stig-gradle-plugin/com.stigway.gradle.tasks.analysis

Package-level declarations

Types

data class AnalysisAttemptEvidenceRoot(val taskPath: String, val directory: String, val archivePath: String, val fullModeOnly: Boolean = false, val includeNativeLibrarySnapshots: Boolean = false, val includeFinalAnalyzerBitcode: Boolean = false) : Serializable

Explicit artifact ownership; these are task output directories, never production source trees.

ElementTransformRules

data class ElementTransformRules(val projectPath: String, val rules: List<BitcodeTransformRule>)

P5MissingSymbolCandidate

data class P5MissingSymbolCandidate(val status: P5MissingSymbolCandidateStatus, val symbol: String, val mangledSymbol: String? = null, val sourceFile: String? = null, val reason: String, val effectiveRules: List<BitcodeTransformRule> = emptyList(), val ownerUnits: List<String> = emptyList(), val suggestions: List<SuggestedP5SymbolModel> = emptyList())

P5MissingSymbolCandidatesReport

data class P5MissingSymbolCandidatesReport(val schemaVersion: Int = 1, val entries: List<P5MissingSymbolCandidate>)

P5MissingSymbolCandidateStatus

enum P5MissingSymbolCandidateStatus : Enum<P5MissingSymbolCandidateStatus>

SoftwareSelectionMode

enum SoftwareSelectionMode : Enum<SoftwareSelectionMode>

StigAggregateAnalysisConfigurationEvidenceTask

@DisableCachingByDefault(because = "Aggregate verification task over activity-owned evidence outputs.")

abstract class StigAggregateAnalysisConfigurationEvidenceTask : DefaultTask

Creates one deterministic project review manifest from every initialized activity check.

StigAnalysisAttemptTracker

abstract class StigAnalysisAttemptTracker : BuildService<StigAnalysisAttemptTracker.Parameters> , OperationCompletionListener, AutoCloseable, StigTaskExecutionObserver

Gradle's completion events also cover cache hits and tasks which fail before their actions run.

StigAnalysisEvidenceArchiveOptionsTask

@DisableCachingByDefault(because = "Shared option base; concrete diagnostic tasks declare their cache policy.")

abstract class StigAnalysisEvidenceArchiveOptionsTask : DefaultTask

Shared, explicit export options for source-analysis review tasks.

StigAnalysisEvidenceInputTask

@DisableCachingByDefault(because = "Evidence tasks verify the current contents of explicitly selected archives and directories.")

abstract class StigAnalysisEvidenceInputTask : DefaultTask

Explicit evidence inputs shared by archive auditing and worksheet generation.

StigAnalysisEvidenceModule

data class StigAnalysisEvidenceModule(val projectPath: String, val projectDirectory: String, val outputDirectory: String, val diagnosticStatusPath: String) : Serializable

A configured source-analysis module; paths are captured while Gradle configures the project.

StigAnalysisP1BuildNativeTargetTask

@DisableCachingByDefault(because = "Runs Bazel build; caching belongs to Bazel.")

abstract class StigAnalysisP1BuildNativeTargetTask : DefaultTask, StigProblemProducerTask

Native-build authority for source-code analysis.

StigAnalysisP1ExtractNativeCompileCommandsTask

@CacheableTask

abstract class StigAnalysisP1ExtractNativeCompileCommandsTask : DefaultTask, StigProblemProducerTask

StigAnalysisP1PatchNativeSourcesTask

@DisableCachingByDefault(because = "Mutates source files in place; not safe for Gradle build cache.")

abstract class StigAnalysisP1PatchNativeSourcesTask : DefaultTask

Applies regex-based patches to source files in the user repo.

StigAnalysisP2ConvertCompileCommandsToLlvmTask

@CacheableTask

abstract class StigAnalysisP2ConvertCompileCommandsToLlvmTask : DefaultTask

Converts the complete P1 native compile database to one pinned LLVM-compatible database.

