refactor: move internal packages to internal/ directory

.golangci.yaml

@@ -61,7 +61,7 @@ linters:
               reason: "`aquasecurity/go-version` is designed for our use-cases"
           - github.com/liamg/memoryfs:
               recommendations:
-                - github.com/aquasecurity/trivy/pkg/mapfs
+                - github.com/aquasecurity/trivy/internal/mapfs
     gosec:
       excludes:
         - G101
@@ -162,7 +162,7 @@ linters:
   exclusions:
     generated: lax
     paths:
-      - "pkg/iac/scanners/terraform/parser/funcs" # copies of Terraform functions
+      - "internal/iac/scanners/terraform/parser/funcs" # copies of Terraform functions
     rules:
       - path: ".*_test.go$"
         linters:

integration/integration_test.go

@@ -27,14 +27,14 @@ import (
 	"github.com/xeipuuv/gojsonschema"
 
 	"github.com/aquasecurity/trivy-db/pkg/metadata"
+	"github.com/aquasecurity/trivy/internal/clock"
+	"github.com/aquasecurity/trivy/internal/db"
 	"github.com/aquasecurity/trivy/internal/dbtest"
 	"github.com/aquasecurity/trivy/internal/testutil"
-	"github.com/aquasecurity/trivy/pkg/clock"
+	"github.com/aquasecurity/trivy/internal/uuid"
+	"github.com/aquasecurity/trivy/internal/vex/repo"
 	"github.com/aquasecurity/trivy/pkg/commands"
-	"github.com/aquasecurity/trivy/pkg/db"
 	"github.com/aquasecurity/trivy/pkg/types"
-	"github.com/aquasecurity/trivy/pkg/uuid"
-	"github.com/aquasecurity/trivy/pkg/vex/repo"
 
 	_ "modernc.org/sqlite"
 )

pkg/attestation/attestation_test.go → internal/attestation/attestation_test.go

@@ -9,7 +9,7 @@ import (
 	slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
 	"github.com/stretchr/testify/require"
 
-	"github.com/aquasecurity/trivy/pkg/attestation"
+	"github.com/aquasecurity/trivy/internal/attestation"
 )
 
 func TestStatement_UnmarshalJSON(t *testing.T) {

pkg/attestation/sbom/rekor.go → internal/attestation/sbom/rekor.go

@@ -10,9 +10,9 @@ import (
 	"github.com/samber/lo"
 	"golang.org/x/xerrors"
 
-	"github.com/aquasecurity/trivy/pkg/attestation"
+	"github.com/aquasecurity/trivy/internal/attestation"
+	"github.com/aquasecurity/trivy/internal/rekor"
 	"github.com/aquasecurity/trivy/pkg/log"
-	"github.com/aquasecurity/trivy/pkg/rekor"
 )
 
 var ErrNoSBOMAttestation = xerrors.New("no SBOM attestation found")

pkg/attestation/sbom/rekor_test.go → internal/attestation/sbom/rekor_test.go

@@ -6,9 +6,9 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/aquasecurity/trivy/pkg/attestation/sbom"
+	"github.com/aquasecurity/trivy/internal/attestation/sbom"
+	"github.com/aquasecurity/trivy/internal/rekortest"
 	"github.com/aquasecurity/trivy/pkg/log"
-	"github.com/aquasecurity/trivy/pkg/rekortest"
 )
 
 func TestRekor_RetrieveSBOM(t *testing.T) {

pkg/compliance/report/json.go → internal/compliance/report/json.go

@@ -6,6 +6,13 @@ import (
 	"io"
 
