care

package module
v0.9.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 16, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

README

care

Quality care health GitHub Tag License

Code and repo health

care runs every quality, security, dependency, and test check for a repo in one command, built for working across many repos and languages at once.

Keeping standards consistent as you switch languages is hard. care helps you follow each ecosystem's best practices. Go for now.

blink demo discovering and running services 

care

github.com/toaweme/care  │  C 78/100 needs-attention  │  7 passed, 2 failed, 1 skipped  │  3.2s  │  6 tools
  main · a4d4a5a · 18 commits · dirty +235 -0 · touched 3m ago
✓ build            compiles
✓ dependencies     tidy, no replace directives
✓ docs             84% documented (309/366, 57 undocumented)
✓ runtime          declared 1.25.0 · code 1.22 · deps 1.25.0
✓ secrets          0 secrets
✓ tests            161 tests, 38.5% coverage, 7 untested
✓ vulnerabilities  0 vulnerabilities (+12 in go toolchain)
○ benchmarks       skipped: not applicable
✗ lint             1 issue
  cmd/care/output/report_json.go:138:12  G306: Expect WriteFile permissions to be 0600 or less (gosec)
✗ version control  1 uncommitted (+235 -0)
  untracked  README.md  +235 -0  3m ago

One command, every check, one grade. Run it before you push, in CI, or on a timer behind a dashboard.

Install

# go
go install github.com/toaweme/care/cmd/care@latest

# homebrew (macos)
brew install toaweme/tap/care

# scoop (windows)
scoop bucket add toaweme https://github.com/toaweme/scoop-bucket
scoop install toaweme/care

# binary
wget -qO- https://github.com/toaweme/care/releases/download/v0.9.0/care_0.9.0_linux_x64.tar.gz | tar xz

Every release also lists the exact archive for each OS/arch on the releases page.

care shells out to a few tools (golangci-lint, govulncheck, betterleaks, plus go/gofmt). With auto_install: true (the default) it installs any missing binary on demand via brew or go install; pin or disable individual tools in config.

Commands

Bare care is care status with everything on.

care status or just care

Run the selected checks against the current repo and render the result.

  • --json/-j emits the report as JSON to stdout
  • --output/-o <file> writes the JSON report to a file instead.
  • --stdout/-s outputs to stdout. Useful in CI where we need both JSON file and the logs.
  • --amend/-a is a fast one-shot refresh of just the working-tree state, merged into the --output file (~36x faster than a full care status run) for an external watcher, cron, or dashboard to poll.
care get

Fetch a config file into the current repo from any source and, optionally, rewrite placeholder tokens on the way in. It decouples which file goes where from where the bytes come from.

care get toaweme/care/templates/.golangci.yml                                        # pull a file, write ./.golangci.yml
care get toaweme/care/templates/.golangci.yml --out config/x.yml                     # choose the destination
care get owner/repo/path/LICENSE -r __YEAR__=2027 -r '__HOLDER__=toawe.me Authors'   # rewrite tokens
care get ./local/x.yml --force                                                       # overwrite an existing file

The source is the first positional argument; --out defaults to the source's filename. Pass -r token=value to replace every occurrence of token in the fetched bytes; repeat -r for each replacement. Each pair splits on the first =, so the value may contain any character (spaces, ;, ,, =, quotes) as long as your shell passes it as one argument; the token may not contain =. If a token starts with -, use the glued form -r=token=value.

Sources resolve in this order:

  • local file (./, ~, file://, or any existing path)
  • remote (a real github.com/raw.githubusercontent.com/gist URL, or the owner/repo[/path] shorthand).

Local and embedded sources are zero-network, a remote fetch is an explicit.

Set Github repo token via --token/-t, env:GITHUB_TOKEN

care changelog

Derive release notes from conventional commits, the org's single source for a release body (it replaces goreleaser's own changelog). The positional tag is the range end; --since sets the start.

care changelog                         # notes for the latest tag (or HEAD), since the previous tag
care changelog v1.2.0                  # notes ending at v1.2.0, since the tag before it
care changelog v1.2.0 --since v1.0.0   # explicit range
care changelog --full                  # from the first commit, ignoring tags
care changelog --write                 # maintain CHANGELOG.md in place instead of printing
  • Prints to stdout by default (redirect to capture). --write maintains the Keep a Changelog file at --file/-f (default ./CHANGELOG.md).
  • For the natural range, a matching ## [version] section already in --file is used verbatim, so hand-written prose reaches the release. An explicit --since/--full always re-derives from git.
  • --plain drops commit/PR links and author attribution. Git-host extras (Full Changelog link, contributors) need a token via --token/-t or GITHUB_TOKEN/GH_TOKEN.

GitHub Actions

Use the bundled action to run care in CI. Pin it to a tag or a commit SHA: each tag carries the matching care version, so either pin installs the right binary (no version: input) and verifies its cosign signature and SHA-256 first.

The action installs care and runs care status. Three optional inputs change that: output writes a JSON report, publish-url publishes it, and strict fails the job on failing checks. With none set, it just runs status and logs the result:

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<sha>
      - uses: toaweme/care@v0.9.0 # runs `care status`

Publishing needs id-token: write (a GitHub OIDC token is minted with the URL's origin as audience). Point publish-url at your own ingestion engine. strict: true fails the step on a failing check; omit it to report without failing the job:

jobs:
  quality:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # only for publishing
    steps:
      - uses: actions/checkout@<sha>
      - uses: toaweme/care@v0.9.0
        with:
          strict: true                                  # fail the job, but keep the report
          publish-url: https://ci.example.com/care      # POST the report here; omit to keep it local

care stays on PATH, so any other care command is just your own step, e.g. run: care get toaweme/care/templates/.golangci.yml to sync the lint config first. Set install-only: true to skip care status (and publish/gate) entirely and just get the verified binary onto PATH:

      - uses: toaweme/care@v0.9.0
        with:
          install-only: true
      - run: care get toaweme/care/templates/.golangci.yml

Inputs (none are required):

Input Purpose Default
install-only true installs and verifies care, then stops - no status run, publish, or gate. Use it when a later step just runs its own care command false
version Override the binary version, only when pinning the action to a SHA or branch Latest
output Report file path, care's own --output (use a <name>.care.json name). A failing check still writes it rather than failing the step -
strict true fails the step when a check fails, after any report is published. false reports without failing false
verify Cosign signature check true
dir Directory care runs in (care's --cwd), for a module in a subdirectory with its own go.mod. The report still lands in the workspace root .
publish-url Full URL to POST the report to; empty keeps it local. Needs id-token: write -
publish-timeout Max seconds for each publish-report curl call (OIDC token mint and the POST) 30

The publish endpoint gets the report JSON as the POST body with an Authorization: Bearer <OIDC token> header (audience is the URL's origin). A self-hosted codeviewer exposes the same path: https://<your-host>/ingest?kind=care.

The report stays in the workspace even when checks fail, so you can read a failure report without re-running care (only the download temp dir is cleaned up). The report-path output exposes its location for later steps, e.g. to upload it as an artifact.

