Repository navigation
Modernize CLI config and drop configkit - #117
Merged
Merged
Conversation
validate --vex, GATECHECK_VEX, and the config's vex.files read OpenVEX and CycloneDX VEX. Grype, CycloneDX, Trivy, and osv-scanner findings marked not exploitable are dropped after the deny list, so they skip the KEV, EPSS, and severity rules. Statements that name packages match by package URL, and the latest statement wins. Fixes #102
The license config section checks Syft JSON and CycloneDX components against deny and allow glob patterns, with SPDX AND, OR, and WITH expressions evaluated. denyUnknown fails packages with no license, and packageRiskAcceptance skips packages by purl or name. Syft JSON now lists its packages and validates with these rules instead of erroring. Fixes #103
Build a fresh command tree per call and read every setting flag, then environment variable, then default. Remove configkit and Viper. - Exit 2 for usage, IO, and decode errors and 3 for EPSS or KEV data errors. --audit only ignores threshold failures. - --log-level and --log-format on every command. --silent keeps warnings. - --format table|markdown|json on list, list-all, and validate. - validate gains --input-type (with stdin), --epss-url, and --kev-url. list-all gains --epss-filename and --epss-url. - One config encoder and decoder. config init indents, and unknown keys are reported as warnings. validate warns when there is no config. - Coverage thresholds over 1 are read as percents. - Fix the env var panics, the KEV file reading GATECHECK_EPSS_FILENAME, bundle create not truncating, bundle remove of a missing label exiting 0, and the case-sensitive Grype KEV compare. Fixes #73
Deploying gatecheck-website with
|
| Latest commit: |
307061e
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://6c8bc309.gatecheck-website.pages.dev |
| Branch Preview URL: | https://cli-config-modernize.gatecheck-website.pages.dev |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This covers the #73 plan, plus the bugs listed in that issue's comment. The tree is built fresh on every call, settings go flag → env → default, and configkit and Viper are gone.
Behavior changes
0ok,1threshold failure,2usage, IO, or decode error,3EPSS or KEV data error (gatecheck.ErrExternalData). Most of these used to be 255.--auditonly forgives threshold failures. An unsupported report, a decode error, or a fetch error still fails.--silentnow shows warnings.--log-level debug|info|warn|errorand--log-format text|jsonare new, each with an env var. Color is used only on a TTY, andNO_COLORturns it off.--format table|markdown|jsononlist,list-all, andvalidate. Forlist, JSON comes from a custom tablewriter renderer, so every report type gets it without its own code.list-allJSON is one array keyed by file.validate --formatprints a pass/fail summary.validate:--input-type, stdin when FILE is omitted,--epss-url, and--kev-url. It warns when there's no config or when the config has unknown keys (strict decode for each format).list-all:--epss-filenameand--epss-url. EPSS loads once per run. It exits 2 when a file couldn't be listed.Fixes: the panics on
GATECHECK_VERBOSE,GATECHECK_SILENT, andGATECHECK_AUDIT;--audit=falselosing to the env var; the KEV file readingGATECHECK_EPSS_FILENAME;bundle createnot truncating, andadd/removeleaving stale tail bytes;bundle removeof a missing label exiting 0; the case-sensitive Grype KEV compare (related CVE ids are now checked too); EPSS headers with a+0000offset.Tests:
cmd/cli_test.goruns the real tree end to end. It covers each exit path, env precedence, logging, formats, stdin, bundle truncation, and config output. There are also new config round-trip and unknown-key tests inpkg/gatecheck.The docs, the agent guide,
AGENTS.md, and the changelog are updated, including a breaking-changes list for the next minor release.This is stacked on #115 and #116.
Fixes #73
🤖 Generated with Claude Code