Dagger
Search

commit

No long description provided.

Installation

dagger install github.com/context-and-oss/cicd/src/composites/commit@v5.1.5

Entrypoint

Return Type 
Commit
Example
dagger -m github.com/context-and-oss/cicd/src/composites/commit@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \

func (m *MyModule) Example() *dagger.Commit  {
	return dag.
			Commit()
}
@function
def example() -> dagger.Commit:
	return (
		dag.commit()
	)
@func()
example(): Commit {
	return dag
		.commit()
}

Types

Commit 🔗

Commit wires the source gate (every stage-2 code check) and an artifact tail into a single, artifact-agnostic commit-stage pipeline.

run() 🔗

Run executes the full commit stage for any repo shape (ADR-005). The source gate — quality, SAST, secrets, dependency-vuln and risk — runs for EVERY shape via a single dag.Stage2().Run call. The artifact tail is selected explicitly with –artifact (never auto-detected):

  • container → build the OCI image, SBOM it, and image-scan it (with an opt-in live-verified secrets pass via –verify-secrets);
  • archive → run the consumer build command in a toolchain container and secrets-scan the built output (requires –build-cmd and –output-path);
  • none → no build; the SBOM comes from stage-2’s scan-source Trivy-FS CycloneDX (source lockfiles), and the audit carries an explicit “artifact: NOT ATTESTED” record so a run that attested no artifact cannot read as one that attested a clean artifact (build.NoArtifact).

The artifact is built and scanned but never published — each consumer repo owns its own deployment. Evidence from the source gate and the artifact tail is aggregated and a Teams notification is posted if a webhook is provided. Returns the audit directory containing combined-evidence.json, findings.sarif, sbom.cdx.json. With app-id, explicit app legs replace repository discovery and only evidence is produced. Shared scanners and artifact builders are reused directly.

Return Type 
Directory !
Arguments
NameTypeDefault ValueDescription
srcDirectory !-

Source directory to scan (and, for the container/archive shapes, build).

commitShaString !-

Git commit SHA — used as the image tag and for evidence provenance.

branchString !-

Git branch name.

repoUrlString !-

Repository URL.

artifactString !"container"

Artifact shape: container|archive|none. Always explicit (ADR-001 — cicd never auto-detects the build).

failOnString !"HIGH"

Minimum severity that fails the pipeline: CRITICAL|HIGH|MEDIUM|LOW|NONE

include[String ! ] -

— source gate (passthrough to dag.Stage2().Run) — Languages to include: go, node, python, dotnet (repeatable, optional).

sastRulesetsString !"p/security-audit"

Semgrep rulesets for SAST (e.g. “p/security-audit,p/owasp-top-ten”). Never pass empty, and never “auto” — both mean semgrep applies no rules. The security module now fails the gate instead of reporting zero findings (see security/CLAUDE.md).

diffFile -

Output of git diff <base>...HEAD. Carries the change set to the intent gate’s coupling checks, which report here without gating. It does not scope the risk infra scan: this stage runs on the push that already merged, and scans the whole tree.

minCoverageFloat "0"

Minimum coverage percentage gate (0 disables). See quality.Check.

coverageMinLinesInteger "0"

Skip coverage gate for a language when coverable lines are below this threshold.

testCmdString -

Consumer-owned test command for witnessed BYO test execution (quality.Test).

testLegsString -

Witnessed test legs as a JSON array — one object per leg with the keys label, language (go|node|python|dotnet), cmd, and optionally coveragePath and toolchainImage. The polyglot form of testCmd: one command, container and coverage report per language instead of one for the whole repository. Mutually exclusive with testCmd. See quality.Test.

coveragePathString -

Path of the coverage report the test command writes — absolute, or relative to the source root. Applies to testCmd only; a leg names its own. See quality.Test.

baselineFile -

Baseline coverage document for the ratchet: a prior combined-evidence.json / evidence envelope, or a bare {“coverageByLanguage”: {…}} map (sniffed).

toleranceFloat !1

Allowed per-language coverage drop (percentage points) before the ratchet trips.

coverageGateString !"gate"

Ratchet mode: “gate” fails the envelope on a tripped ratchet, “warn” only warns.

licenseGateString !"warn"

License policy mode: “gate” fails the envelope on a license outside the allowlist, “warn” reports without enforcing.

licenseAllow[String ! ] -

Licence categories and individual licences the policy permits. Empty uses cicd’s default policy (permissive, notice, unencumbered). Naming a category replaces the defaults; naming a licence keeps them and allows that declaration as well. “unknown” is not an allowable category — allow the declarations you have read, by their exact text: globally when it is an SPDX expression (BlueOak-1.0.0), or scoped to one package when it is not (example-sdk=SEE LICENSE IN LICENSE).

