stage-2
Installation
Entrypoint
Types
Stage2
- run()

stage-2

No long description provided.

Installation

dagger install github.com/context-and-oss/cicd/src/stage-2@v5.1.5

Entrypoint

Return Type

Stage2

Example

dagger -m github.com/context-and-oss/cicd/src/stage-2@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \

func (m *MyModule) Example() *dagger.Stage2  {
	return dag.
			Stage2()
}

@function
def example() -> dagger.Stage2:
	return (
		dag.stage_2()
	)

@func()
example(): Stage2 {
	return dag
		.stage2()
}

Types

Stage2 🔗

Stage2 is the source-gate orchestrator of the CD model: it runs quality, source security, licence, risk and intent checks against one commit and returns their evidence files for cross-cutting/evidence to aggregate. It decides the leg set and the parallelism; the legs themselves live in the domain modules.

run() 🔗

Run executes all pre-commit checks: quality (lint + test), security source scan, risk validation, and — when the caller opts in with requireIntent — the intent gate. Returns a slice of evidence files — one per domain module. Pass these to cross-cutting/evidence to produce combined-evidence.json. Intent is in the slice either way: opted out, it reports that it checked nothing.

Return Type

[File ! ] !

Arguments

Name	Type	Default Value	Description
src	Directory !	-	Source directory to check.
commitSha	String !	-	Git commit SHA for evidence provenance.
branch	String !	-	Git branch name.
repoUrl	String !	-	Repository URL.
failOn	String !	"HIGH"	Minimum severity that fails the pipeline: CRITICAL\|HIGH\|MEDIUM\|LOW\|NONE
include	[String ! ]	-	Languages to include: go, node, python, dotnet (repeatable, optional).
sastRulesets	String !	"p/security-audit"	Semgrep rulesets for SAST (e.g. “p/security-audit,p/owasp-top-ten”). “auto” is rejected by the security module — see security/CLAUDE.md.
npmFeedUrl	String	-	Internal npm registry URL.
npmFeedRouting	String	-	How the npm feed is applied: “registry” (default) makes it the registry for every package; “npmrc” binds only its token and leaves routing to the project’s .npmrc, for a feed with no upstream to the public registry.
npmToken	Secret	-	Auth token for internal npm registry.
nugetFeedUrl	String	-	Internal NuGet feed URL.
nugetToken	Secret	-	Auth token for internal NuGet feed.
diff	File	-	Output of `git diff origin/main...HEAD`. Scopes the intent gate (coupling checks), and the risk infra scan when infra-scope is “changed”.
infraScope	String	"changed"	Which infrastructure files the risk scan evaluates: “changed” (only the ones in –diff) or “tree” (every one in the checkout). It is a parameter and never inferred, because the two stages that call this orchestrator want opposite answers and neither is a default anyone should have to guess. A pull request gate scans the pull request: debt in a file the author did not touch is the previous run’s problem. A push to the default branch has no author left to ask, and it is the stage this repository tells consumers to adopt as the whole-repository gate — where scoping to one push means a file is scanned on the commit that edits it and never again, and a misconfiguration that predates the scan, or that became one when a policy was added rather than when the file changed, is invisible forever. Every other concern on that stage already reads the whole tree; the risk scan was the one exception. With no –diff there is no change set, so “changed” scans the whole tree anyway — that is risk.Validate’s own contract and not a second rule here. Validation lives there too; forwarding an unknown value fails the run.
intentGlobs	[String ! ]	-	Glob patterns for intent artifacts. Uses built-in defaults when omitted.
minCoverage	Float	"0"	Minimum coverage percentage gate (0 disables). See quality.Check.
coverageMinLines	Integer	"0"	Skip coverage gate for a language when coverable lines are below this threshold.
testCmd	String	-	Consumer-owned test command for witnessed BYO test execution (quality.Test). When set, quality.Check runs lint-only and quality.Test runs the command; both evidence files are returned. When empty, existing behavior is unchanged.
testLegs	String	-	JSON array of per-language witnessed test legs, each with its own command, toolchain image and coverage report — the polyglot form of testCmd, and mutually exclusive with it. See quality.Test.
coveragePath	String	-	Path of the coverage report the test command writes — absolute, or relative to the source root. Applies to testCmd only; a leg names its own. See quality.Test.
baseline	File	-	Baseline coverage document for the ratchet: a prior combined-evidence.json / evidence envelope, or a bare {“coverageByLanguage”: {…}} map (sniffed).
tolerance	Float !	1	Allowed per-language coverage drop (percentage points) before the ratchet trips.
coverageGate	String !	"gate"	Ratchet mode: “gate” fails the envelope on a tripped ratchet, “warn” only warns.
licenseGate	String !	"warn"	License policy mode: “gate” fails the envelope on a license outside the allowlist, “warn” reports without enforcing. Defaults to “warn” so the step reports every consumer’s real exposure before anyone is blocked by it. There is deliberately no “off” — see src/security/licensereport.go.
licenseAllow	[String ! ]	-	Licence categories and individual licences the policy permits. Empty uses cicd’s default policy (permissive, notice, unencumbered). Naming a category replaces the defaults; naming a licence keeps them and allows that declaration as well. Anything else outside the policy is a finding. “unknown” is not an allowable category — it means Trivy could not classify a declaration, so allowing it would allow every future one too. Allow the declarations you have read instead, by their exact text: globally when it is an SPDX expression (BlueOak-1.0.0), or scoped to one package when it is not (example-sdk=SEE LICENSE IN LICENSE).
licenseExclude	[String ! ]	-	Glob patterns whose license declarations are reported but not judged against the policy, e.g. “docs/**”. It narrows scope, never findings: there is no way to exclude a license by name. See src/security/licenseexclude.go.
licenseFull	Boolean !	true	Read licenses from source headers and LICENSE files as well as from package metadata. On by default because metadata-only mode never reads the tree’s own LICENSE, which in ecosystems whose manifests carry no license field (Go among them) can be all there is to read. Dependency licences come from installed package metadata in either mode.
vulnAccept	String	-	Vulnerability findings to accept, each as “=” — e.g. “CVE-2026-81871=the exporter only reaches the Dagger engine’s own telemetry endpoint on the runner”. The row leaves the severity counts, findings[] and the gate, and is disclosed in warnings[] with the reason given; it stays in the CycloneDX report. A reason is mandatory, patterns are refused, and an acceptance that matches nothing warns, so a stale one is visible rather than a standing permission. ONE PER LINE: the separator is a newline and never a comma, because a reason is prose that contains commas. See src/security/vulnallow.go.
toolchainImage	String	-	Toolchain container image override for the BYO test command (ADR-004). Applies to testCmd only; a leg names its own.
dependabotActionsPin	Boolean	-	Asserts diff is a pull_request whose actor is exactly dependabot[bot], enabling intent’s approved GitHub Actions pin-bump path in place of a human intent artifact. The caller must verify the actor itself — intent independently re-validates every diff hunk and never trusts this alone. Never set for commit/push execution (dependabot origin cannot be inferred after merge).
requireIntent	Boolean	-	Requires this change to carry a change-intent artifact (capsule, spec, *.intent.md, …). Opt-in: the intent gate asks whether a team practice was followed, not whether the code is safe, and a team that keeps its change rationale somewhere else should not be told its pipeline failed. Left off, intent still reports — with `required: false` and a warning — so an audit can tell an unasked gate from a clean one.
parallelism	Integer !	1	Maximum independent check groups, and declared test legs, in flight; tool-internal parallelism is separate.
nodeProjectLimit	Integer !	4	Maximum independent Node projects; exceeding this fails rather than truncates.
prepared	Container	-	No description provided
preparedLanguage	String	-	No description provided
preparedTestLabel	String	-	No description provided
preparedImage	String	-	No description provided