Reports stay local unless you set both publish-url and id-token: write; then they're POSTed there. Set publish-url without the token and publishing is skipped with a warning.

Pin to an exact tag and bump it deliberately when you adopt a new release.

Checklist

Each check runs only where it applies and skips itself otherwise (no benchmarks in a repo with none, nothing Go in a non-Go repo).

Check What it does
Version control Uncommitted files as a worklog: per-file line delta + relative age, ordered most-recently-touched
Build go build ./..., compiler diagnostics parsed and located; any error fails
Lint Golangci-lint when a .golangci.* governs the repo, else a go vet + gofmt -l fallback
Dependencies go mod tidy delta + replace directives + go mod verify; the runtime floor the graph forces
Runtime Compares the declared Go version against what the code needs and what deps force (informational)
Docs Exported-symbol doc-comment coverage via go/ast; warns below a configurable threshold
Tests One go test ./... -json per profile: per-package/file/function coverage, untested pkgs, slowest
Benchmark go test -bench (skipped instantly when the repo has no func Benchmark)
Secrets Betterleaks over the working tree and (optionally) git history
Vulnerabilities Govulncheck, called-only findings, categorized deps/code/runtime so toolchain CVEs don't fail

Every check rolls up into one grade. Results are weighted, then critical failures cap the score: a committed secret caps you at F, a reachable vulnerability at C. You get a score out of 100, an A+..F letter, and a healthy / needs-attention / failing verdict. Weights and caps are yours to retune.

Why use care?

  • One score for a whole repo. Build, lint, deps, runtime, docs, tests, benchmarks, secrets, and vulnerabilities, all in one command and one grade. No remembering which tool checks what.
  • Output you can build on. --json emits the full report with the numbers that matter (coverage, vulns, secrets, issues, tests) lifted to the top. Ingest it into codeviewer, a dashboard, a status badge, or any other tooling, the format is stable and meant to be consumed.
  • Fast refresh for live tracking. --amend re-checks just the working tree and reuses the last heavy run, about 36x faster than a full pass, so a watcher or status bar can poll it cheaply.
  • No noise from things you can't fix. Vulnerability findings are filtered to code you actually call, and a CVE that lives in the Go toolchain is shown but never drags your grade down.
  • Tells you the real Go version you need. care reads your code to work out the minimum Go version it actually requires, so you know whether your go.mod directive can come down.
  • Drop in best-practice configs. care get writes canonical linter, release, taskfile, CI, and license files into a repo, bundled and offline by default, or synced from a URL when you ask.
  • Configure once, or not at all. Sensible defaults out of the box; layer ~/.care/care.yml and ./care.yml to pin tools, turn off checks, or retune the grade. Everything optional.
  • Built to grow beyond Go. The check engine is language-agnostic; Go is the first ecosystem, with more to come.

With Go Report Card winding down, coincidentally care works as a local alternative that runs on your own machine.

Contributing

care uses an issue-first workflow. Open an issue describing the change and wait for a maintainer to approve the approach (the approved label) before you open a pull request. PRs that don't reference an approved issue are flagged by a bot and usually closed, so the issue step saves you wasted work.

Every commit must be signed off for the Developer Certificate of Origin with git commit -s. A CI check enforces this on every commit in a pull request.

Full flow in CONTRIBUTING.md, ground rules in CODE_OF_CONDUCT.md.

Hosted code and health reports

Care's --json output can be ingested by any 3rd party tooling including our code viewer, which also hosts our badges and cards.

Public availability soon.

care health care code

Made with ❤️ in Lithuania 🇱🇹.

Documentation

Overview

Package care is the language-agnostic core: it models ecosystems, features, and checks, runs them against a repo, and renders the unified typed results.

Index

Constants

View Source 
const (
	// VulnDeps is a vulnerability in a third-party dependency the code calls.
	VulnDeps = "deps"
	// VulnCode is a vulnerability in the module's own code.
	VulnCode = "code"
	// VulnRuntime is a stdlib vulnerability, a property of the installed Go
	// toolchain version rather than the project; informational, never failing.
	VulnRuntime = "runtime"
)

Vulnerability origin categories. A finding's category decides whether it is actionable against the code (deps, code) or merely informational because it tracks the installed Go toolchain rather than the project (runtime).

View Source 
const (
	FeatureVersionControl  = "version_control"
	FeatureBuild           = "build"
	FeatureLint            = "lint"
	FeatureDependencies    = "dependencies"
	FeatureRuntime         = "runtime"
	FeatureDocs            = "docs"
	FeatureTests           = "tests"
	FeatureBenchmark       = "benchmarks"
	FeatureSecrets         = "secrets"
	FeatureVulnerabilities = "vulnerabilities"
	FeatureFixer           = "fixer"
)

Feature names a language-agnostic capability care checks: the wire `feature` and the terminal header. A result's feature comes from the Ecosystem slot it was selected from, never from the check itself.

Variables

This section is empty.

Functions

This section is empty.

Types

type BaseCheck 

type BaseCheck struct {
	// contains filtered or unexported fields
}

BaseCheck supplies the Name/Tools accessors and the default Applies (false: opt-in), so an implementation only adds Run and overrides Applies for the repos it handles.

func NewBaseCheck 

func NewBaseCheck(name string, tools ...Tool) BaseCheck

NewBaseCheck builds the identity a check embeds from its name and injected tools.

func (BaseCheck) Applies 

func (b BaseCheck) Applies(string) bool

Applies defaults to false: a check must opt in to the repos it handles by overriding this, so nothing runs (or installs tools) where it does not belong.

func (BaseCheck) Name 

func (b BaseCheck) Name() string

Name returns the check's name.

func (BaseCheck) Tools 

func (b BaseCheck) Tools() []Tool

Tools returns the tools the check needs installed.

type BenchMetric 

type BenchMetric struct {
	Unit  string  `json:"unit"`
	Value float64 `json:"value"`
}

BenchMetric is one non-standard benchmark column: a value and its unit, as the benchmark emitted it (e.g. SetBytes throughput "MB/s", a ReportMetric custom unit).

type BenchReport 

type BenchReport struct {
	ModulePath string        `json:"-"` // repo metadata lives on the report header; kept only to shorten package names in Rows
	Benchmarks []BenchResult `json:"benchmarks,omitempty"`
}

BenchReport holds one repo's benchmark results.

func (BenchReport) Rows 

func (r BenchReport) Rows(int) [][]string

Rows renders one row per benchmark result.

func (BenchReport) Summary 

func (r BenchReport) Summary(int) string

Summary renders the benchmark results as a one-line terminal summary.

type BenchResult 

type BenchResult struct {
	Name        string        `json:"name"`
	Package     string        `json:"package,omitempty"`
	Runs        int           `json:"runs,omitempty"`
	NsPerOp     float64       `json:"ns_per_op,omitempty"`
	BytesPerOp  int           `json:"bytes_per_op,omitempty"`
	AllocsPerOp int           `json:"allocs_per_op,omitempty"`
	Extra       []BenchMetric `json:"extra,omitempty"`
}

