feat: per-module timeouts, config validate, CLI polish and core refactors - #13
Conversation
Add Artifact.Scoped so new host/URL/IP/host:port list artifacts opt into scope filtering at their declaration site instead of relying on the scopedTextArtifacts allowlist alone (kept as a safety net). Mark the eight target-list artifacts Scoped: true and add a regression test proving an unknown artifact name is filtered when Scoped is set.
…nary go install without ldflags produced binaries reporting 0.0.1/dev/unknown, so the update appeared to never change the version. Resolve the latest release and commit via go list -m and git ls-remote, rebuild with the same ldflags as the Makefile/release pipeline, and replace the running binary in place (falling back to GOBIN with a warning). Extract updateTools for the --tools flag.
Organize the root help into Core/Reports/Configuration/Maintenance groups (disabling cobra command sorting), and give every subcommand a descriptive Long description and Examples section.
scanforge config validate loads scanforge.yaml and checks the config version, default profile resolution, custom profiles referencing only known modules, custom tool paths existing on disk, and a parseable default scope file, exiting non-zero on problems. Add CLI tests covering root/subcommand help, version output and the validate command.
app.go (785 lines) is now app.go (types and options only), run.go (run flow), events.go (orchestrator event consumption and manifest finalization), output.go (report generation and terminal rendering), registry.go (module wiring) and commands.go (doctor/init). Purely mechanical: no behavior change.
parsers.go (799 lines) becomes scan.go (shared line/JSON scanning helpers), parsers_text.go (hosts, ports, katana, whatweb, waf), parsers_json.go (httpx, ffuf, nuclei, techcve, httpcheck, dnsx, tlsx, jssecrets, jsverify), parsers_nmap.go (XML collection) and parsers_screenshots.go. Verified function-by-function against the original: no missing or altered bodies.
Bound each module invocation with context.WithTimeout when a module_timeouts entry is configured in scanforge.yaml; a module exceeding its limit is killed, reported as failed with an actionable message, and its dependents are skipped. Zero/unset keeps the module's own default. config validate now rejects unknown module names in module_timeouts. Docs updated (en/fr/zh).
|
Warning Review limit reached
Next review available in: 58 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (46)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Résumé
Branche
dev: 21 commits depuismain, couvrant la stabilisation (Phase 1), le refactoring du core (Phase 2) et le premier point UX de la Phase 3.Phase 1 — Stabilisation
Artifact.Scoped(8 artefacts de cibles marqués, test de régression) — la frontière de scope ne dépend plus uniquement de l'allowlist legacyscanforge updatereconstruit avec les ldflags de version et installe par-dessus le binaire en cours d'exécutionscanforge config validatePhase 2 — Refactoring core (aucun changement de comportement)
app.goéclaté enrun.go,events.go,output.go,registry.go,commands.goparsers.goéclaté par format d'entrée (scan.go,parsers_text.go,parsers_json.go,parsers_nmap.go,parsers_screenshots.go) — vérifié fonction par fonction, aucun corps altéréPhase 3 — UX (premier point)
module_timeoutsdansscanforge.yaml— chaque module est borné parcontext.WithTimeout; au dépassement il est tué, signaléfailedavec message actionnable, ses dépendants sontskipped.config validaterejette les clés inconnues. Docs en/fr/zh mises à jour.Validation
go vet ./...,golangci-lint run ./...(0 issues),go test ./...— tout passemodule_timeouts), timeout orchestrateur (module tué + dépendant skipped), validation configNotes
module_timeouts(optionnel, rétro-compatible — les configs existantes sans ce champ sont inchangées).tools-versioninchangé)