Dagger
Search

evidence

No long description provided.

Installation

dagger install github.com/context-and-oss/cicd/src/cross-cutting/evidence@v5.1.5

Entrypoint

Return Type 
Evidence
Example
dagger -m github.com/context-and-oss/cicd/src/cross-cutting/evidence@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \

func (m *MyModule) Example() *dagger.Evidence  {
	return dag.
			Evidence()
}
@function
def example() -> dagger.Evidence:
	return (
		dag.evidence()
	)
@func()
example(): Evidence {
	return dag
		.evidence()
}

Types

Evidence 🔗

Evidence is the Dagger module that aggregates the per-module evidence envelopes of one pipeline run into a combined audit directory (Wrap), with the findings table ordered and truncated by a rule the envelope states, and records a stage that could not produce its own envelope (Failure).

failure() 🔗

Failure records a stage that could not produce its own envelope. It lets an orchestrator preserve completed evidence while recording the missing work.

Return Type 
File !
Arguments
NameTypeDefault ValueDescription
moduleString !-No description provided
toolString !-No description provided
concernString !-No description provided
messageString !-No description provided
commitShaString !-No description provided
branchString !-No description provided
repoUrlString !-No description provided
Example
dagger -m github.com/context-and-oss/cicd/src/cross-cutting/evidence@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 failure --module string --tool string --concern string --message string --commit-sha string --branch string --repo-url string
func (m *MyModule) Example(module string, tool string, concern string, message string, commitSha string, branch string, repoUrl string) *dagger.File  {
	return dag.
			Evidence().
			Failure(module, tool, concern, message, commitSha, branch, repoUrl)
}
@function
def example(module: str, tool: str, concern: str, message: str, commitsha: str, branch: str, repourl: str) -> dagger.File:
	return (
		dag.evidence()
		.failure(module, tool, concern, message, commitsha, branch, repourl)
	)
@func()
example(module: string, tool: string, concern: string, message: string, commitSha: string, branch: string, repoUrl: string): File {
	return dag
		.evidence()
		.failure(module, tool, concern, message, commitSha, branch, repoUrl)
}

wrap() 🔗

Wrap aggregates one or more evidence envelope files into a single audit directory.

The returned directory contains: - combined-evidence.json — merged envelope across all inputs - findings.sarif — concatenated SARIF runs from all scanning modules - sbom.cdx.json — merged CycloneDX document from sbom/vuln-scan modules - parts/NN-.json — each input envelope, byte-for-byte as produced - parts/index.json — what parts/ should contain, and what each part said - concerns/.json — the run re-indexed by question (sast, sca, …), as pointers into parts/ rather than copies - concerns/index.json — every concern answered, and every one that was not — the denominator that stops a missing section reading as a clean one

The bundle is written to the module runtime’s scratch workdir and returned by reference (dag.CurrentModule().Workdir), NOT built with dag.Directory(). WithNewFile. That is not a style preference. WithNewFile encodes the file’s entire contents inside the returned Directory’s ID, and a module function’s return value is serialised through a 128 MiB output file — so building the bundle in the DAG makes the bundle’s own size the limit on whether the function can return anything at all. It did: a consumer’s run assembled just over 128 MiB of evidence and got

read function output file: file size 134250496 exceeds limit 134217728

instead of a verdict, an artifact, or any indication of what had been found. The diagnostic size is the public 128 MiB limit plus one fixed 32 KiB read chunk, not the payload’s measured size. Written to the workdir, the content travels through the engine’s filesystem and the returned ID stays a small reference regardless of how much evidence the run produced.

Return Type 
Directory !
Arguments
NameTypeDefault ValueDescription
envelopes[File ! ] !-

Evidence files returned by individual modules.

commitShaString !-

Git commit SHA for the overall pipeline run.

branchString !-

Git branch name.

repoUrlString !-

Repository URL.

appIdString -

Optional application identity. Both fields must be supplied together.

sourcePaths[String ! ] -

Caller-declared source scope, relative to the original checkout.

omitSbomBoolean -

Defer application dependency assessment and do not emit an empty SBOM. Records explicit SKIPPED evidence; repository mode keeps its normal SBOM.

Example
dagger -m github.com/context-and-oss/cicd/src/cross-cutting/evidence@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 wrap --commit-sha string --branch string --repo-url string
func (m *MyModule) Example(envelopes []*dagger.File, commitSha string, branch string, repoUrl string) *dagger.Directory  {
	return dag.
			Evidence().
			Wrap(envelopes, commitSha, branch, repoUrl)
}
@function
def example(envelopes: List[dagger.File], commitsha: str, branch: str, repourl: str) -> dagger.Directory:
	return (
		dag.evidence()
		.wrap(envelopes, commitsha, branch, repourl)
	)
@func()
example(envelopes: File[], commitSha: string, branch: string, repoUrl: string): Directory {
	return dag
		.evidence()
		.wrap(envelopes, commitSha, branch, repoUrl)
}