BenchResult is one benchmark's result. Ns/Bytes/Allocs are the standard columns `go test -benchmem` always emits; Extra carries any further columns the same line reports (MB/s from b.SetBytes, custom units from b.ReportMetric), in output order.

type Benchmark 

type Benchmark = Check[BenchReport]

Benchmark is the benchmarks feature's check interface.

type Bound 

type Bound struct {
	Min string `json:"min,omitempty"`
	Max string `json:"max,omitempty"`
}

Bound is a version range [Min, Max]. An empty Max means unbounded: Go, being backwards-compatible, never sets one, so a Go bound carries only a Min; a language that removes features (or declares an upper engines bound) fills the Max.

func (Bound) String 

func (b Bound) String() string

String renders a bound: "1.25" (min only), "<=22" (max only), "18..22" (both).

type Build 

type Build = Check[BuildReport]

Build is the build feature's check interface.

type BuildError 

type BuildError struct {
	File    string `json:"file,omitempty"`
	Line    int    `json:"line,omitempty"`
	Col     int    `json:"col,omitempty"`
	Message string `json:"message"`
}

BuildError is one compiler diagnostic: where it occurred and the message.

type BuildReport 

type BuildReport struct {
	Errors []BuildError `json:"errors,omitempty"`
}

BuildReport is the compile state of the repo: the compiler errors `go build` emitted. An empty Errors list means the module compiles.

func (BuildReport) Rows 

func (r BuildReport) Rows(int) [][]string

Rows renders one row per build finding.

func (BuildReport) Summary 

func (r BuildReport) Summary(int) string

Summary renders the build result as a one-line terminal summary.

type Caps added in v0.6.0 

type Caps struct {
	Secrets         int `yaml:"secrets"`
	Vulnerabilities int `yaml:"vulnerabilities"`
}

Caps is the score ceiling a failing critical feature imposes: a committed secret is a live exposure (bad regardless of dev state), a reachable vulnerability is real but often transitive. A feature with no cap relies on its weight alone. Operators own their grade, so caps are tunable; loosening one weakens that signal by choice.

type Check 

type Check[T Report] interface {
	Name() string
	Tools() []Tool
	Applies(dir string) bool
	Run(ctx context.Context, dir string, opts RunOptions) Output[T]
}

Check is one feature's implementation for an ecosystem: it declares the tools it needs, whether it applies to a repo, and runs to produce a typed Output. T is the feature's payload, so a check's Run is statically typed end to end.

func WithRating added in v0.6.0 

func WithRating[T Report](c Check[T], weight int, opts ...RateOption) Check[T]

WithRating binds a grading weight (and an optional score cap via CapAt) to a check at registration, so a feature's importance lives at the ecosystem assembly site next to the check it grades. The result still fills the same typed Ecosystem slot.

type CheckConfig 

type CheckConfig struct {
	Options map[string]string `yaml:"options,omitempty"`
	// Disabled removes this check from a run even when its feature would otherwise be
	// selected. Everything runs by default, so this is how an operator turns a check
	// off without disabling the underlying tool (which other checks may share).
	Disabled bool `yaml:"disabled,omitempty"`
}

CheckConfig is the operator-facing configuration for a single check, keyed by a config key in Config.Checks. Options is a free-form bag the composition root passes to the feature that owns those keys.

type Config 

type Config struct {
	// AutoInstall provisions missing tool binaries when running commands. Defaults to true.
	AutoInstall bool `yaml:"auto_install" default:"true"`
	// Checks configures individual checks by a config key (e.g. "sec.secrets",
	// "sec.vuln"): a free-form options bag the composition root passes to the
	// feature that owns those keys, so adding a check option never changes this
	// struct.
	Checks map[string]CheckConfig `yaml:"checks,omitempty"`
	// Tools overrides tool binaries by name: pin a version or disable a tool.
	// Install coordinates (brew formula, go import path) live in code, not config.
	Tools map[string]ToolConfig `yaml:"tools,omitempty"`
	// Profiles configures the run-profiles a profiled feature runs under: a feature
	// with N profiles runs N times (e.g. tests plain + -race + a build-tag variant),
	// each producing its own result row. An empty list keeps the synthesized default.
	Profiles ProfilesConfig `yaml:"profiles,omitempty"`
	// Health tunes the repo health grade: the per-feature score weights and the failing-
	// feature caps. The composition root seeds it with the active ecosystem's defaults
	// (e.g. golang.DefaultRating) before reading config, so a care.yml health block
	// overlays only the keys the operator sets and the rest keep the ecosystem defaults.
	Health Rating `yaml:"health,omitempty"`
}

Config is the global care configuration loaded from care.yml. The yaml tags carry omitempty so `care init` can marshal a Config back into a clean, minimal care.yml without emitting every zero-valued field.

func Defaults 

func Defaults() Config

Defaults returns a Config with sensible defaults applied.

func (Config) CheckDisabled 

func (c Config) CheckDisabled(feature string) bool

CheckDisabled reports whether a check is disabled in config, keyed by its feature name (e.g. "build", "vet").

func (Config) CheckOption 

func (c Config) CheckOption(check, option string) string

CheckOption returns the value of a single option for a named check, or "" when the check or option is not configured.

func (Config) ToolVersion 

func (c Config) ToolVersion(name string) string

ToolVersion returns the operator-pinned version for a named tool, or "" when the tool is not configured (which the constructors read as "no pin, use the default").

type CosignVerify added in v0.2.0 

type CosignVerify struct {
	IdentityRegexp string `json:"identity_regexp"`
	Issuer         string `json:"issuer"`
}

CosignVerify is the keyless signer identity the download installer verifies a release's checksums sigstore bundle against, when a cosign binary is present.

type DepIssue 

type DepIssue struct {
	Check  string `json:"check"` // tidy | replace | verify
	Detail string `json:"detail"`
}

DepIssue is one dependency finding: which sub-check raised it and the detail.

type Dependencies 

type Dependencies = Check[DepsReport]

Dependencies is the dependencies feature's check interface.

type DepsReport 

type DepsReport struct {
	Issues []DepIssue `json:"issues,omitempty"`
	// RuntimeFloor is the highest runtime version any dependency requires (Go: the
	// max `go` directive across the graph); RuntimeFloorBy is the module that sets
	// it. This is a demand the graph places on the project, surfaced next to the
	// hygiene findings. Deps is every dependency with its declared runtime version.
	RuntimeFloor   string       `json:"runtime_floor,omitempty"`
	RuntimeFloorBy string       `json:"runtime_floor_by,omitempty"`
	Deps           []RuntimeDep `json:"deps,omitempty"`
}

DepsReport is the dependency-graph state for one repo: hygiene findings (module not tidy, replace directives, failed verification) plus what the graph demands: the runtime-version floor the dependencies force (RuntimeFloor, set by RuntimeFloorBy) and the per-dependency runtime versions (Deps, verbose only).

func (DepsReport) Rows 

func (r DepsReport) Rows(verbosity int) [][]string

Rows renders one row per dependency finding.