StigAnalysisP3SelectProvenanceCompileCommandsTask

@CacheableTask

abstract class StigAnalysisP3SelectProvenanceCompileCommandsTask : DefaultTask

Selects P3 provenance compile commands from the complete P2 LLVM-compatible compile database. This task never converts compiler flags and never appends harness, stub, or replacement sources.

StigAnalysisP4SelectSoftwareUnderAnalysisTask

@CacheableTask

abstract class StigAnalysisP4SelectSoftwareUnderAnalysisTask : DefaultTask

Selects real production compilation units whose implementations enter P5.

StigAnalysisP5ApplyBitcodeTransformsTask

@DisableCachingByDefault(because = "Validation gate over the cacheable P5 evidence producer.")

abstract class StigAnalysisP5ApplyBitcodeTransformsTask : DefaultTask

Public P5 validation gate over the separately retained transform-production evidence.

StigAnalysisP5DeriveInterfacePointsTask

@CacheableTask

abstract class StigAnalysisP5DeriveInterfacePointsTask : DefaultTask, StigProblemProducerTask

stigAnalysisP5DeriveInterfacePoints derives LLVM symbols for the element's interface points (sources, sinks, and entry points) from the final transformed P5 analyzer input.

StigAnalysisP5GenerateAnalyzerRunPlanTask

@CacheableTask

abstract class StigAnalysisP5GenerateAnalyzerRunPlanTask : DefaultTask, StigProblemProducerTask

Generates the v4 PhASAR run-plan: one aggregate cfg for every (analysisKind × sinkASIL) combination, flat in the task's output directory.

StigAnalysisP5SelectAnalyzerInputCompileCommandsTask

@CacheableTask

abstract class StigAnalysisP5SelectAnalyzerInputCompileCommandsTask : DefaultTask

Filters an already-transformed LLVM compile-commands JSON to keep only the compilation units listed in a text file (one path per line).

StigAnalysisP6RunAnalyzerTask

@CacheableTask

abstract class StigAnalysisP6RunAnalyzerTask : DefaultTask, StigProblemProducerTask

StigAnalysisP6SliceAnalyzerInputTask

@CacheableTask

abstract class StigAnalysisP6SliceAnalyzerInputTask : DefaultTask

StigAnalysisP7CollectDescriptionsTask

@DisableCachingByDefault(because = "Reads upstream source files; not audited for cache correctness.")

abstract class StigAnalysisP7CollectDescriptionsTask : DefaultTask

Extracts documented function descriptions from source comments and writes a report.

StigAnalysisP7CollectMetricsTask

@DisableCachingByDefault(because = "Runs external clang-tidy over upstream source files; not audited for cache correctness.")

abstract class StigAnalysisP7CollectMetricsTask : DefaultTask

Runs clang-tidy-based per-function complexity metric extraction and writes a metrics report.

StigAnalysisP7GenerateAppliedTransformationsTask

@CacheableTask

abstract class StigAnalysisP7GenerateAppliedTransformationsTask : DefaultTask

StigAnalysisP7GenerateDiagramsTask

@CacheableTask

abstract class StigAnalysisP7GenerateDiagramsTask : DefaultTask, StigProblemProducerTask

Direct P7 diagram producer. Walks the analyzer output directory, loads each *.analysis.json into a PipelineGraph, enriches, transforms, and lays out the graph, then emits any combination of SVG / Cytoscape / Sigma files gated by diagramOutputsSvg / diagramOutputsCytoscape / diagramOutputsSigma.

StigAnalysisP7SelectSourceCompileCommandsTask

@CacheableTask

abstract class StigAnalysisP7SelectSourceCompileCommandsTask : DefaultTask, StigProblemProducerTask

StigAnalyzerStartWith

enum StigAnalyzerStartWith : Enum<StigAnalyzerStartWith>

Omit --start-with for the normal pipeline. Earlier LLVM checkpoints are not executable inputs yet.

StigAuditAnalysisEvidenceTask

@DisableCachingByDefault(because = "Checks explicit captured evidence and always reports its current integrity.")

abstract class StigAuditAnalysisEvidenceTask : StigAnalysisEvidenceInputTask

Audits captured evidence only; no dependency may select a product analysis or native tool build.

