secgate/docs/config.schema.json at main · Stelnyx/secgate · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://github.com/Stelnyx/SecGate/raw/main/docs/config.schema.json",
  "title": "SecGate config",
  "description": "Configuration for .secgate.config.json — place in the scan target directory.",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "failOn": {
      "type": "array",
      "description": "Severity tiers that cause SecGate to exit 1. Default: [\"critical\",\"high\"].",
      "items": {
        "type": "string",
        "enum": ["critical", "high", "medium", "low", "unknown"]
      },
      "default": ["critical", "high"],
      "examples": [["critical"], ["critical", "high", "medium"]]
    },
    "profile": {
      "type": "string",
      "description": "HTML report confidence profile. 'curated' (default) demotes known-noisy patterns (Trivy license findings, base-image OS CVEs at LOW/MEDIUM, CVEs >5 years old, UNKNOWN severity, HTML SRI on inline scripts) to a collapsed Informational block. 'strict' renders every finding inline with no demotion. Findings are never dropped — only re-classified for display ordering. Profile selection does NOT affect the exit code; the failOn policy alone gates CI.",
      "enum": ["curated", "strict"],
      "default": "curated"
    },
    "scanners": {
      "type": "object",
      "description": "Enable or disable individual scanners. Set a key to false to skip that scanner entirely.",
      "additionalProperties": false,
      "properties": {
        "semgrep":  { "type": "boolean", "default": true },
        "gitleaks": { "type": "boolean", "default": true },
        "npm":      { "type": "boolean", "default": true },
        "osv":      { "type": "boolean", "default": true },
        "trivy":    { "type": "boolean", "default": true }
      }
    },
    "severityOverrides": {
      "type": "array",
      "description": "Override the severity of findings whose signature matches a rule pattern. Patterns support literal strings and '*' wildcard. First match wins.",
      "items": {
        "type": "object",
        "required": ["rule", "severity"],
        "additionalProperties": false,
        "properties": {
          "rule": {
            "type": "string",
            "description": "Glob-style pattern matched against finding.signature. Use '*' as a wildcard."
          },
          "severity": {
            "type": "string",
            "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN"],
            "description": "Target severity (case-insensitive)."
          }
        }
      },
      "default": [],
      "examples": [
        [{ "rule": "npm-audit.lodash", "severity": "LOW" }],
        [{ "rule": "trivy-ID-*", "severity": "MEDIUM" }]
      ]
    },
    "ignore": {
      "type": "array",
      "description": "Signatures to drop entirely. Supports literal strings and '*' wildcard. Ignored findings are excluded from counters and the fail-gate.",
      "items": { "type": "string" },
      "default": [],
      "examples": [["CVE-2024-12345", "npm:some-package*"]]
    },
    "baselineFile": {
      "type": "string",
      "description": "Path to the baseline JSON file. Relative paths are resolved from the scan target. Default: .secgate-baseline.json.",
      "default": ".secgate-baseline.json"
    },
    "customSemgrepRules": {
      "type": ["string", "null"],
      "description": "Path to custom Semgrep rules directory or config file. Passed as --config=<path> in addition to --config=auto. Relative paths are resolved from the scan target.",
      "default": null,
      "examples": ["./rules/", ".semgrep/"]
    }
  }
}