 	"golang.org/x/xerrors"
+
+	compliance "github.com/aquasecurity/trivy/pkg/compliance/types"
+)
+
+const (
+	allReport     = "all"
+	summaryReport = "summary"
 )
 
 type JSONWriter struct {
@@ -14,7 +21,7 @@ type JSONWriter struct {
 }
 
 // Write writes the results in JSON format
-func (jw JSONWriter) Write(report *ComplianceReport) error {
+func (jw JSONWriter) Write(report *compliance.Report) error {
 	var output []byte
 	var err error
 

pkg/compliance/report/json_test.go → internal/compliance/report/json_test.go

@@ -9,16 +9,17 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/aquasecurity/trivy/pkg/compliance/report"
+	"github.com/aquasecurity/trivy/internal/compliance/report"
+	compliance "github.com/aquasecurity/trivy/pkg/compliance/types"
 	"github.com/aquasecurity/trivy/pkg/types"
 )
 
 func TestJSONWriter_Write(t *testing.T) {
-	input := &report.ComplianceReport{
+	input := &compliance.Report{
 		ID:               "1234",
 		Title:            "NSA",
 		RelatedResources: []string{"https://example.com"},
-		Results: []*report.ControlCheckResult{
+		Results: []*compliance.ControlCheckResult{
 			{
 				ID:       "1.0",
 				Name:     "Non-root containers",
@@ -55,7 +56,7 @@ func TestJSONWriter_Write(t *testing.T) {
 	tests := []struct {
 		name       string
 		reportType string
-		input      *report.ComplianceReport
+		input      *compliance.Report
 		want       string
 	}{
 		{

internal/compliance/report/report.go

@@ -0,0 +1,40 @@
+package report
+
+import (
+	ctypes "github.com/aquasecurity/trivy/pkg/compliance/types"
+	iacTypes "github.com/aquasecurity/trivy/pkg/iac/types"
+	"github.com/aquasecurity/trivy/pkg/types"
+)
+
+// BuildComplianceReportResults create compliance results data
+func BuildComplianceReportResults(checksMap map[string]types.Results, s iacTypes.Spec) *ctypes.Report {
+	controlCheckResult := buildControlCheckResults(checksMap, s.Controls)
+	return &ctypes.Report{
+		ID:               s.ID,
+		Title:            s.Title,
+		Description:      s.Description,
+		Version:          s.Version,
+		RelatedResources: s.RelatedResources,
+		Results:          controlCheckResult,
+	}
+}
+
+// buildControlCheckResults create compliance results data
+func buildControlCheckResults(checksMap map[string]types.Results, controls []iacTypes.Control) []*ctypes.ControlCheckResult {
+	var complianceResults []*ctypes.ControlCheckResult
+	for _, control := range controls {
+		var results types.Results
+		for _, c := range control.Checks {
+			results = append(results, checksMap[c.ID]...)
+		}
+		complianceResults = append(complianceResults, &ctypes.ControlCheckResult{
+			Name:          control.Name,
+			ID:            control.ID,
+			Description:   control.Description,
+			Severity:      string(control.Severity),
+			DefaultStatus: control.DefaultStatus,
+			Results:       results,
+		})
+	}
+	return complianceResults
+}

