ignore

Documentation

Overview

Package ignore reads .lockvetignore files: acknowledged findings that should stop tripping -fail-on gates without turning the gate off.

One rule per line. Blank lines and #-comments are skipped; a trailing "# reason" on a rule line is encouraged. Rules:

GHSA-xxxx-xxxx-xxxx              ignore one advisory wherever it appears
lodash                           ignore every finding for a package
lodash@4.17.21                   … only while a specific version is incoming
fresh:aws-sdk-go-v2              ignore one finding kind for a package
major:react@19.*                 accept a specific major bump
GHSA-xxxx-xxxx-xxxx until=2026-12-31   temporary, expires loudly

Kinds: vuln, fresh, deprecated, unlisted, typosquat, scripts, provenance, integrity, registry, license, major, downgrade. Package names and advisory IDs match case-insensitively and accept * and ? globs. Suppressed findings stay in the JSON output (ignored / ignored_vulns) and appear as a dim marker in reports, but no longer count toward the summary or -fail-on.

Index

• Constants
• type Rule
• type Set
  • func Parse(path, content string) (*Set, error)
  • func Resolve(explicit string, disable bool, dir string) (*Set, error)
  • func (s *Set) Apply(diffs []diffx.FileDiff, now time.Time) (int, []string)

Constants

const DefaultName = ".lockvetignore"

DefaultName is the filename discovered automatically.

Types

type Rule

type Rule struct {
	Raw  string // the line as written (comment stripped)
	Line int
	Kind string // "" = all kinds; otherwise a canonical kind

	Until time.Time // zero = never expires
	// contains filtered or unexported fields
}

Rule is one parsed .lockvetignore line.

type Set

type Set struct {
	Path  string
	Rules []Rule
}

Set is a parsed ignore file.

func Parse

func Parse(path, content string) (*Set, error)

Parse parses ignore-file content. Errors carry path:line.

func Resolve

func Resolve(explicit string, disable bool, dir string) (*Set, error)

Resolve loads the ignore rules for a run: nil when disabled, the explicit file when given (an error if it doesn't exist), otherwise dir/.lockvetignore when present.

func (*Set) Apply

func (s *Set) Apply(diffs []diffx.FileDiff, now time.Time) (int, []string)

Apply suppresses matching findings in place. It returns the number of findings suppressed and warnings for expired rules (which no longer apply — remove or extend them).