Finding

A finding is a single instance of a matched audit query. These are what are loaded into collections or made available to remediation steps. They are available in the template as objects of flattened key/value pairs where the name is the named match from the audit and the value is the string from the file in that location.

Example

Let's say we have the following YAML file:

key: value
foo: bar
bar: baz

And we have the following audit:

(block_node
  (block_mapping
    (block_mapping_pair
      (flow_node) @key
      (flow_node) @value
    )
  )
)

If used as a collection named objects, the object would look like this:

collections:
  objects:
    - key: key
      value: value
    - key: foo
      value: bar
    - key: bar
      value: baz

objects becomes an array of findings. Each finding has the capture group names as keys (i.e., @key -> key) and the value from the file(s) as strings.

For remediation findings (i.e., spec.audit) it automatically iterates the findings and sets findings and $ to that object.

# Loop 1
finding: {key: key, value: value}

# Loop 2
finding: {key: foo, value: bar}

# Loop 3
finding: {key: bar, value: baz}