Module adapter 

Per-analyzer adapters: native analyzer output in, a NormalizedReport out.

An adapter is the only analyzer-specific code in this crate. It knows one tool’s native JSON, how to name that tool’s findings so they are recognisable across runs, and which argv produces that JSON. Everything downstream — the validation, the identity keys, the ordering, the store — is shared.

Why this is the seam, and not the runner

ADR-0012 requires that “a finding is the same artifact whether it was produced locally in a sandbox or ingested from a CI report”. The cheap way to satisfy that is to write the conversion twice and add a test comparing the two. This crate does the other thing: there is one conversion, and both paths call it. A subprocess run captures the analyzer’s stdout and hands those bytes to the adapter; roteiro security ingest reads a file of the same native bytes and hands them to the same adapter. Equality of the resulting Findings is therefore a property of the code, and the tests that assert it are guarding against a future refactor rather than establishing the invariant.

Adding an analyzer needs no migration

rto_graph::FindingKey is finding:<analyzer>:<that analyzer's own ordered identity components>. An adapter chooses the recipe; the schema never learns what the components mean. So a new analyzer is a new file in adapters/, an entry in ADAPTERS, and nothing else — no schema change, no migration.

@rto:0012 @rto:0014 @rto:0018

Modules

cargo_audit

cargo-audit — RustSec advisories against a resolved Cargo.lock.

osv_scanner

osv-scanner — OSV.dev advisories against resolved dependency manifests.

semgrep

semgrep — static analysis across the project’s languages.

Structs

AssetPaths

Verified local paths of an analyzer’s provisioned assets, keyed by asset id.

Invocation

How an analyzer is invoked as a child process.

NativeContext

Everything an adapter may need that is not in the analyzer’s own output.

Constants

NO_SNIPPET

Recorded in place of a snippet hash when the source could not be read — an ingested report about a tree this checkout does not have.

UNKNOWN_VERSION

Recorded as an analyzer’s version when neither the caller nor the report knows it — which is the ordinary case for a cargo audit report ingested from CI, since its JSON has no version field.

Statics

ADAPTERS

Every analyzer this build knows how to normalise.

Traits

Adapter

One analyzer’s native output format and invocation.

Functions

adapter_for

The adapter for analyzer, or None if this build has none.

known_analyzers

Every analyzer id this build can normalise, sorted — for error messages that tell a caller what it could have asked for.

snippet_hash

Short SHA-256 prefix of a snippet, used by identity recipes that need to notice that the code at a location changed even though the location did not.

snippet_hash_at

snippet_hash of what snippets holds for the span, or NO_SNIPPET.