Recertification Checking

The Recertification Checking module is a core component of the IaC Recertification Engine (ICE). Its primary responsibility is to analyze a list of scanned files and determine whether each file requires recertification based on its age and predefined configuration rules. This component acts as the decision-making heart of the engine, producing a list of results that detail which files have passed their recertification deadline, how overdue they are, and their assigned priority.

The checking process is initiated by the main Engine after files have been scanned and enriched with Git history. The results from the checker are then passed to the Grouping Strategy to bundle related files into pull requests.

Sources: internal/engine/engine.go:110-114, internal/scan/recert_checker.go

Core Logic and Flow

The recertification checking logic is encapsulated within the Checker struct and its Check method. The process iterates through each file, matches it against configured patterns, and performs the age calculation.

Sources: internal/scan/recert_checker.go:18-20

The following diagram illustrates the high-level workflow of the Check method.

Sources: internal/scan/recert_checker.go:23-130

File Matching

For each file, the checker determines the first Pattern that it matches.

1. The file's path is made relative to the repository root.
2. It iterates through the patterns defined in the configuration.
3. For each enabled pattern, it uses doublestar.PathMatch to check if the file's relative path matches any of the glob patterns in pattern.Paths.
4. If a match is found, it then checks against the pattern.Exclude list. If the file matches an exclusion glob, it is ignored for that pattern.
5. The first pattern that includes the file and does not exclude it is used for the check.

Sources: internal/scan/recert_checker.go:34-78

Recertification Calculation

Once a file is matched to a pattern, the checker calculates its recertification status.

• Days Since Last Modified: The number of days since the file was last modified is calculated as int(time.Since(file.LastModified).Hours() / 24).
• Threshold: The recertification period in days is retrieved from the matched pattern's RecertificationDays field.
• Needs Recertification: A boolean flag, NeedsRecert, is set to true if the days since last modification is greater than or equal to the threshold.

Sources: internal/scan/recert_checker.go:87-89

Priority Calculation

A key feature of the checker is to assign a priority to each file. This helps teams prioritize which recertifications to address first. The priority is calculated based on the ratio of how long it has been since the last modification (DaysSince) versus the configured Threshold.

The logic is as follows:

Note: The code contains a condition for Medium priority when NeedsRecert is true and the ratio is >= 0.8. However, this is superseded by the High and Critical conditions. The effective logic is represented in the table above.

Sources: internal/scan/recert_checker.go:91-107, internal/scan/recert_checker_test.go:20-120

The following diagram visualizes the priority assignment logic.

Sources: internal/scan/recert_checker.go:92-107

Data Structures

The checking process relies on several key data structures for its input and output.

Input: config.Pattern

This struct defines the rules for recertification. The checker primarily uses the fields listed below.

Sources: internal/config/types.go:41-49, example.config.yaml:23-44

Input: types.FileInfo

This struct contains the file metadata needed for the check.

Sources: internal/types/types.go:7-13

Output: types.RecertCheckResult

This is the primary output of the Check method. A slice of these structs is returned, with one entry for each file that matched a pattern.

Sources: internal/types/types.go:15-23, internal/scan/recert_checker.go:111-121

The relationship between these structures is shown below.

Sources: internal/config/types.go:41-49, internal/types/types.go:7-23