risk
Installation
Entrypoint
Types
Risk

risk

No long description provided.

Installation

dagger install github.com/context-and-oss/cicd/src/risk@v5.1.5

Entrypoint

Return Type

Risk

Example

dagger -m github.com/context-and-oss/cicd/src/risk@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \

func (m *MyModule) Example() *dagger.Risk  {
	return dag.
			Risk()
}

@function
def example() -> dagger.Risk:
	return (
		dag.risk()
	)

@func()
example(): Risk {
	return dag
		.risk()
}

Types

Risk 🔗

Risk provides AI-driven repository risk analysis with OPA policy enforcement. Use Scan to generate findings (committed to the repo), Validate to gate CI, Check as a Dagger check directive, and Report to render a markdown summary.

check() 🔗

Check runs Validate and returns an error if any policy violations are found. Registered as a dagger check — runs automatically via dagger check.

Return Type

Void !

Arguments

Name	Type	Default Value	Description
source	Directory	-	No description provided

Example

dagger -m github.com/context-and-oss/cicd/src/risk@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 check

func (m *MyModule) Example(ctx context.Context)   {
	return dag.
			Risk().
			Check(ctx)
}

@function
async def example() -> None:
	return await (
		dag.risk()
		.check()
	)

@func()
async example(): Promise<void> {
	return dag
		.risk()
		.check()
}

proxy() 🔗

Proxy exports the bundled claude-proxy.js. Run this once to get the script, then keep it running alongside dagger call scan –use-claude-cli –llm-token env:CICD_RISK_PROXY_TOKEN.

Usage:

dagger -m ./src/risk call proxy export --path ./claude-proxy.js
npm install -g @anthropic-ai/claude-code             # once
export CICD_RISK_PROXY_TOKEN="$(openssl rand -hex 32)"
node claude-proxy.js                                 # keep running

Return Type

File !

Example

dagger -m github.com/context-and-oss/cicd/src/risk@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 proxy

func (m *MyModule) Example() *dagger.File  {
	return dag.
			Risk().
			Proxy()
}

@function
def example() -> dagger.File:
	return (
		dag.risk()
		.proxy()
	)

@func()
example(): File {
	return dag
		.risk()
		.proxy()
}

report() 🔗

Report renders a markdown report from findings.json and decisions.json, auto-discovered anywhere in the source tree.

Return Type

File !

Arguments

Name	Type	Default Value	Description
source	Directory !	-	No description provided

Example

dagger -m github.com/context-and-oss/cicd/src/risk@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 report --source DIR_PATH

func (m *MyModule) Example(source *dagger.Directory) *dagger.File  {
	return dag.
			Risk().
			Report(source)
}

@function
def example(source: dagger.Directory) -> dagger.File:
	return (
		dag.risk()
		.report(source)
	)

@func()
example(source: Directory): File {
	return dag
		.risk()
		.report(source)
}

scan() 🔗

Scan runs AI analysis on the repository. Returns a directory with findings.json and decisions.json to commit to the repo.

LLM mode (pick one): - –use-claude-cli –llm-token env:CICD_RISK_PROXY_TOKEN → connect to a locally running claude-proxy.js on port 4000. Uses your Claude CLI auth (subscription/OAuth, no API key needed). Start the proxy first with the same token — see the error message for the setup. - –llm-url http://host:4000 [–llm-token …] → any OpenAI-compatible proxy (enterprise gateway) - (neither) → dag.LLM() native, requires ANTHROPIC_API_KEY env var

What reaches the model: the files collect.go lists — git’s view of the tree minus the credential and metadata classes in sensitivePathParts — in full, up to the prompt budget. scan-manifest.json names every one of them.

Return Type

Directory !

Arguments

Name	Type	Default Value	Description
source	Directory !	-	Source directory to scan.
useClaudeCli	Boolean	-	Connect to a locally running claude-proxy.js on port 4000. Uses your existing Claude CLI auth — no API key required. Needs –llm-token; start the proxy first (‘risk proxy’ exports it).
llmUrl	String	-	OpenAI-compatible proxy URL for custom/enterprise setups. Mutually exclusive with –use-claude-cli.
maxLlmretries	Integer	2	Maximum JSON-correction retries when the AI returns invalid JSON.
llmToken	Secret	-	Bearer token for the LLM endpoint, as a secret (–llm-token env:CICD_RISK_PROXY_TOKEN). Required with –use-claude-cli: claude-proxy.js refuses every request without it. Optional with –llm-url.

Example

dagger -m github.com/context-and-oss/cicd/src/risk@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 scan --source DIR_PATH

func (m *MyModule) Example(source *dagger.Directory) *dagger.Directory  {
	return dag.
			Risk().
			Scan(source)
}

@function
def example(source: dagger.Directory) -> dagger.Directory:
	return (
		dag.risk()
		.scan(source)
	)

@func()
example(source: Directory): Directory {
	return dag
		.risk()
		.scan(source)
}

validate() 🔗

Validate runs OPA policy checks: findings+decisions review enforcement and infra file scanning (Dockerfile, ARM JSON, pipeline YAML). Returns an evidence envelope. Missing risk files: passes with a warning.

Scope: infraScope decides. “changed” judges only the files the supplied diff touches — a pull request owns the infra it changes, not the repository’s pre-existing artifact debt (mirrors the intent gate) — and falls back to the whole tree when there is no change set to narrow by (standalone calls, default-branch runs). “tree” judges every parseable file in the checkout and ignores the diff, which is what the commit stage asks for: on a push that has already merged there is no author left to hold responsible for one file, and a scan scoped to that push reads a file on the commit that edits it and never again.

Either way the envelope states both numbers — how many files were examined and how many the scanner could have read — because a zero is unreadable without its denominator.

Return Type

File !

Arguments

Name	Type	Default Value	Description
source	Directory !	-	Source directory to validate.
failOn	String !	"HIGH"	Minimum severity that fails the pipeline: CRITICAL\|HIGH\|MEDIUM\|LOW\|NONE
commitSha	String !	-	Git commit SHA for evidence provenance.
branch	String !	-	Git branch name for evidence provenance.
repoUrl	String !	-	Repository URL for evidence provenance.
diff	File	-	Output of `git diff <base>...HEAD` as a file. Supplies the change set that infraScope “changed” narrows by. Ignored when infraScope is “tree”.
infraScope	String	"changed"	Which infrastructure files to evaluate: “changed” (only those in –diff) or “tree” (every parseable file in the checkout).

Example

dagger -m github.com/context-and-oss/cicd/src/risk@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 validate --source DIR_PATH --fail-on string --commit-sha string --branch string --repo-url string

func (m *MyModule) Example(source *dagger.Directory, failOn string, commitSha string, branch string, repoUrl string) *dagger.File  {
	return dag.
			Risk().
			Validate(source, failOn, commitSha, branch, repoUrl)
}

@function
def example(source: dagger.Directory, failon: str, commitsha: str, branch: str, repourl: str) -> dagger.File:
	return (
		dag.risk()
		.validate(source, failon, commitsha, branch, repourl)
	)

@func()
example(source: Directory, failOn: string, commitSha: string, branch: string, repoUrl: string): File {
	return dag
		.risk()
		.validate(source, failOn, commitSha, branch, repoUrl)
}