feat: add experimental support for updating config files - #2534

Open

G-Rath wants to merge 46 commits into

google:mainfrom

ackama:support-updating-configs

Commits on Jun 17, 2026

feat: implement ability to ignore vulns in config
G-Rath
committed
924f4c0
test: write some tests
G-Rath
committed
5e3bb40
feat: implement experimental flag
G-Rath
committed
0766c5e
test: add some cmd cases
G-Rath
committed
443c75c
fix: update ignores before doing filtering
G-Rath
committed
827087b
fix: deduplicate ignores
G-Rath
committed
45ff086
fix: return errors
G-Rath
committed
e5a5891
fix: remove indenting
G-Rath
committed
5da88e9
refactor: rename flag
G-Rath
committed
415bd4f
fix: ensure vulns are sorted by ID
G-Rath
committed
3e3a7df
refactor: make `copyFile` public (internally)
G-Rath
committed
3d423b4
test: add a case with a custom global config
G-Rath
committed
3ae74bd
fix: account for multiple files using the same config
G-Rath
committed
4340360
test: use `os.CopyFS`
G-Rath
committed
b472f2b
fix: skip the default config and add nil check
G-Rath
committed
8a6cf7e
refactor: simplify "update configs" implementation (somewhat)
G-Rath
committed
7a76ced
test: update names
G-Rath
committed
43ba19b
test: add case for global config + recursive
G-Rath
committed
9162350
test: add more cases for "with no config"
G-Rath
committed
73a85bd
test: merge groups
G-Rath
committed
5527553
test: use cassettes and update snapshots
G-Rath
committed
c67455f
test: use vertical output instead
G-Rath
committed
a465f22
feat: switch to using a string flag
G-Rath
committed
b9d3790
feat: implement support for removing unused ignores
G-Rath
committed
a03aab2
refactor: merge `unused-config.toml` and `custom-config.toml`
G-Rath
committed
8a72743
test: add a config case with a package override
G-Rath
committed
f5636b8
chore: add todos
G-Rath
committed
423103a
refactor(config): split ignoring and saving
G-Rath
committed
840c3f3
refactor: clean up functions a bit more
G-Rath
committed
dabe5eb
refactor: stick with saving as config map is not holding pointers
G-Rath
committed
cc2c376
chore: update cassettes
G-Rath
committed
0e719b6
docs: add a page
G-Rath
committed
52d8639
perf: optimize slice filtering
G-Rath
committed
dbb1a0b
fix: store configs by reference
G-Rath
committed
fd8d1b0
feat: print the number of removed unused ignore entries
G-Rath
committed
3ca2cb3
feat: print the actual ignore entries that were removed
G-Rath
committed
03d6d54
fix: don't record configs that had no ignores removed
G-Rath
committed
05b14dc
feat: print when config ignores have been updated
G-Rath
committed
d207c3c
refactor: deduplicate "reporting on unused ignore action"
G-Rath
committed
4db71ef
refactor: deduplicate the whole "unused ignore entries" section
G-Rath
committed
7851113
refactor: deduplicate for when we're ignoring all entries too
G-Rath
committed
fd1744d
fix: omit empty fields from package overrides
G-Rath
committed
097b8cc
fix: omit ignored vulns and package overrides entirely if empty
G-Rath
committed
e7d5c43
fix: reorder top level `Config` fields
G-Rath
committed
917a41e
feat: don't filter when ignoring all vulns
G-Rath
committed
b1aaffb
test: update snapshots and cassettes
G-Rath
committed
be56aee