Feat/mvp implementation - #2
Merged
Merged
Conversation
Implements the revised canonical data model as a working reference: - Core types for all entities (Artifact, Submission, ProviderResult, Finding with TypedIdentifier relations, PolicyDecision with finding-linked reasons, CloudEvent, ResourceReference) - Normative PURL canonicalization (per-type namespace case rules, qualifier sort, version extraction) - Normative capability-matching algorithm (DNF: profiles OR, requirements AND) with reasoned compatibility results - Stub OSV-style vulnerability provider with in-memory vuln DB, zero-findings-equals-pass boundary, verdict derivation.driven_by[] - Parallel provider orchestration with gated completion, findings-only path, deferred+resume, all-providers-ineligible - Policy engine: allow/review/deny/defer with severity-band escalation and finding-linked DecisionReason - CloudEvents 1.0 emitter with v1 event-type registry (10 types) - HTTP API: submissions, providers, capabilities, artifacts (upload+HEAD), well-known discovery, events; RFC 9457 errors - 10 end-to-end tests, all passing; go build/vet/test clean
Standalone JSON Schema Draft 2020-12 documents are normative; the OpenAPI 3.1 document describes the HTTP surface and references them rather than redefining the domain model. This decouples the schema contract from any OpenAPI tooling version. Schemas (schema/*.schema.json): - resource-reference, artifact, artifact-ref - submission, submission-create (request body) - provider-capabilities (with Capability/InputProfile/Requirement $defs) - finding (with TypedIdentifier relations, SeverityObservation, Assessment, Metric $defs; CWE is classification-only) - provider-result (normative invariants via allOf: completed=>verdict, error/timeout=>no verdict, pass=>no affected findings, fail/warn=>derivation.driven_by, unknown=>derivation.summary) - policy-decision (with finding-linked DecisionReason $def) - event (CloudEvents 1.0 with v1 event-type registry enum) - problem-details (RFC 9457) - compatibility-result OpenAPI (openapi/scintx.openapi.yaml): - 9 endpoints: submissions (create/get/resume), providers (list/caps), artifacts (upload/HEAD), well-known, events - References all schemas via ../schema/*.schema.json - RFC 9421 HTTP Message Signatures as required auth baseline - Idempotency-Key header parameter - RFC 9457 Problem Details for all error responses - Examples for PURL-vulnerability and findings-only submissions Validation (scripts/validate-schemas.py): - 20 fixtures covering every schema, including 4 negative cases (empty artifact, bad CWE id, error-with-verdict, bad event type) - All 20 pass; 0 failures
…rate
Restructures the repo so extensions have a clear home and are picked up
automatically when added — no wiring changes needed.
Extension interfaces (internal/scintx/registry.go):
- Provider — security-scanner adapters
- RegistryConnector — package-registry submission sources
- PolicyEngine — consumer-side policy engines
Each extension registers a factory via init() in its package. The
orchestrator loads all registered providers at startup via
LoadProvidersFromRegistry().
Auto-discovery:
- extensions/{providers,policies,registries}/<name>/ — extension packages
- extensions/{providers,policies,registries}/all/all.go — AUTO-GENERATED
aggregation files that blank-import every extension, triggering init()
- cmd/gen-extensions — code generator that scans extension dirs and
regenerates all.go files
- go generate ./extensions/... — the only command needed after adding
an extension
Extensions shipped:
- extensions/providers/stub-osv/ — stub OSV vulnerability provider (moved)
- extensions/providers/stub-secrets/ — stub secrets provider (new, proves
auto-discovery works with zero wiring changes)
- extensions/policies/default/ — reference allow/review/deny/defer policy
EXTENSIONS.md documents how to add each extension kind with examples.
12 e2e tests pass (added auto-discovery verification tests). 20 schema
validations pass. go build/vet/test all clean.
Ship the HTTP orchestrator (policy, merge, store/cache, auth CLI) so the repo is a runnable interchange rather than a spec-only tree. Co-authored-by: Cursor <cursoragent@cursor.com>
Content-scanning providers need the uploaded file; GetArtifact plus in-memory Content (not JSON) hands them the bytes without sending them to PURL APIs like OSV. Co-authored-by: Cursor <cursoragent@cursor.com>
validate-schemas.py needs jsonschema/referencing; ubuntu-latest does not ship them, so CI was failing on import. Co-authored-by: Cursor <cursoragent@cursor.com>
Tags on actions are mutable; pin commits, drop write credentials, and require hashes for schema Python deps so CI cannot silently swap code. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep a Changelog documents Unreleased gateway work and the 0.0.1 bootstrap so release history is visible next to the license. Co-authored-by: Cursor <cursoragent@cursor.com>
PURL-only queries miss VS Code malware indexed as VSCode:<registry>, so fall back to ecosystem+name queries and merge by vuln ID. Co-authored-by: Cursor <cursoragent@cursor.com>
Default cap is configurable via SCINTX_MAX_ARTIFACT_BYTES; over-limit returns 413 artifact_too_large, and other read failures include the underlying cause. Co-authored-by: Cursor <cursoragent@cursor.com>
Sonatype does not catalog VS Code extensions; advertising the type would turn empty reports into false cleans. Co-authored-by: Cursor <cursoragent@cursor.com>
referencing==0.37.0 pulls in typing-extensions as a transitive dep; --require-hashes mode requires every package to be explicitly pinned with == and a hash, so add typing-extensions==4.16.0 with its SHA256. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.