bofig/k9iser.toml at main · hyperpolymath/bofig · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# SPDX-License-Identifier: MPL-2.0
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
#
# k9iser manifest for bofig
# Generates K9 contracts from repo configuration files.
# bofig is a Phoenix/Elixir evidence graph application with Deno test tooling

[project]
name = "bofig"
safety_tier = "yard"

[[source]]
path = "mix.exs"
type = "mix"
output = "generated/k9iser/mix-manifest.k9"

[[source]]
path = "deno.json"
type = "deno"
output = "generated/k9iser/deno-test-config.k9"

[[source]]
path = "Justfile"
type = "justfile"
output = "generated/k9iser/justfile-recipes.k9"

[[source]]
path = "Containerfile"
type = "containerfile"
output = "generated/k9iser/container-build.k9"

[[source]]
path = ".github/workflows/hypatia-scan.yml"
type = "workflow"
output = "generated/k9iser/ci-security.k9"

[[source]]
path = ".github/workflows/codeql.yml"
type = "workflow"
output = "generated/k9iser/ci-codeql.k9"

[[constraint]]
rule = "mix.dependencies has no retired packages"
severity = "error"

[[constraint]]
rule = "services.evidence_graph.environment contains 'VERISIMDB_URL'"
severity = "warn"

[[constraint]]
rule = "services.evidence_graph.environment contains 'SECRET_KEY_BASE'"
severity = "error"

[[constraint]]
rule = "container.base_image uses chainguard or distroless"
severity = "warn"

[[constraint]]
rule = "workflows includes hypatia-scan"
severity = "error"

[[constraint]]
rule = "deno.imports has no npm: specifiers"
severity = "error"