module

Noir::DiffGate

--fail-on: which kinds of diff-mode findings make the scan exit non-zero, so a CI job can block a pull request on them.

Constants

CATEGORIES = ["added", "removed", "changed", "auth-removed"] of ::String

EXIT_CODE = 3

Exit status when a gate fires. 1 is a usage error and 2 is --strict's "the scan itself was incomplete"; a CI step has to be able to tell the three apart.

Instance methods

fired(categories : Array(String), counts : Hash(String, Int32)) : Array(String)

The categories that fired, given how many findings each one has.

Source

needs_taggers?(categories : Array(String)) : Bool

auth-removed is read off the auth tag, and tags exist only when a tagger ran. Without one the gate could never fire, which in CI looks exactly like a pull request that removed no auth.

Source

parse(value : String) : Array(String)

Source

unknown(categories : Array(String)) : Array(String)

Source