func (DepsReport) Summary 

func (r DepsReport) Summary(verbosity int) string

Summary renders the dependency check as a one-line terminal summary.

type DepsRunOptions 

type DepsRunOptions struct {
	Fix bool
}

DepsRunOptions are the run modes the Dependencies check reads. Fix applies `go mod tidy` for real instead of the non-mutating tidy check.

type DocSymbol 

type DocSymbol struct {
	File string `json:"file"`
	Line int    `json:"line,omitempty"`
	Kind string `json:"kind"` // func | type | const | var | method
	Name string `json:"name"`
}

DocSymbol is one undocumented exported declaration: its kind, name and location.

type Docs 

type Docs = Check[DocsReport]

Docs is the docs feature's check interface.

type DocsReport 

type DocsReport struct {
	Total      int         `json:"total"`
	Documented int         `json:"documented"`
	Missing    []DocSymbol `json:"missing,omitempty"`
}

DocsReport is the doc-comment coverage of exported symbols: how many of the repo's exported declarations carry a doc comment, and which do not.

func (DocsReport) Rows 

func (r DocsReport) Rows(verbosity int) [][]string

Rows returns the undocumented-symbol list only at -vv, grouped by file. Below that it returns nothing: coverage is a single headline stat (the Summary), and the full per-symbol list would flood the terminal, so it rides on the JSON payload for machine consumers instead.

func (DocsReport) Summary 

func (r DocsReport) Summary(int) string

Summary renders the docs check as a one-line terminal summary.

type Ecosystem 

type Ecosystem struct {
	VersionControl  VersionControl
	Build           Build
	Quality         Quality
	Dependencies    Dependencies
	Runtime         Runtime
	Docs            Docs
	Tests           Tests
	Benchmark       Benchmark
	Secrets         Secrets
	Vulnerabilities Vulnerabilities
	// Fixer applies the fixable features' fixes (lint autofix, gofmt, go.mod tidy)
	// when --fix is set; it runs before the read-only features report what is left.
	Fixer Fixer
}

Ecosystem is the registry of every feature care checks, one typed slot per feature. The struct is the living documentation of care's capabilities: each field names a language-agnostic feature and holds the active ecosystem's check implementation (e.g. golang.NewGoMod() for Dependencies). A second ecosystem (Node) fills the same slots with its own checks. An empty slot is a feature this ecosystem does not implement; it is skipped.

func (*Ecosystem) Tasks 

func (e *Ecosystem) Tasks(s EcosystemConfig) []Task

Tasks turns a EcosystemConfig into the runnable Task list: the Fixer first (when requested and present), then each selected, filled feature slot. Empty slots are dropped, so a feature this ecosystem does not implement never reaches the runner. A profiled feature (one whose check implements Profiled) expands into one task per configured run-profile.

type EcosystemConfig 

type EcosystemConfig struct {
	VersionControl  bool
	Build           bool
	Quality         bool
	Dependencies    bool
	Runtime         bool
	Docs            bool
	Tests           bool
	Benchmark       bool
	Secrets         bool
	Vulnerabilities bool
	// Fix selects the Fixer slot (when present) ahead of the read-only features.
	Fix bool
}

EcosystemConfig picks which feature slots a run includes. The status command maps its flags onto these; the Ecosystem turns them into the runnable Task list.

type FileCoverage 

type FileCoverage struct {
	Path       string      `json:"path"`
	Statements int         `json:"statements,omitempty"`
	Covered    int         `json:"covered,omitempty"`
	Uncovered  []LineRange `json:"uncovered,omitempty"`
}

FileCoverage is one source file's statement coverage within a suite, with the line ranges left uncovered.

type FixReport 

type FixReport struct {
	Fixes []FixResult `json:"fixes,omitempty"`
}

FixReport lists the fixes a Fixer applied across the fixable features.

func (FixReport) Rows 

func (r FixReport) Rows(int) [][]string

Rows renders one row per fix applied.

func (FixReport) Summary 

func (r FixReport) Summary(int) string

Summary renders the fixer result as a one-line terminal summary.

type FixResult 

type FixResult struct {
	Action  string `json:"action"`
	Changed bool   `json:"changed"`
	Detail  string `json:"detail,omitempty"`
}

FixResult is one applied fix: the action taken and a short result detail.

type Fixer 

type Fixer = Check[FixReport]

Fixer is the fixer feature's check interface.

type FuncCoverage 

type FuncCoverage struct {
	File     string  `json:"file"`
	Line     int     `json:"line,omitempty"`
	Name     string  `json:"name"`
	Coverage float64 `json:"coverage"`
}

FuncCoverage is one function's statement coverage within a suite.

type Installer 

type Installer string

Installer selects how the runner provisions a Tool's binary. The zero value (empty) means nothing to provision. 

const (
	InstallerBrew    Installer = "brew"       // homebrew formula
	InstallerGo      Installer = "go-install" // go install <path>@<version>
	InstallerRelease Installer = "release"    // download a verified prebuilt release binary
	InstallerBuiltin Installer = "builtin"    // ships with the toolchain (e.g. go)
)

Installers the runner can provision a tool binary through.

type LineRange 

type LineRange struct {
	Start int `json:"start"`
	End   int `json:"end"`
}

LineRange is an inclusive span of source lines.

type Output 

type Output[T Report] struct {
	// contains filtered or unexported fields
}

Output is a feature's typed result: the feature fills Status and Data (its typed payload); the runner stamps the metadata. T is the feature's payload type, so authoring a feature and its tests stays statically typed. Output satisfies Rendered, so a heterogeneous run collects into one []Rendered.

func Errored 

func Errored[T Report](note string, err error) Output[T]

Errored is a failing outcome with no usable payload (the tool itself failed); note is the short label, err the detail surfaced at higher verbosity.

func ErroredResult added in v0.3.1 

func ErroredResult[T Report](feature, check, dir, note string, err error) Output[T]

ErroredResult builds a stamped run-phase tool-failure Output: note is the short label ("tool failed"), err the underlying detail. It mirrors Result so a caller (or a test) outside this package can synthesize an errored outcome.

func Fail 

func Fail[T Report](data T) Output[T]

Fail is a failing outcome carrying its typed payload (the findings that failed it).

func Pass 

func Pass[T Report](data T) Output[T]

Pass is an OK outcome carrying its typed payload.

func Result 

func Result[T Report](feature, check, dir string, status Status, data T) Output[T]

Result builds a stamped run-phase Output from explicit parts, so a caller (or a test) outside this package can synthesize an output stream without the runner.

func Skip 

func Skip[T Report](note string) Output[T]

Skip is a not-applicable / nothing-to-do outcome; note is the short reason.

func Warn 

func Warn[T Report](data T) Output[T]

Warn is a non-failing outcome that still has something to report.

func (Output[T]) Cap added in v0.6.0 

func (o Output[T]) Cap() (int, bool)

Cap returns the score ceiling this check imposes on a failure; ok is false when the check imposes no cap.

