Help us shape the future of Go! Take the 2026 Go Developer Survey

app

package
v0.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 29, 2026 License: MIT Imports: 55 Imported by: 0

Documentation

Overview

Package app wires configuration, scope validation, orchestration and reporting together behind the CLI commands.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ReadTargets added in v0.4.0 

func ReadTargets(path string) ([]string, error)

ReadTargets parses an engagement targets file: one target per line, "#" comments and blank lines ignored, entries deduplicated.

Types

type App 

type App struct {
	ConfigPath    string
	ScopePrompter ScopePrompter
	Wizard        WizardPrompter
}

func New 

func New(configPath string) *App

func (*App) Diff added in v0.4.0 

func (a *App) Diff(ctx context.Context, opts DiffOptions) (*report.RunDelta, string, error)

Diff loads two runs, regenerates their consolidated reports from the raw artifacts and computes the delta between them. The returned string is the human-readable rendering; the delta itself is also returned so callers can emit JSON for CI.

func (*App) Doctor 

func (a *App) Doctor(ctx context.Context, opts DoctorOptions) error

Doctor checks the local environment (tools, workspace, config) for the selected profile and reports the results, exiting non-zero when a required tool is missing.

func (*App) Export added in v0.4.0 

func (a *App) Export(ctx context.Context, opts ExportOptions) (string, error)

Export reconsolidates a run's report and serializes it in the requested machine-readable format. It returns the path of the written file.

func (*App) Init 

func (a *App) Init(ctx context.Context, opts InitOptions) error

Init creates the default configuration files (scanforge.yaml, scope.txt) in the current directory.

func (*App) Plan added in v0.1.0 

func (a *App) Plan(opts PlanOptions) ([]*PlanResult, error)

Plan validates the profile DAG and scope for every target and returns one PlanResult per target (multi-target support via --targets).

func (*App) PrintValidateConfig added in v0.6.0 

func (a *App) PrintValidateConfig(result *ValidateConfigResult) error

PrintValidateConfig renders the validation result and returns an ExitCodeError when problems were found, so the shell sees a failing command without os.Exit in library code.

func (*App) Run 

func (a *App) Run(ctx context.Context, opts RunOptions) error

Run resolves the target(s) — one positional target or a --targets file — and executes the profile against each of them, keeping per-target runs and reports separated under runs/<target>/. A failing target does not abort the rest of the engagement.

func (*App) Triage added in v0.7.0 

func (a *App) Triage(ctx context.Context, opts TriageOptions) (*triage.Result, error)

Triage reconsolidates a run's report, projects it into the canonical finding model, computes the deterministic relations and runs the triage pipeline (deduplication + optional LLM analysis). Results are written under <run>/triage/ and returned for rendering.

func (*App) Update added in v0.1.0 

func (a *App) Update(ctx context.Context, opts UpdateOptions) error

func (*App) ValidateConfig added in v0.6.0 

func (a *App) ValidateConfig(ctx context.Context) (*ValidateConfigResult, error)

ValidateConfig loads scanforge.yaml and checks that it is usable: supported config version, resolvable default profile, custom profiles referencing only known modules, custom tool paths that exist on disk, and a parseable default scope file. A missing default scope file is only a warning: it is the normal state before `scanforge init` has run.

type DiffOptions added in v0.4.0 

type DiffOptions struct {
	// Run1 and Run2 are run root directories (runs/<target>/<id>).
	Run1 string
	Run2 string
}

DiffOptions selects the two runs to compare.

type DoctorOptions 

type DoctorOptions struct {
	Profile string
	JSON    bool
	Verbose bool
}

type ExitCodeError added in v0.3.0 

type ExitCodeError struct {
	Code int
}

ExitCodeError carries a non-zero process exit code out of a command handler so the entry point can honor it without os.Exit in library code (which would skip defers and make the path untestable).

func (ExitCodeError) Error added in v0.3.0 

func (e ExitCodeError) Error() string

type ExportFormat added in v0.4.0 

type ExportFormat string

ExportFormat selects the machine-readable output format. 