StigBeginAnalysisAttemptTask

@DisableCachingByDefault(because = "Starts invocation-scoped analysis evidence collection.")

abstract class StigBeginAnalysisAttemptTask : DefaultTask

StigBeginProjectAnalysisCheckTask

@DisableCachingByDefault(because = "Starts invocation-scoped analysis build logging.")

abstract class StigBeginProjectAnalysisCheckTask : DefaultTask

StigCheckAnalysisAggregateTask

@DisableCachingByDefault(because = "Aggregate lifecycle task; child collectors own the evidence outputs.")

abstract class StigCheckAnalysisAggregateTask : StigAnalysisEvidenceArchiveOptionsTask

StigCheckAnalysisTask

@DisableCachingByDefault(because = "Always-current diagnostic check with optional evidence export.")

abstract class StigCheckAnalysisTask : StigAnalysisEvidenceArchiveOptionsTask

Packages report gaps and the exact analyzer/LLVM/configuration evidence needed to review them.

StigCheckP5SymbolCompletenessAggregateTask

@DisableCachingByDefault(because = "Aggregate lifecycle task; activity checks own all outputs.")

abstract class StigCheckP5SymbolCompletenessAggregateTask : DefaultTask

Root lifecycle aggregate for every activity's P5 symbol-completeness gate.

StigCheckP5SymbolCompletenessTask

@DisableCachingByDefault(because = "Reads P5 diagnostics and always writes a current structured review.")

abstract class StigCheckP5SymbolCompletenessTask : DefaultTask, StigProblemProducerTask

Reports missing P5 implementations as HIGH findings while retaining provisional analysis capability.

StigClassifyP5MissingSymbolsTask

@CacheableTask

abstract class StigClassifyP5MissingSymbolsTask : DefaultTask

Writes inactive, review-only classifications for every unresolved application symbol.

StigCollectAnalysisConfigurationEvidenceTask

@DisableCachingByDefault(because = "Always-current diagnostic check with optional evidence export.")

abstract class StigCollectAnalysisConfigurationEvidenceTask : DefaultTask, StigProblemProducerTask

Produces retained configuration-chain evidence; public activity/root tasks apply the final failure policy.

StigCollectNativeSymbolProvidersTask

@DisableCachingByDefault(because = "Captures current native artifacts named by Bazel actions, including newly available files.")

abstract class StigCollectNativeSymbolProvidersTask : DefaultTask

Native outputs can change independently of the cached compilation-command inventory.

StigCompleteAnalysisAttemptTask

@DisableCachingByDefault(because = "Completion barrier for Gradle task outcome events.")

abstract class StigCompleteAnalysisAttemptTask : DefaultTask

StigConfirmFunctionRewriteRulesTask

@DisableCachingByDefault(because = "Explicit maintenance command updates the project registry in its root Gradle file.")

abstract class StigConfirmFunctionRewriteRulesTask : DefaultTask

Records the caller's completed semantic review; running this task does not perform that review.

StigDeriveAnalysisConfigurationTask

@CacheableTask

abstract class StigDeriveAnalysisConfigurationTask : DefaultTask

Derives configuration from the full LLVM ownership and configured analyzer-input inventories.

StigEvidenceReference

data class StigEvidenceReference(val path: String = "", val sha256: String = "", val mediaType: String = "application/json")

StigExtractAnalysisInterfaceInventoryTask

@CacheableTask

abstract class StigExtractAnalysisInterfaceInventoryTask : DefaultTask, StigProblemProducerTask

Scans one activity's compiled C++ topics into a renderer-neutral, cacheable inventory.

StigGenerateAnalysisHarnessTask

@CacheableTask

abstract class StigGenerateAnalysisHarnessTask : DefaultTask, StigProblemProducerTask

Renders the lifecycle harness as a normal cacheable analysis-pipeline output.

