Route deeper analyzers per component with prerequisites and inert invocation plans
I maintainer di solito rispondono entro 1 giorno
Nessuno ha ancora preso questa issue.
Valutazione
- Difficoltà
- 5/5
- Tempo stimato
- Più di una settimana
- Idoneità per principianti
- 30/100
Direzione di ricerca
Start with pkg/capabilities/types.go and the existing planner described by #60, then read the map (#74) and coverage-ledger descriptors (#78). Define the router's descriptor data and inert output shape before implementation. Done means the map and one-shot summary report applicable tools, observed and missing prerequisites, scope, coverage, and inert argv, with golden-corpus and descriptor-versioning tests passing.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Descrizione
Why
The "glue" role needs dircue to say which deeper analyzers apply to which component, what each needs, and what it will and won't cover. It should do this before anything runs, deterministically and offline.
Today plan can only route dircue's own modules. The registry in pkg/capabilities/types.go lists eight: availability, declarations, discovery, environments, focus, formats, metrics, structure. It can't plan any external tool. #25 describes exporting tool prerequisites but has no concrete router.
Proposal
Extend planning into an analyzer router driven by the map (#74) and the same versioned provider descriptors used by the coverage ledger (#78).
For each component and deployable, emit:
- applicable tools, with the reason (language, framework, build system);
- prerequisites observed vs. missing, for example:
- a JVM component:
mvnw/gradlewpresent, declaredmaven.compiler.releaseor Gradle toolchain, multi-module parent; - .NET: SDK from
global.json, target frameworks; - Python:
requires-python, lockfile presence; - Go:
godirective,go.work;
- a JVM component:
- scope: root, includes and excludes (vendored, generated, test);
- expected coverage, which feeds the ledger;
- inert argv templates with placeholders (never executed), and the report format to hand back to
--attach(#77).
Initial descriptors:
| Tool | Notes |
|---|---|
| Syft | always applicable; directory source |
| OWASP Noir | framework-coverage table matched against observed frameworks |
| OpenTaint | Java/Kotlin; Maven/Gradle build or precompiled classes; JDK version; SARIF out |
| Bifrost | 13 languages; build-free; requires a staged regular-file inventory (a relative --sources symlink escape was found in the #24 evaluation); BIFROST_SEMANTIC_PACK_DOWNLOAD=off; private cache dir |
| BCA / scc | languages as today |
| Semgrep/OpenGrep, CodeQL | language support; CodeQL build modes |
Rules
- Never route by PATH contents, and never let repository content choose tools, arguments or budgets. Caller policy is trusted; the repository is evidence.
- Missing prerequisites are reported, never guessed around. Weak evidence isn't a safe-to-skip recommendation.
- Absorbs the tool-prerequisite portion of #25. #26 (OpenTaint → ZAP) remains a downstream recipe.
Acceptance
- Router output in the map and the one-shot summary (#76).
- On the golden corpus (#75), applicable tools and unmet prerequisites match the hand-written expectations. JVM entries route to JVM-capable tools with correct build prerequisites, and an unsupported-language component shows no taint analyzer.
- Descriptor data is versioned and tested. Updating a tool version is a data change with its own review.
Related: #9 (trusted profiles), #21, #24, #25, #26, #60 (planner). Epic: #81.
- Lingua principale
- Go
- Stelle
- 0
- Fork
- 0
- Merge medio
- 5h 8m
- PR unite (30g)
- 54
Preparare l'ambiente
- Include un Dockerfile o un file Docker Compose
- Ha un modello di pull request
- Leggi la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di war-and-code/dircue
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 86/100
war-and-code/dircue#200 ·
I maintainer di solito rispondono entro 1 giorno
-
enhancement follow-up
Difficoltà 5/5 Più di una settimana Idoneità per principianti 25/100
war-and-code/dircue#201 ·
I maintainer di solito rispondono entro 1 giorno
-
follow-up
Difficoltà 5/5 Più di una settimana Idoneità per principianti 35/100
war-and-code/dircue#179 ·
I maintainer di solito rispondono entro 1 giorno
-
follow-up
Difficoltà 5/5 Più di una settimana Idoneità per principianti 35/100
war-and-code/dircue#178 ·
I maintainer di solito rispondono entro 1 giorno
-
enhancement follow-up
Difficoltà 4/5 3-5 giorni Idoneità per principianti 45/100
war-and-code/dircue#172 ·
I maintainer di solito rispondono entro 1 giorno
Tutte le issue di war-and-code/dircue
Issue simili
-
bug
Difficoltà 2/5 1-3 ore Idoneità per principianti 62/100
chaitin/agent-compose#770 ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 1/5 Meno di un'ora Idoneità per principianti 85/100
I maintainer di solito rispondono entro 1 giorno
-
kind/bug
Difficoltà 1/5 1-3 ore Idoneità per principianti 85/100
kubernetes-sigs/vsphere-csi-driver#4351 ·
I maintainer di solito rispondono entro 1 giorno
-
component/gpu-kubelet-plugin component/helm needs-triage
Difficoltà 2/5 1-3 ore Idoneità per principianti 62/100
kubernetes-sigs/dra-driver-nvidia-gpu#1559 ·
I maintainer di solito rispondono entro 1 giorno
-
workflow: redundant goroutine in scheduleRetryForse già presa @moodbased l’ha presa oggi. Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 70/100
I maintainer di solito rispondono entro 2 giorni