const (
	ExportSARIF      ExportFormat = "sarif"
	ExportDefectDojo ExportFormat = "defectdojo"
)

func ParseExportFormat added in v0.4.0 

func ParseExportFormat(value string) (ExportFormat, error)

ParseExportFormat normalizes a user-supplied format name.

type ExportOptions added in v0.4.0 

type ExportOptions struct {
	// Run is a run root directory (runs/<target>/<id>).
	Run string
	// Format is one of ExportSARIF or ExportDefectDojo.
	Format ExportFormat
	// Out overrides the default output path (empty = report.<ext> in the run dir).
	Out string
}

ExportOptions selects the run and format to export.

type InitOptions 

type InitOptions struct {
	Force bool
}

type PlanOptions added in v0.1.0 

type PlanOptions struct {
	Target      string
	TargetsFile string
	Profile     string
	Scope       string
	ScopeMode   string
	ScopeAdd    []string
	Exclusions  []string
}

type PlanResult added in v0.1.0 

type PlanResult struct {
	Target       string
	Profile      string
	Scope        string
	ScopeSource  string
	ScopeMode    string
	ScopeNote    string
	ScopeEntries []string
	Steps        []PlanStep
}

type PlanStep added in v0.1.0 

type PlanStep struct {
	Wave        int
	Name        string
	Binary      string
	Risk        string
	Description string
	Requires    []string
	Produces    []string
}

type RunOptions 

type RunOptions struct {
	Target       string
	TargetsFile  string
	Profile      string
	Scope        string
	ScopeMode    string
	ScopeAdd     []string
	Exclusions   []string
	ConfirmScope bool
	DryRun       bool
	Verbose      bool

	// Proxy routes HTTP-capable modules through an intercepting proxy such
	// as Caido or Burp Suite (e.g. http://127.0.0.1:8080).
	Proxy string
	// Headers are applied to every outgoing HTTP request, for example to
	// carry an authenticated session (Cookie/Authorization).
	Headers []string
	// Nuclei carries nuclei-specific tuning (severity, tags, rate limiting).
	Nuclei modules.NucleiOptions
	// Ffuf carries ffuf-specific tuning (wordlist, status-code filtering).
	Ffuf modules.FfufOptions
	// NmapConcurrency bounds how many nmap processes run at once.
	NmapConcurrency int
}

type ScopePrompter added in v0.1.0 

type ScopePrompter interface {
	IsTTY() bool
	Confirm(ScopeProposal) (bool, error)
}

ScopePrompter is injectable so confirmation behavior can be tested without a real terminal.

type ScopeProposal added in v0.1.0 

type ScopeProposal struct {
	Source  string
	Mode    string
	Input   string
	Note    string
	Entries []string
}

ScopeProposal is the exact authorization boundary shown before a run.

type TriageOptions added in v0.7.0 

type TriageOptions struct {
	// Run is a run root directory (runs/<target>/<id>).
	Run string
	// Force bypasses the cache and re-runs the analysis.
	Force bool
	// Model and BaseURL override the ai section of scanforge.yaml.
	Model   string
	BaseURL string
}

TriageOptions selects the run to analyze and optional LLM overrides.

type UpdateOptions added in v0.1.0 

type UpdateOptions struct {
	Tools bool
}

type ValidateConfigResult added in v0.6.0 

type ValidateConfigResult struct {
	Path     string
	Problems []string
	Warnings []string
}

ValidateConfigResult is the outcome of a config validation: the resolved config path plus problems (hard errors) and warnings (soft issues).

type WizardPrompter added in v0.5.0 

type WizardPrompter interface {
	IsTTY() bool
	AskTarget() (string, error)
	AskProfile(available []string, current string) (string, error)
}

WizardPrompter collects the pieces of a run the user did not provide (target, profile) so bare "scanforge run" becomes a guided setup instead of a plain "target is required" error. It is injectable so the interactive behavior can be tested without a terminal, mirroring ScopePrompter.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.