vulnAcceptString -

Vulnerability findings to accept, each as “=” — e.g. “CVE-2026-81871=the exporter only reaches the Dagger engine’s own telemetry endpoint on the runner”. The row leaves the severity counts, findings[] and the gate, and is disclosed in warnings[] with the reason given; it stays in the CycloneDX report. A reason is mandatory, patterns are refused, and an acceptance that matches nothing warns, so a stale one is visible rather than a standing permission. ONE PER LINE: the separator is a newline and never a comma, because a reason is prose that contains commas. See src/security/vulnallow.go.

licenseExclude[String ! ] -

Not forwarded in application mode (–app-id): that path runs ScanSource code-only and ScanArchive artifact-only, so no vulnerability leg runs and there is nothing to accept. Forwarding it there would warn UNUSED on every app run. Glob patterns whose license declarations are reported but not judged against the policy, e.g. “docs/**”. It narrows scope, never findings.

licenseFullBoolean !true

Read licenses from source headers and LICENSE files as well as from package metadata.

toolchainImageString -

Toolchain container image override for the BYO test command and the archive build — the only digest-pinnable level (ADR-004). On the test side it applies to testCmd only; a leg names its own.

npmFeedUrlString -

Internal npm registry URL.

npmFeedRoutingString -

How the npm feed is applied: “registry” (default) makes it the registry for every package; “npmrc” binds only its token and leaves routing to the project’s .npmrc, for a feed with no upstream to the public registry.

npmTokenSecret -

Auth token for internal npm registry.

nugetFeedUrlString -

Internal NuGet feed URL.

nugetTokenSecret -

Auth token for internal NuGet feed.

dockerfileString !"Dockerfile"

— container shape — Path to Dockerfile relative to src.

platformString !"linux/amd64"

Target platform.

buildCmdString -

— archive shape — Build command, run via sh -c in the toolchain container (always explicit, never auto-detected). Required for –artifact archive.

outputPathString -

Path of the build output directory, relative to the source root (e.g. “dist”). Required for –artifact archive.

verifySecretsBoolean !false

— heavier secrets — Restrict image secrets findings to live-verified credentials (adds TruffleHog’s –only-verified). Opt-in “heavier secrets” gate; container shape only.

teamsWebhookSecret -

— delivery — Teams incoming webhook URL for notifications.

runUrlString -

CI pipeline run URL shown in the Teams notification.

appIdString -

Optional app identity selects evidence-only application execution.

sourcePaths[String ! ] -

Literal checkout-relative files/folders belonging to the application.

lintLegsString -

JSON array of witnessed lint commands and native report locations.

parallelismInteger !1

Maximum independent check groups, and declared test legs, in flight, 1–4. Default preserves sequential execution.

nodeProjectLimitInteger !4

Maximum independent Node projects in repository mode. No truncation.

prepareCmdString -

Restore/install and optionally compile once; tests and packaging share the resulting state. Requires toolchain-image, prepare-language, and witnessed BYO tests.

prepareLanguageString -

Language using prepared dependencies: node or dotnet.

prepareTestLabelString -

Test leg that uses prepared state; required with test-legs, omitted with test-cmd.

Example
dagger -m github.com/context-and-oss/cicd/src/composites/commit@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 run --src DIR_PATH --commit-sha string --branch string --repo-url string --artifact string --fail-on string --sast-rulesets string --coverage-gate string --license-gate string --license-full boolean --dockerfile string --platform string --verify-secrets boolean --parallelism integer --node-project-limit integer
func (m *MyModule) Example(src *dagger.Directory, commitSha string, branch string, repoUrl string, artifact string, failOn string, sastRulesets string, tolerance , coverageGate string, licenseGate string, licenseFull bool, dockerfile string, platform string, verifySecrets bool, parallelism int, nodeProjectLimit int) *dagger.Directory  {
	return dag.
			Commit().
			Run(src, commitSha, branch, repoUrl, artifact, failOn, sastRulesets, tolerance, coverageGate, licenseGate, licenseFull, dockerfile, platform, verifySecrets, parallelism, nodeProjectLimit)
}
@function
def example(src: dagger.Directory, commitsha: str, branch: str, repourl: str, artifact: str, failon: str, sastrulesets: str, tolerance: , coveragegate: str, licensegate: str, licensefull: bool, dockerfile: str, platform: str, verifysecrets: bool, parallelism: int, nodeprojectlimit: int) -> dagger.Directory:
	return (
		dag.commit()
		.run(src, commitsha, branch, repourl, artifact, failon, sastrulesets, tolerance, coveragegate, licensegate, licensefull, dockerfile, platform, verifysecrets, parallelism, nodeprojectlimit)
	)
@func()
example(src: Directory, commitSha: string, branch: string, repoUrl: string, artifact: string, failOn: string, sastRulesets: string, tolerance: , coverageGate: string, licenseGate: string, licenseFull: boolean, dockerfile: string, platform: string, verifySecrets: boolean, parallelism: number, nodeProjectLimit: number): Directory {
	return dag
		.commit()
		.run(src, commitSha, branch, repoUrl, artifact, failOn, sastRulesets, tolerance, coverageGate, licenseGate, licenseFull, dockerfile, platform, verifySecrets, parallelism, nodeProjectLimit)
}