pkg/compliance/report/report_test.go → internal/compliance/report/report_test.go

@@ -8,8 +8,8 @@ import (
 
 	dbTypes "github.com/aquasecurity/trivy-db/pkg/types"
 	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/vulnerability"
-	"github.com/aquasecurity/trivy/pkg/compliance/report"
-	"github.com/aquasecurity/trivy/pkg/compliance/spec"
+	cm "github.com/aquasecurity/trivy/pkg/compliance"
+	compliance "github.com/aquasecurity/trivy/pkg/compliance/types"
 	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
 	iacTypes "github.com/aquasecurity/trivy/pkg/iac/types"
 	"github.com/aquasecurity/trivy/pkg/types"
@@ -18,12 +18,12 @@ import (
 func TestBuildComplianceReport(t *testing.T) {
 	type args struct {
 		scanResults []types.Results
-		cs          spec.ComplianceSpec
+		cs          compliance.Spec
 	}
 	tests := []struct {
 		name    string
 		args    args
-		want    *report.ComplianceReport
+		want    *compliance.Report
 		wantErr assert.ErrorAssertionFunc
 	}{
 		{
@@ -96,7 +96,7 @@ func TestBuildComplianceReport(t *testing.T) {
 						},
 					},
 				},
-				cs: spec.ComplianceSpec{
+				cs: compliance.Spec{
 					Spec: iacTypes.Spec{
 						ID:          "1234",
 						Title:       "NSA",
@@ -137,15 +137,15 @@ func TestBuildComplianceReport(t *testing.T) {
 					},
 				},
 			},
-			want: &report.ComplianceReport{
+			want: &compliance.Report{
 				ID:          "1234",
 				Title:       "NSA",
 				Description: "National Security Agency - Kubernetes Hardening Guidance",
 				Version:     "1.0",
 				RelatedResources: []string{
 					"https://example.com",
 				},
-				Results: []*report.ControlCheckResult{
+				Results: []*compliance.ControlCheckResult{
 					{
 						ID:          "1.0",
 						Name:        "Non-root containers",
@@ -231,7 +231,7 @@ func TestBuildComplianceReport(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := report.BuildComplianceReport(tt.args.scanResults, tt.args.cs)
+			got, err := cm.BuildReport(tt.args.scanResults, tt.args.cs)
 			if !tt.wantErr(t, err, fmt.Sprintf("BuildComplianceReport(%v, %v)", tt.args.scanResults, tt.args.cs)) {
 				return
 			}

pkg/compliance/report/summary.go → internal/compliance/report/summary.go

@@ -10,12 +10,13 @@ import (
 	"golang.org/x/xerrors"
 
 	"github.com/aquasecurity/table"
+	compliance "github.com/aquasecurity/trivy/pkg/compliance/types"
 )
 
-func BuildSummary(cr *ComplianceReport) *SummaryReport {
-	var ccma []ControlCheckSummary
+func BuildSummary(cr *compliance.Report) *compliance.SummaryReport {
+	var ccma []compliance.ControlCheckSummary
 	for _, control := range cr.Results {
-		ccm := ControlCheckSummary{
+		ccm := compliance.ControlCheckSummary{
 			ID:       control.ID,
 			Name:     control.Name,
 			Severity: control.Severity,
@@ -25,7 +26,7 @@ func BuildSummary(cr *ComplianceReport) *SummaryReport {
 		}
 		ccma = append(ccma, ccm)
 	}
-	return &SummaryReport{
+	return &compliance.SummaryReport{
 		ID:              cr.ID,
 		Title:           cr.Title,
 		SummaryControls: ccma,
@@ -43,7 +44,7 @@ func NewSummaryWriter(output io.Writer) SummaryWriter {
 }
 
 // Write writes the results in a summarized table format
-func (s SummaryWriter) Write(report *ComplianceReport) error {
+func (s SummaryWriter) Write(report *compliance.Report) error {
 	if _, err := fmt.Fprintln(s.Output); err != nil {
 		return xerrors.Errorf("failed to write summary report: %w", err)
 	}
@@ -76,7 +77,7 @@ func (s SummaryWriter) columns() []string {
 	}
 }
 
-func (s SummaryWriter) generateSummary(summaryControls ControlCheckSummary) []string {
+func (s SummaryWriter) generateSummary(summaryControls compliance.ControlCheckSummary) []string {
 	// "-" means manual checks
 	numOfIssues := "-"
 	status := "-"

pkg/compliance/report/summary_test.go → internal/compliance/report/summary_test.go

@@ -6,25 +6,26 @@ import (
 	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
 