func (Output[T]) Check 

func (o Output[T]) Check() string

Check returns the name of the check that produced this result.

func (Output[T]) Data 

func (o Output[T]) Data() any

Data returns the typed payload for the JSON wire, or nil when the outcome has no rich payload (a skip or a tool failure).

func (Output[T]) Dir 

func (o Output[T]) Dir() string

Dir returns the repo directory this result was produced in.

func (Output[T]) DurationMs 

func (o Output[T]) DurationMs() int64

DurationMs returns how long the check took, in milliseconds.

func (Output[T]) Err 

func (o Output[T]) Err() error

Err returns the underlying error for a tool-failure outcome, or nil.

func (Output[T]) Feature 

func (o Output[T]) Feature() string

Feature returns the language-agnostic feature this result was produced for.

func (Output[T]) Phase 

func (o Output[T]) Phase() Phase

Phase returns the pipeline stage this result belongs to.

func (Output[T]) Profile 

func (o Output[T]) Profile() string

Profile returns the run-profile name this result ran under.

func (Output[T]) Rows 

func (o Output[T]) Rows(verbosity int) [][]string

Rows renders the result's payload as detail rows, or nil when there is no payload.

func (Output[T]) Source 

func (o Output[T]) Source() string

Source returns the result source (empty for typed outputs).

func (Output[T]) Status 

func (o Output[T]) Status() Status

Status returns the outcome status of this result.

func (Output[T]) Summary 

func (o Output[T]) Summary(verbosity int) string

Summary renders the result's payload as a one-line terminal summary, or the note when there is no rich payload.

func (Output[T]) Tool 

func (o Output[T]) Tool() string

Tool returns the name of the tool this result ran through.

func (Output[T]) Version 

func (o Output[T]) Version() string

Version returns the tool version for this result (empty for typed outputs).

func (Output[T]) Weight added in v0.6.0 

func (o Output[T]) Weight() int

Weight returns the feature's grading weight, stamped from its WithRating registration (0 for an unweighted, informational feature).

func (Output[T]) WithCap added in v0.6.0 

func (o Output[T]) WithCap(score int) Output[T]

WithCap returns a copy carrying the failure score cap, the companion to WithWeight for the critical features (secrets, vulnerabilities) that impose a ceiling.

func (Output[T]) WithWeight added in v0.6.0 

func (o Output[T]) WithWeight(weight int) Output[T]

WithWeight returns a copy carrying the grading weight, so a caller (or a test) synthesizing a result stream outside the runner can stamp the policy WithRating would have attached.

type Phase 

type Phase string

Phase is the pipeline stage a result belongs to. The runner installs every task's tools (install phase) before running the tasks (run phase), and tags each result so a single renderer can section the unified stream. 

const (
	PhaseInstall Phase = "install" // ensuring a tool binary is present
	PhaseRun     Phase = "run"     // running a check against a repo
)

Pipeline phases the runner tags each result with.

type Profiled 

type Profiled interface {
	Profiles() []RunProfile
}

Profiled is implemented by a check that runs under multiple named profiles. The Ecosystem expands such a slot into one Task per profile; a check that does not implement it (or returns a single profile) runs once. The returned slice is never empty: a check with no configured profiles returns its synthesized default.

type ProfilesConfig 

type ProfilesConfig struct {
	Tests []RunProfile `yaml:"tests,omitempty"`
	Bench []RunProfile `yaml:"bench,omitempty"`
}

ProfilesConfig holds the per-feature run-profiles. Only the profiled features (tests, benchmarks) take profiles; both shell out to `go test`.

type Quality 

type Quality = Check[QualityReport]

Quality is the lint feature's check interface.

type QualityIssue 

type QualityIssue struct {
	File     string `json:"file"`
	Line     int    `json:"line,omitempty"`
	Col      int    `json:"col,omitempty"`
	Linter   string `json:"linter,omitempty"`
	Severity string `json:"severity,omitempty"`
	Message  string `json:"message"`
}

QualityIssue is one structured linter finding.

type QualityReport 

type QualityReport struct {
	Issues []QualityIssue `json:"issues,omitempty"`
}

QualityReport is the linter findings for one repo.

func (QualityReport) Rows 

func (r QualityReport) Rows(int) [][]string

Rows lists each issue as location/message, where location is a contiguous file:line:col so terminals and editors recognize it as a jump target.

func (QualityReport) Summary 

func (r QualityReport) Summary(int) string

Summary renders the lint findings as a one-line terminal summary.

type QualityRunOptions 

type QualityRunOptions struct {
	Fix bool
}

QualityRunOptions are the run modes the Quality check reads. Fix runs the linter in apply mode (golangci-lint run --fix) instead of read-only reporting.

type RateOption added in v0.6.0 

type RateOption func(*rateOptions)

RateOption configures a WithRating call.

func CapAt added in v0.6.0 

func CapAt(score int) RateOption

CapAt sets the worst score a check leaves standing when it fails, so a critical failure (a committed secret, a reachable vulnerability) cannot hide behind an otherwise good average.

type Rated added in v0.6.0 

type Rated interface {
	// Weight is the feature's relative importance in the score; 0 makes it
	// informational (excluded from the grade).
	Weight() int
	// Cap is the worst score this check leaves standing when it fails; ok is false
	// when the check imposes no ceiling.
	Cap() (score int, ok bool)
}

Rated is implemented by a check that carries its own grading policy: its weight in the health score and an optional score cap it imposes when it fails. The runner reads these off the check and stamps them onto the result, so the rating engine grades from per-check policy registered at the ecosystem assembly site, not from a central feature->weight map.

type Rating added in v0.6.0 

type Rating struct {
	Weights Weights `yaml:"weights"`
	Caps    Caps    `yaml:"caps"`
}

Rating is an ecosystem's grading policy: the weight each feature carries in the health score and the worst score a failing critical feature is allowed to leave standing. The types are language-agnostic (they mirror the Ecosystem's feature slots), so every ecosystem grades through the same shape; only the default values differ per ecosystem (a Go module and a Node package can weight dependencies differently). An ecosystem supplies its defaults as a value (e.g. golang.DefaultRating); a care.yml health block overlays it during config load.

type ReleaseSpec added in v0.2.0 

type ReleaseSpec struct {
	BaseURL   string            `json:"base_url"`
	Asset     string            `json:"asset"`
	Checksums string            `json:"checksums"`
	BinPath   string            `json:"bin_path,omitempty"`
	OS        map[string]string `json:"os,omitempty"`
	Arch      map[string]string `json:"arch,omitempty"`
	Cosign    *CosignVerify     `json:"cosign,omitempty"`
}

ReleaseSpec locates a tool's prebuilt release archive for the download installer: the URL and filename templates (expanding {tag}, {version}, {os}, {arch}), the binary's path inside the archive, per-platform token overrides, and optional cosign signer identity. Requires a pinned Version, since a release URL names an exact tag.

