Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Account for analyzer coverage and expose blind spots across tools

Aperta
  • Qualcosa non va?
#78 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go
Ambito
cli, data, tooling

Direzione di ricerca

Start by reading the map and one-shot summary work in issues #74 and #76, then review report ingestion in #77 and the pinned golden-corpus runs in #75. Define the ledger from the population, provider descriptors, and run evidence described here; done means the map and summary report the four expected blind-spot reasons and include the named provider descriptors plus generic SARIF fallback. This is an epic-scale feature, so coordinate scope with maintainers before starting.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement follow-up

Why

When a pipeline runs several deeper analyzers (SBOM generators, structural metrics, linters, endpoint discovery, dataflow tools) over many heterogeneous repositories, an empty result often means the tool didn't understand or didn't reach the code:

  • unsupported language or framework;
  • a build prerequisite was missing;
  • files were excluded;
  • the tool crashed partway;
  • the tool was never run on that component.

These blind spots are invisible in each tool's own output, and no open-source tool found in a survey of the landscape produces cross-tool coverage accounting. This is a neutral profiling fact ("which analyzers actually covered which parts of this directory"), not a quality or security judgment.

dircue already knows the population (files by language, role and component) and states its own coverage honestly. It is the right place to compute what was actually analyzed, and what wasn't.

Proposal

A coverage ledger in the map (#74), computed from three inputs:

  1. The population: first-party executable/source files by component, language and role, excluding vendored and generated files unless the caller says otherwise.
  2. Provider capability descriptors: versioned data shipped with dircue and overridable by the caller. For a pinned tool version: supported languages and frameworks, build prerequisites, default exclusions. For example, OpenTaint handles Java/Kotlin and needs compiled bytecode from Maven/Gradle; Noir covers a set of frameworks; Bifrost covers 13 languages without a build.
  3. Run evidence from ingested reports (#77): SARIF artifacts/invocations/toolExecutionNotifications/exit status, Syft source/locations, provider errors.

Output per component × language × tool:

  • expected_applicable
  • ran
  • covered_files
  • not_covered, with a reason: unsupported_language, unsupported_framework, prerequisite_unmet, excluded, tool_error, not_run, unknown

Roll it up into a blind-spot summary, for example: "38% of first-party source (Scala in services/billing) is covered by no structural analyzer; Syft was not run on dist/; a JVM dataflow tool ran on 2 of 3 JVM components (1 build prerequisite unmet)."

Rules

  • "No report" means not_run, never "clean". "Ran and reported nothing" is different from "didn't analyze".
  • Where a tool doesn't list analyzed files, coverage for that tool is unknown, not assumed.
  • Descriptors are data with provenance and version. A caller's trusted policy can override them; repository content cannot.

Acceptance

  • Ledger present in the map and the one-shot summary (#76).
  • On golden-corpus entries with pinned tool runs (#75), the expected blind spots are reported with the correct reasons: an unsupported language, an unmet build prerequisite, a missing run, and a crashed run.
  • Descriptor data for Syft, OpenTaint, Noir, Bifrost, BCA and scc, plus a generic SARIF fallback with unknown coverage.

Epic: #81.

Lingua principale
Go
Stelle
0
Fork
0
Merge medio
5h 8m
PR unite (30g)
54

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di war-and-code/dircue

Tutte le issue di war-and-code/dircue

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.