StigGenerateArchivedAnalysisReviewTask

@DisableCachingByDefault(because = "Verifies immutable evidence and preserves editable assessments outside task outputs.")

abstract class StigGenerateArchivedAnalysisReviewTask : StigAnalysisEvidenceInputTask

Reviews immutable archives or local evidence without selecting analysis producers.

StigLockAnalysisWorkspaceTask

@DisableCachingByDefault(because = "Every invocation must acquire its own process lock")

abstract class StigLockAnalysisWorkspaceTask : DefaultTask

Acquires the process lock before Gradle checks or restores downstream analysis outputs.

StigP5BodyRuleAccounting

data class StigP5BodyRuleAccounting(val configuredFinalBodyRuleCount: Int = 0, val p3MatchedFinalBodyRuleCount: Int = 0, val p5InputMatchedFinalBodyRuleCount: Int = 0, val finalP5SurvivingRewrittenDefinitionRuleCount: Int = 0, val eliminatedAfterP5OptimizationRuleCount: Int = 0, val accountedP3MatchedFinalBodyRuleCount: Int = 0, val accountedP5InputMatchedFinalBodyRuleCount: Int = 0)

StigP5SymbolCompletenessReview

data class StigP5SymbolCompletenessReview(val schemaId: String = P5_SYMBOL_COMPLETENESS_REVIEW_SCHEMA, val schemaVersion: Int = 1, val producer: StigReviewProducer = StigReviewProducer(), val producingTask: String = "", val activityProjectPath: String = "", val status: StigP5SymbolCompletenessStatus = StigP5SymbolCompletenessStatus.ACTION_REQUIRED, val summary: StigP5SymbolCompletenessSummary = StigP5SymbolCompletenessSummary(), val repositoryRoots: Map<String, String> = emptyMap(), val evidence: List<StigEvidenceReference> = emptyList(), val diagnoses: List<StigP5SymbolDiagnosis> = emptyList())

StigP5SymbolCompletenessStatus

enum StigP5SymbolCompletenessStatus : Enum<StigP5SymbolCompletenessStatus>

StigP5SymbolCompletenessSummary

data class StigP5SymbolCompletenessSummary(val unresolvedApplicationSymbols: Int = 0, val allowedExternalSymbols: Int = 0, val notConfigured: Int = 0, val configuredNotUsed: Int = 0, val configuredAndUsedButUnresolved: Int = 0)

StigP5SymbolDiagnosis

data class StigP5SymbolDiagnosis(val symbol: String = "", val mangledSymbol: String? = null, val sourcePath: String? = null, val unresolvedReason: String = "", val configurationState: String = "", val matchingTransformIdentity: String? = null, val meaning: String = "", val requiredAction: String = "")

StigPatchSpec

data class StigPatchSpec(val file: File, val find: String, val replace: String, val regex: Boolean = true, val skipIfContains: String? = null, val required: Boolean = true, val description: String? = null, val replaceFromFile: File? = null)

Specification for a single source-code patch.

StigPrepareAnalysisTransformConfigurationTask

@CacheableTask

abstract class StigPrepareAnalysisTransformConfigurationTask : DefaultTask

Materializes the complete resolved rules for consumers that validate review state incrementally.

StigPrepareTransformReviewEvidenceTask

@CacheableTask

abstract class StigPrepareTransformReviewEvidenceTask : DefaultTask

Evidence shared by the configuration collector and P6; contains no authored review state.

StigReplayArchivedAnalyzerRunTask

@DisableCachingByDefault(because = "Diagnostic replay always executes and writes analyzer evidence outside the archive.")

abstract class StigReplayArchivedAnalyzerRunTask : DefaultTask

Replays one analyzer run from an extracted stigCheckAnalysis evidence archive.

StigReviewProducer

data class StigReviewProducer(val name: String = "STIG", val version: String = "")

StigSelectConfiguredAnalyzerInputCompileCommandsTask

@CacheableTask

abstract class StigSelectConfiguredAnalyzerInputCompileCommandsTask : StigAnalysisP5SelectAnalyzerInputCompileCommandsTask

Exact task type for the maintenance-only configured analyzer-input selection.