type Rendered 

type Rendered interface {
	Phase() Phase
	Feature() string
	Check() string
	Tool() string
	// Profile is the run-profile this result ran under (e.g. "race"); "" for the
	// implicit default profile and for non-profiled checks.
	Profile() string
	Dir() string
	Status() Status
	Summary(verbosity int) string
	Rows(verbosity int) [][]string
	Data() any
	Err() error
	DurationMs() int64
	// Weight is the feature's grading weight (0 for an unweighted feature); Cap is the
	// score ceiling it imposes on a failure, ok false when it imposes none. Both are
	// stamped from the check's WithRating registration so the grade reads per-check.
	Weight() int
	Cap() (score int, ok bool)
	// Version is the resolved tool version captured at install (install outputs
	// only); "" for run-phase checks, which reference their tool by bare name.
	Version() string
	// Source is the installer that provisions the tool (its Installer const:
	// "brew", "go-install", "builtin"); install outputs only, "" otherwise.
	Source() string
}

Rendered is the non-generic view the runner collects and the renderer + JSON consume. Every concrete result (a typed Output[T], a skip, an install outcome) satisfies it, so the unified output stream is one []Rendered.

func InstallResult 

func InstallResult(tool string, status Status, note string) Rendered

InstallResult builds an install-phase outcome for one tool; note is its short state text ("present", "installed", ...).

type RepoFile 

type RepoFile struct {
	Status    string     `json:"status"`
	Name      string     `json:"name"`
	Path      string     `json:"path,omitempty"`
	TouchedAt *time.Time `json:"touched_at,omitempty"`
	// Added / Deleted are the file's uncommitted line delta against HEAD (an
	// untracked file counts every line as added); both are zero for a binary file.
	Added   int `json:"added,omitempty"`
	Deleted int `json:"deleted,omitempty"`
}

RepoFile is one changed file in the working tree: a short status word, the basename and repo-root-relative path, and when it was last touched on disk. TouchedAt is the filesystem mtime, the per-file "last worked on" signal that lets a consumer order changed files by recency; it is absent for a deleted file.

type Report 

type Report interface {
	Summary(verbosity int) string
	Rows(verbosity int) [][]string
}

Report is a check's structured payload rendered to human text. Every outcome carries one: the concrete type is the JSON wire data (via its struct tags) and the source of the terminal presentation. English lives here, never on the metadata fields that reach the wire.

type RunOptions 

type RunOptions struct {
	Tests        TestRunOptions
	Quality      QualityRunOptions
	Dependencies DepsRunOptions
	// Profile is the active run-profile for this task: a profiled feature (tests,
	// benchmarks) expands into one task per profile, and the runner sets this to the
	// profile that task runs under so the check builds the right tool invocation.
	Profile RunProfile
}

RunOptions carries the per-invocation modes a check reads at run time, so a feature slot is constructed once at registration and parameterized per run. Each check reads only its own namespace, so a mode meant for one feature can never leak into another and the struct stays coherent as features gain options.

type RunProfile 

type RunProfile struct {
	Name      string   `yaml:"name"`
	Race      bool     `yaml:"race,omitempty"`
	Coverage  bool     `yaml:"coverage,omitempty"`
	Tags      string   `yaml:"tags,omitempty"`      // -tags
	Benchtime string   `yaml:"benchtime,omitempty"` // benchmarks: -benchtime
	Count     int      `yaml:"count,omitempty"`     // -count
	CPU       string   `yaml:"cpu,omitempty"`       // -cpu
	Args      []string `yaml:"args,omitempty"`      // raw escape-hatch flags appended to the invocation
}

RunProfile is one named set of `go test`-based flags a profiled feature runs under. Both profiled features (tests, benchmarks) shell out to `go test`, so a single shape covers both: a feature with N configured profiles runs N times, once per profile, each producing its own result row. The zero value is the implicit "default" profile.

type Runner 

type Runner interface {
	Run(ctx context.Context, tasks []Task, dir string, opts RunOptions) []Rendered
}

Runner runs selected feature tasks against a repository.

func NewRunner 

func NewRunner(autoInstall bool, tools map[string]ToolConfig) Runner

NewRunner builds a runner. autoInstall controls whether missing tools are installed (vs the feature being skipped); tools carries operator overrides (version pin / disable) keyed by tool name. Concurrency defaults to NumCPU.

type Runtime 

type Runtime = Check[RuntimeReport]

Runtime is the runtime feature's check interface.

type RuntimeDep 

type RuntimeDep struct {
	Module  string `json:"module"`
	Version string `json:"version"`
	Min     string `json:"min,omitempty"` // the dep's own declared runtime version
}

RuntimeDep is one dependency's identity and the runtime version it declares.

type RuntimeReport 

type RuntimeReport struct {
	// Version is the declared language version against what the code actually needs.
	Version RuntimeVersion `json:"version"`
	// Toolchain is the toolchain that builds and runs the project.
	Toolchain RuntimeToolchain `json:"toolchain"`
	// Targets is the module system and platforms the project builds for.
	Targets RuntimeTargets `json:"targets"`
}

RuntimeReport is the execution environment a project targets and what its own code needs, as opposed to what its dependencies demand (that is DepsReport). It is language-agnostic: an ecosystem fills only the parts it has. Go fills the version floor and the toolchain; Node additionally fills the module system and platform targets.

func (RuntimeReport) Rows 

func (r RuntimeReport) Rows(verbosity int) [][]string

Rows renders one row per runtime finding.

func (RuntimeReport) Summary 

func (r RuntimeReport) Summary(int) string

Summary renders the runtime check as a one-line terminal summary.

type RuntimeTargets 

type RuntimeTargets struct {
	// ModuleSystem is the module format the project emits (Node "esm"/"commonjs").
	ModuleSystem string `json:"module_system,omitempty"`
	// Platforms are the os/arch targets the project builds for.
	Platforms []string `json:"platforms,omitempty"`
}

RuntimeTargets is what a project targets at the environment level. Both fields are empty for ecosystems without these concepts.

type RuntimeToolchain 

type RuntimeToolchain struct {
	// Running is the toolchain version currently executing (Go `go env GOVERSION`,
	// the running node binary's version).
	Running string `json:"running,omitempty"`
	// Pinned is the toolchain version the manifest declares (Go `toolchain`
	// directive, a packageManager field); empty when nothing is pinned.
	Pinned string `json:"pinned,omitempty"`
	// PinNote flags a notable Pinned value - one that is redundant or raises the
	// build floor; empty when the pin is unremarkable.
	PinNote string `json:"pin_note,omitempty"`
}

RuntimeToolchain is the toolchain or interpreter that builds and runs a project: the version executing now against the version the manifest pins.

type RuntimeVersion 

type RuntimeVersion struct {
	// Declared is the version range the manifest claims to support (Go `go`
	// directive, Node engines, Python requires-python).
	Declared Bound `json:"declared"`
	// Required is the version range the project's own code needs, by static analysis.
	Required Bound `json:"required"`
	// RequiredReason names the construct that sets Required's lower bound.
	RequiredReason string `json:"required_reason,omitempty"`
	// DependencyFloor is the lowest version the dependency graph allows.
	DependencyFloor string `json:"dependency_floor,omitempty"`
	// Minimum is the lowest version Declared could be set to: the higher of the code
	// requirement and the dependency floor.
	Minimum string `json:"minimum,omitempty"`
	// Reducible reports whether Declared's lower bound sits above Minimum and so
	// could be lowered to it.
	Reducible bool `json:"reducible"`
}