-	"github.com/aquasecurity/trivy/pkg/compliance/report"
+	"github.com/aquasecurity/trivy/internal/compliance/report"
+	compliance "github.com/aquasecurity/trivy/pkg/compliance/types"
 	"github.com/aquasecurity/trivy/pkg/types"
 )
 
 func TestBuildSummary(t *testing.T) {
 	tests := []struct {
 		name       string
 		reportType string
-		input      *report.ComplianceReport
-		want       *report.SummaryReport
+		input      *compliance.Report
+		want       *compliance.SummaryReport
 	}{
 		{
 			name:       "build report summary config only",
 			reportType: "summary",
-			input: &report.ComplianceReport{
+			input: &compliance.Report{
 				ID:               "1234",
 				Title:            "NSA",
 				RelatedResources: []string{"https://example.com"},
-				Results: []*report.ControlCheckResult{
+				Results: []*compliance.ControlCheckResult{
 					{
 						ID:       "1.0",
 						Name:     "Non-root containers",
@@ -57,11 +58,11 @@ func TestBuildSummary(t *testing.T) {
 					},
 				},
 			},
-			want: &report.SummaryReport{
+			want: &compliance.SummaryReport{
 				SchemaVersion: 0,
 				ID:            "1234",
 				Title:         "NSA",
-				SummaryControls: []report.ControlCheckSummary{
+				SummaryControls: []compliance.ControlCheckSummary{
 					{
 						ID:        "1.0",
 						Name:      "Non-root containers",
@@ -80,11 +81,11 @@ func TestBuildSummary(t *testing.T) {
 		{
 			name:       "build full json output report",
 			reportType: "all",
-			input: &report.ComplianceReport{
+			input: &compliance.Report{
 				ID:               "1234",
 				Title:            "NSA",
 				RelatedResources: []string{"https://example.com"},
-				Results: []*report.ControlCheckResult{
+				Results: []*compliance.ControlCheckResult{
 					{
 						ID:       "1.0",
 						Name:     "Non-root containers",
@@ -130,11 +131,11 @@ func TestBuildSummary(t *testing.T) {
 					},
 				},
 			},
-			want: &report.SummaryReport{
+			want: &compliance.SummaryReport{
 				SchemaVersion: 0,
 				ID:            "1234",
 				Title:         "NSA",
-				SummaryControls: []report.ControlCheckSummary{
+				SummaryControls: []compliance.ControlCheckSummary{
 					{
 						ID:        "1.0",
 						Name:      "Non-root containers",

pkg/compliance/report/table.go → internal/compliance/report/table.go

@@ -7,6 +7,7 @@ import (
 	"golang.org/x/xerrors"
 
 	dbTypes "github.com/aquasecurity/trivy-db/pkg/types"
+	compliance "github.com/aquasecurity/trivy/pkg/compliance/types"
 	pkgReport "github.com/aquasecurity/trivy/pkg/report/table"
 	"github.com/aquasecurity/trivy/pkg/types"
 )
@@ -26,7 +27,7 @@ const (
 	IssuesColumn      = "Issues"
 )
 
-func (tw TableWriter) Write(ctx context.Context, report *ComplianceReport) error {
+func (tw TableWriter) Write(ctx context.Context, report *compliance.Report) error {
 	switch tw.Report {
 	case allReport:
 		t := pkgReport.NewWriter(pkgReport.Options{

pkg/compliance/report/table_test.go → internal/compliance/report/table_test.go

@@ -9,7 +9,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/aquasecurity/trivy/pkg/compliance/report"
+	"github.com/aquasecurity/trivy/internal/compliance/report"
+	compliance "github.com/aquasecurity/trivy/pkg/compliance/types"
 	"github.com/aquasecurity/trivy/pkg/types"
 )
 
@@ -18,17 +19,17 @@ func TestTableWriter_Write(t *testing.T) {
 	tests := []struct {
 		name       string
 		reportType string
-		input      *report.ComplianceReport
+		input      *compliance.Report
 		want       string
 	}{
 		{
 			name:       "build summary table",
 			reportType: "summary",
-			input: &report.ComplianceReport{
+			input: &compliance.Report{
 				ID:               "1234",
 				Title:            "NSA",
 				RelatedResources: []string{"https://example.com"},
-				Results: []*report.ControlCheckResult{
+				Results: []*compliance.ControlCheckResult{
 					{
 						ID:       "1.0",
 						Name:     "Non-root containers",