Documentation
¶
Overview ¶
Package ignore models a repo-committed, declarative finding-suppression policy: the accepted-risk decisions a team version-controls alongside its code – Synapse's take on Trivy's .trivyignore, made governance-first. A rule may carry a reason and an expiry; an expired rule never suppresses (accepted risk is revisited, not permanent); and – enforced by the caller – a suppressed finding is RETAINED and surfaced, never silently dropped. This package is pure (bytes in, decisions out): reading the file and applying the decisions live in the infrastructure + usecase layers.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Rule ¶
type Rule struct {
ID string
Reason string
Expires time.Time // zero = never; the rule stops suppressing on this UTC date
// Malformed marks a rule whose exp: token was present but unparseable. Such a rule NEVER suppresses
// (fail-safe: a date typo must not silently become a permanent acceptance) and is surfaced so it's fixed.
Malformed bool
}
Rule is one suppression: an advisory id (CVE/GHSA) or an exact finding dedup key to accept, with an optional human reason and an optional expiry (zero = never expires).
type Set ¶
type Set []Rule
Set is a parsed suppression policy.
func Parse ¶
Parse reads the .synapseignore text format: one rule per line, '#' begins a comment. A rule line is
<id> [exp:YYYY-MM-DD] [# free-text reason]
Unparseable lines are skipped (lenient, like Trivy) so a single typo can neither hide a whole policy nor fail a scan. Parsing never errors.
func (Set) Expired ¶
Expired returns the rules that have lapsed as of now, so an operator can be told which accepted-risk decisions need refreshing (surfacing them is the caller's job – this never hides anything).
Source Files