RuntimeVersion is the language version a project declares against the version its own code needs, with the verdict on whether the declaration could be lowered.

type SecretFinding 

type SecretFinding struct {
	Rule        string   `json:"rule"`
	Description string   `json:"description,omitempty"`
	File        string   `json:"file,omitempty"`
	Line        int      `json:"line,omitempty"`
	Commit      string   `json:"commit,omitempty"`
	Entropy     float64  `json:"entropy,omitempty"`
	Tags        []string `json:"tags,omitempty"`
}

SecretFinding is one leaked-secret finding: the rule that matched, where, and the entropy and tags the scanner attached to it.

type SecretReport 

type SecretReport struct {
	Findings []SecretFinding `json:"findings,omitempty"`
}

SecretReport lists leaked-secret findings.

func (SecretReport) Rows 

func (r SecretReport) Rows(int) [][]string

Rows renders one row per detected secret.

func (SecretReport) Summary 

func (r SecretReport) Summary(int) string

Summary renders the secret-scan findings as a one-line terminal summary.

type Secrets 

type Secrets = Check[SecretReport]

Secrets is the secrets feature's check interface.

type Status 

type Status int

Status is the outcome of running a check against a repo. 

const (
	StatusOK Status = iota
	StatusWarn
	StatusFail
	StatusSkip
)

Outcome statuses a check can report.

func (Status) MarshalJSON 

func (s Status) MarshalJSON() ([]byte, error)

MarshalJSON encodes a status as its short label.

func (Status) String 

func (s Status) String() string

String returns the short label for a status.

type Task 

type Task interface {
	Name() string
	Feature() string
	Profile() string
	Tools() []Tool
	Applies(dir string) bool
	// contains filtered or unexported methods
}

Task is a selected feature erased for the runner: enough to install its tools and run it, with its feature identity attached. It can only be built inside this package (via Ecosystem.Tasks), so the feature label always comes from a registry slot, never from arbitrary caller input.

type TestCase 

type TestCase struct {
	Name      string `json:"name"`
	Action    string `json:"action"` // pass|fail|skip
	ElapsedMs int    `json:"elapsed_ms,omitempty"`
	Output    string `json:"output,omitempty"`
}

TestCase is one test function's outcome. Output carries the test's own log output when it failed.

type TestCounts 

type TestCounts struct {
	Passed  int `json:"passed"`
	Failed  int `json:"failed"`
	Skipped int `json:"skipped,omitempty"`
}

TestCounts is a pass/fail/skip tally of individual test functions.

type TestReport 

type TestReport struct {
	ModulePath string `json:"-"` // repo metadata lives on the report header; kept only to shorten package names in Rows

	Suites       []TestSuite `json:"suites,omitempty"`
	Total        float64     `json:"total,omitempty"`
	WithCoverage bool        `json:"with_coverage"`
	// Cases is the per-test-function tally across all suites (distinct from the
	// per-suite pass/fail, which Summary derives from Suites).
	Cases TestCounts `json:"cases"`
	// Untested lists packages with no test coverage (no test files, or 0% covered
	// when coverage ran), shortened against ModulePath.
	Untested []string `json:"untested,omitempty"`
}

TestReport is the structured result of a test run: per-suite and per-test outcomes plus aggregate coverage.

func (TestReport) Rows 

func (r TestReport) Rows(verbosity int) [][]string

Rows lists each suite (name, result, coverage), expanding any failed suite inline with the failure text so a red run is actionable without a flag; at -vv it expands every suite to its individual test functions.

func (TestReport) Summary 

func (r TestReport) Summary(int) string

Summary renders the test results as a one-line terminal summary.

type TestRunOptions 

type TestRunOptions struct {
	Race     bool
	Coverage bool
}

TestRunOptions are the run modes the Tests check reads.

type TestSuite 

type TestSuite struct {
	Name       string         `json:"name"`
	Coverage   float64        `json:"coverage,omitempty"`
	Statements int            `json:"statements,omitempty"`
	Covered    int            `json:"covered,omitempty"`
	Passed     bool           `json:"passed"`
	Skipped    bool           `json:"skipped,omitempty"`
	DurationMs int            `json:"duration_ms,omitempty"`
	Output     string         `json:"output,omitempty"`
	Tests      []TestCase     `json:"tests,omitempty"`
	Files      []FileCoverage `json:"files,omitempty"`
	Funcs      []FuncCoverage `json:"funcs,omitempty"`
}

TestSuite is one suite's (Go package's) test result with its per-test cases. Output carries package-scoped failure text (e.g. a build error) when the suite failed to even run; Files holds per-file coverage when coverage was collected.

type Tests 

type Tests = Check[TestReport]

Tests is the tests feature's check interface.

type Tool 

type Tool struct {
	// contains filtered or unexported fields
}

Tool is an external binary a Feature runs through. It wraps a ToolSpec the runner installs from and runs the binary in a repo dir via Exec/ExecStdout. The zero Tool (Name "") is a feature with no tool dependency.

func NewTool 

func NewTool(spec ToolSpec) Tool

NewTool builds a Tool from its spec.

func (Tool) Exec 

func (t Tool) Exec(ctx context.Context, dir string, args ...string) ([]byte, error)

Exec runs the tool's binary in dir with args and returns its combined output.

func (Tool) ExecStdout 

func (t Tool) ExecStdout(ctx context.Context, dir string, args ...string) ([]byte, error)

ExecStdout runs the tool's binary in dir with args and returns only stdout, discarding stderr. It suits tools whose machine-readable output (e.g. govulncheck -json) goes to stdout while progress noise goes to stderr.

func (Tool) Name 

func (t Tool) Name() string

Name is the tool's binary name on PATH.

func (Tool) Spec 

func (t Tool) Spec() ToolSpec

Spec returns the install descriptor the runner provisions from.

func (Tool) Version 

func (t Tool) Version(ctx context.Context) string

Version probes the binary for its semantic version, trying the common version invocations and extracting the first semver from the output. It returns "" when the tool reports no recognizable version (so the caller falls back to a bare name).

type ToolConfig 

type ToolConfig struct {
	Version  string `yaml:"version"`
	Disabled bool   `yaml:"disabled"`
}

ToolConfig is the operator-facing override for a tool binary: a version pin and an enable/disable switch. It deliberately carries no install coordinates.

type ToolSpec 

type ToolSpec struct {
	Name      string       `json:"name"`
	Installer Installer    `json:"installer,omitempty"`
	Brew      string       `json:"brew,omitempty"`
	GoPath    string       `json:"go_path,omitempty"`
	Release   *ReleaseSpec `json:"release,omitempty"`
	Version   string       `json:"version,omitempty"`
}