StigSourceCodeAnalysisActionCode

enum StigSourceCodeAnalysisActionCode : Enum<StigSourceCodeAnalysisActionCode>

StigSourceCodeAnalysisActionRecord

data class StigSourceCodeAnalysisActionRecord(val actionCode: StigSourceCodeAnalysisActionCode = StigSourceCodeAnalysisActionCode.SEMANTIC_REVIEW_REQUIRED, val symbol: String = "", val exactSignatures: List<String> = emptyList(), val llvmSymbols: List<String> = emptyList(), val ownerCompileUnits: List<String> = emptyList(), val ownerRepositories: List<String> = emptyList(), val ownerSourceLocations: List<String> = emptyList(), val requiredBySources: List<String> = emptyList(), val callingFunctions: List<String> = emptyList(), val currentRule: BitcodeTransformRule? = null, val llvmCandidateRule: BitcodeTransformRule? = null, val derivedBehavior: String = "", val reason: String = "", val llvmFacts: List<String> = emptyList(), val endpointMappings: List<String> = emptyList(), val requiredCorrection: String? = null)

StigSourceCodeAnalysisActivitySummary

data class StigSourceCodeAnalysisActivitySummary(val projectPath: String = "", val directory: String = "", val nativeTarget: String = "", val status: StigSourceCodeAnalysisReviewStatus = StigSourceCodeAnalysisReviewStatus.ACTION_REQUIRED, val actionCodes: List<StigSourceCodeAnalysisActionCode> = emptyList(), val problems: StigSourceCodeAnalysisProblemCounts = StigSourceCodeAnalysisProblemCounts(), val evidence: List<StigEvidenceReference> = emptyList())

StigSourceCodeAnalysisProblemCounts

data class StigSourceCodeAnalysisProblemCounts(val critical: Int = 0, val high: Int = 0, val moderate: Int = 0, val low: Int = 0)

StigSourceCodeAnalysisProjectAction

data class StigSourceCodeAnalysisProjectAction(val activityProjectPath: String = "", val action: StigSourceCodeAnalysisActionRecord = StigSourceCodeAnalysisActionRecord())

StigSourceCodeAnalysisProjectReview

data class StigSourceCodeAnalysisProjectReview(val schemaId: String = SOURCE_ANALYSIS_PROJECT_REVIEW_SCHEMA, val schemaVersion: Int = SOURCE_ANALYSIS_REVIEW_SCHEMA_VERSION, val producer: StigReviewProducer = StigReviewProducer(), val producingTask: String = "stigCheckAnalysis", val project: StigSourceCodeAnalysisRootProject = StigSourceCodeAnalysisRootProject(), val status: StigSourceCodeAnalysisReviewStatus = StigSourceCodeAnalysisReviewStatus.ACTION_REQUIRED, val actionCodes: List<StigSourceCodeAnalysisActionCode> = emptyList(), val summary: StigSourceCodeAnalysisProjectSummary = StigSourceCodeAnalysisProjectSummary(), val evidence: List<StigEvidenceReference> = emptyList(), val activities: List<StigSourceCodeAnalysisActivitySummary> = emptyList(), val transforms: List<StigSourceCodeAnalysisSharedTransformReview> = emptyList(), val sourceModelActions: List<StigSourceCodeAnalysisProjectAction> = emptyList())

Stable root-project entry point consumed by the installed $stig:source-analysis skill.

StigSourceCodeAnalysisProjectSummary

data class StigSourceCodeAnalysisProjectSummary(val activityCount: Int = 0, val transformIdentityCount: Int = 0, val transformUseCount: Int = 0, val transformUseActionCount: Int = 0, val sourceModelActionCount: Int = 0, val problems: StigSourceCodeAnalysisProblemCounts = StigSourceCodeAnalysisProblemCounts())