Example

dagger -m github.com/context-and-oss/cicd/src/stage-2@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 run --src DIR_PATH --commit-sha string --branch string --repo-url string --fail-on string --sast-rulesets string --coverage-gate string --license-gate string --license-full boolean --parallelism integer --node-project-limit integer

func (m *MyModule) Example(src *dagger.Directory, commitSha string, branch string, repoUrl string, failOn string, sastRulesets string, tolerance , coverageGate string, licenseGate string, licenseFull bool, parallelism int, nodeProjectLimit int) []*dagger.File  {
	return dag.
			Stage2().
			Run(src, commitSha, branch, repoUrl, failOn, sastRulesets, tolerance, coverageGate, licenseGate, licenseFull, parallelism, nodeProjectLimit)
}

@function
def example(src: dagger.Directory, commitsha: str, branch: str, repourl: str, failon: str, sastrulesets: str, tolerance: , coveragegate: str, licensegate: str, licensefull: bool, parallelism: int, nodeprojectlimit: int) -> List[dagger.File]:
	return (
		dag.stage_2()
		.run(src, commitsha, branch, repourl, failon, sastrulesets, tolerance, coveragegate, licensegate, licensefull, parallelism, nodeprojectlimit)
	)

@func()
example(src: Directory, commitSha: string, branch: string, repoUrl: string, failOn: string, sastRulesets: string, tolerance: , coverageGate: string, licenseGate: string, licenseFull: boolean, parallelism: number, nodeProjectLimit: number): File[] {
	return dag
		.stage2()
		.run(src, commitSha, branch, repoUrl, failOn, sastRulesets, tolerance, coverageGate, licenseGate, licenseFull, parallelism, nodeProjectLimit)
}