ToolSpec is a tool binary's identity and install coordinates. Installer selects how the runner provisions it; Version is a pin the runner installs to on drift. A tool may carry coordinates for several methods (e.g. Release plus GoPath) so the runner can fall back from one to the next.

type VCReport 

type VCReport struct {
	Files       []RepoFile `json:"files,omitempty"`
	HasUpstream bool       `json:"has_upstream"`
	Ahead       int        `json:"ahead,omitempty"`
	Behind      int        `json:"behind,omitempty"`
}

VCReport is the version-control state: uncommitted files plus how far the branch is ahead of / behind its upstream.

func (VCReport) Rows 

func (r VCReport) Rows(int) [][]string

Rows renders one row per changed file (status, name, line delta, how long ago it was touched), in the report's most-recently-touched-first order.

func (VCReport) Summary 

func (r VCReport) Summary(int) string

Summary renders the version-control state as a one-line terminal summary.

type VersionControl 

type VersionControl = Check[VCReport]

VersionControl is the version-control feature's check interface.

type VulnFinding 

type VulnFinding struct {
	ID       string      `json:"id"`
	Category string      `json:"category,omitempty"`
	Package  string      `json:"package,omitempty"`
	Found    string      `json:"found,omitempty"`
	Fixed    string      `json:"fixed,omitempty"`
	Summary  string      `json:"summary,omitempty"`
	Symbol   string      `json:"symbol,omitempty"`
	Trace    []VulnFrame `json:"trace,omitempty"`
}

VulnFinding is one structured vulnerability: the OSV id, its origin category, the affected package and the versions found vs fixed, a one-line summary, the symbol the code reaches, and the call-chain trace.

type VulnFrame 

type VulnFrame struct {
	Module   string `json:"module,omitempty"`
	Version  string `json:"version,omitempty"`
	Package  string `json:"package,omitempty"`
	Function string `json:"function,omitempty"`
}

VulnFrame is one frame of a vulnerability's call-chain trace.

type VulnReport 

type VulnReport struct {
	Findings []VulnFinding `json:"findings,omitempty"`
}

VulnReport lists the vulnerabilities the code is affected by, bucketed by origin via each finding's Category (deps/code are actionable; runtime is informational).

func (VulnReport) Actionable 

func (r VulnReport) Actionable() int

Actionable counts the findings that reflect on the code itself (dependency and own-code vulnerabilities), the set that fails the check and drives the rating.

func (VulnReport) Rows 

func (r VulnReport) Rows(int) [][]string

Rows renders one row per vulnerability finding, actionable ones first and the informational go-toolchain findings last.

func (VulnReport) RuntimeVulns 

func (r VulnReport) RuntimeVulns() int

RuntimeVulns counts the stdlib findings tied to the installed Go toolchain. They are surfaced for visibility but never fail the check or affect the rating.

func (VulnReport) Summary 

func (r VulnReport) Summary(int) string

Summary renders the vulnerability findings as a one-line terminal summary: the actionable count drives the headline noun, with the informational go-toolchain count appended so it stays visible even when the check passes.

type Vulnerabilities 

type Vulnerabilities = Check[VulnReport]

Vulnerabilities is the vulnerabilities feature's check interface.

type Weights added in v0.6.0 

type Weights struct {
	VersionControl  int `yaml:"version_control"`
	Build           int `yaml:"build"`
	Lint            int `yaml:"lint"`
	Dependencies    int `yaml:"dependencies"`
	Docs            int `yaml:"docs"`
	Tests           int `yaml:"tests"`
	Benchmarks      int `yaml:"benchmarks"`
	Secrets         int `yaml:"secrets"`
	Vulnerabilities int `yaml:"vulnerabilities"`
}

Weights is the relative importance of each gradable feature in the score, one field per Ecosystem feature slot. Weight 0 makes a feature informational (excluded from the grade), which is the usual setting for benchmarks: they run and report but never move the score.

Source Files

View all Source files

Directories

Path Synopsis
cmd
care command
Command care reports repository health and scaffolds config files for the current repo's ecosystem.
 Command care reports repository health and scaffolds config files for the current repo's ecosystem.
care/output
Package output renders a run's check results as a styled terminal report or JSON.
 Package output renders a run's check results as a styled terminal report or JSON.
eco
golang
Package golang holds the Go ecosystem's checks, one per file (check_<name>.go).
 Package golang holds the Go ecosystem's checks, one per file (check_<name>.go).
golang/gomod
Package gomod reads facts out of a repo's go.mod without invoking the go command: its go/toolchain directives, replace directives, and the dependency go-directive floor (computed from each required module's go.mod in the local cache).
 Package gomod reads facts out of a repo's go.mod without invoking the go command: its go/toolchain directives, replace directives, and the dependency go-directive floor (computed from each required module's go.mod in the local cache).
golang/inspect
Package inspect reads Go project metadata (the module path) from a repository on disk.
 Package inspect reads Go project metadata (the module path) from a repository on disk.
golang/minver
Package minver computes the lowest Go language version a module's own code can declare in its `go` directive: the oldest Go that still compiles it.
 Package minver computes the lowest Go language version a module's own code can declare in its `go` directive: the oldest Go that still compiles it.
golang/tests
Package tests runs the Go test suite once via `go test ./...
 Package tests runs the Go test suite once via `go test ./...
golang/tools
Package tools builds the Go ecosystem's external tools with their install coordinates and an optional version pin.
 Package tools builds the Go ecosystem's external tools with their install coordinates and an optional version pin.
shared
Package shared holds the language-agnostic feature implementations: features that apply to any repository regardless of its toolchain (version control, secret scanning).
 Package shared holds the language-agnostic feature implementations: features that apply to any repository regardless of its toolchain (version control, secret scanning).
shared/sync
Package sync resolves file sources (local, embedded, remote) and writes them into the working tree, honoring an existing-file/force rule.
 Package sync resolves file sources (local, embedded, remote) and writes them into the working tree, honoring an existing-file/force rule.
shared/tools
Package tools builds the language-agnostic external tools with their install coordinates and an optional version pin.
 Package tools builds the language-agnostic external tools with their install coordinates and an optional version pin.
internal
changelog
Package changelog derives conventional-commit release notes from git, with an optional Keep a Changelog CHANGELOG.md as persisted state.
 Package changelog derives conventional-commit release notes from git, with an optional Keep a Changelog CHANGELOG.md as persisted state.
devops/git
Package git inspects a git repository's working-tree status, upstream sync state, and identity header for care's report.
 Package git inspects a git repository's working-tree status, upstream sync state, and identity header for care's report.
devops/install
Package install provides tool-binary installers.
 Package install provides tool-binary installers.
rating
Package rating turns a run's per-check outcomes into a single repo health grade: a 0-100 score, a letter rating, a coarse verdict, and a per-check breakdown of what moved the score.
 Package rating turns a run's per-check outcomes into a single repo health grade: a 0-100 score, a letter rating, a coarse verdict, and a per-check breakdown of what moved the score.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.