StigSourceCodeAnalysisReviewReport

data class StigSourceCodeAnalysisReviewReport(val schemaId: String = SOURCE_ANALYSIS_ACTIVITY_REVIEW_SCHEMA, val schemaVersion: Int = SOURCE_ANALYSIS_REVIEW_SCHEMA_VERSION, val producer: StigReviewProducer = StigReviewProducer(), val producingTask: String = "", val elementProjectPath: String = "", val elementDirectory: String = "", val nativeTarget: String = "", val status: StigSourceCodeAnalysisReviewStatus = StigSourceCodeAnalysisReviewStatus.ACTION_REQUIRED, val actionCodes: List<StigSourceCodeAnalysisActionCode> = emptyList(), val problems: StigSourceCodeAnalysisProblemCounts = StigSourceCodeAnalysisProblemCounts(), val contradictions: List<String> = emptyList(), val activityUseSelectors: List<String>? = null, val p5BodyRuleAccounting: StigP5BodyRuleAccounting? = null, val evidence: List<StigEvidenceReference> = emptyList(), val actionItems: List<StigSourceCodeAnalysisActionRecord> = emptyList(), val transformReviews: List<StigSourceCodeAnalysisTransformReviewRecord> = emptyList())

Machine-readable activity result consumed by the root project review task.

StigSourceCodeAnalysisReviewStatus

enum StigSourceCodeAnalysisReviewStatus : Enum<StigSourceCodeAnalysisReviewStatus>

StigSourceCodeAnalysisRootProject

data class StigSourceCodeAnalysisRootProject(val name: String = "", val path: String = ":")

StigSourceCodeAnalysisSharedSemantics

data class StigSourceCodeAnalysisSharedSemantics(val kind: String = "", val rule: BitcodeTransformRule? = null)

StigSourceCodeAnalysisSharedTransformReview

data class StigSourceCodeAnalysisSharedTransformReview(val identity: String = "", val reviewStatus: BitcodeTransformReviewStatus = BitcodeTransformReviewStatus.NEW, val semanticsConsistentAcrossActivities: Boolean = true, val observedSemantics: List<StigSourceCodeAnalysisSharedSemantics> = emptyList(), val actionCodes: List<StigSourceCodeAnalysisActionCode> = emptyList(), val uses: List<StigSourceCodeAnalysisTransformUse> = emptyList())

StigSourceCodeAnalysisTransformReviewRecord

data class StigSourceCodeAnalysisTransformReviewRecord(val identity: String = "", val kind: String = "", val rule: BitcodeTransformRule? = null, val exactMatchedSymbols: List<String> = emptyList(), val p5InputMatchedSymbols: List<String>? = null, val ownerEvidence: List<String> = emptyList(), val llvmDerivedBehavior: String = "", val reviewStatus: BitcodeTransformReviewStatus = BitcodeTransformReviewStatus.NEW, val p5Validation: String = "NOT_RUN", val p5ValidationEvidence: List<String> = emptyList(), val p5ExactPostRewriteDefinitionSymbols: List<String>? = null, val p5FinalBodyState: String? = null, val actionCodes: List<StigSourceCodeAnalysisActionCode> = emptyList(), val originalSymbols: List<StigTransformOriginalSymbol> = emptyList())

StigSourceCodeAnalysisTransformUse

data class StigSourceCodeAnalysisTransformUse(val activityProjectPath: String = "", val exactMatchedSymbols: List<String> = emptyList(), val ownerCompilationUnits: List<String> = emptyList(), val p5Validation: String = "NOT_RUN", val p5ValidationEvidence: List<String> = emptyList(), val actionCodes: List<StigSourceCodeAnalysisActionCode> = emptyList(), val activityReview: StigEvidenceReference = StigEvidenceReference())

StigSyncAnalysisEvidenceRepositoriesTask

@DisableCachingByDefault(because = "Explicit networked Git synchronization mutates sibling and parent repositories.")

abstract class StigSyncAnalysisEvidenceRepositoriesTask : DefaultTask

StigTransformOriginalSymbol

data class StigTransformOriginalSymbol(val symbol: String, val state: String, val definitionSymbol: String? = null)

Original LLVM definition coverage, including resolved function aliases.

SuggestedP5SymbolModel

data class SuggestedP5SymbolModel(val projectPath: String, val rule: BitcodeTransformRule)