a known limitation.

Types

type Policy

type Policy struct {
	FailOn      model.SeverityLevel
	IgnoreIDs   map[string]bool
	VEXStatuses map[string]string
}

Policy determines which findings matter and what exit code to return.

func New

func New(failOn string, ignoreIDs []string) *Policy

New creates a Policy from CLI flags.

func (*Policy) ExitCode

func (p *Policy) ExitCode(findings []model.Finding) model.ExitCode

ExitCode determines the process exit code based on findings.

func (*Policy) Filter

func (p *Policy) Filter(findings []model.Finding) []model.Finding

Filter removes ignored findings and returns only actionable ones.