ParsePolicyInputFromFile parses a single flag value of the form "[ :] = [: ]". The optional " :" prefix scopes the input to a single policy (matched against its name or ref); without it the input is global. Because a policy ref may itself contain ":" but an input name
(raw string)
| 65 | // (a Windows drive letter like C:\data\... or a URL scheme like https://) is not |
| 66 | // mistaken for a column. |
| 67 | func ParsePolicyInputFromFile(raw string) (*PolicyInputFromFile, error) { |
| 68 | lhs, rhs, found := strings.Cut(raw, "=") |
| 69 | if !found { |
| 70 | return nil, fmt.Errorf("invalid --policy-input-from-file %q: expected [<policy>:]<input>=<file>[:<column>]", raw) |
| 71 | } |
| 72 | |
| 73 | // Split off the optional "<policy>:" scope prefix at the last ":": a policy |
| 74 | // ref may contain colons (scheme, digest) but the input name never does. |
| 75 | var policy, input string |
| 76 | if i := strings.LastIndex(lhs, scopeDelimiter); i >= 0 { |
| 77 | policy = strings.TrimSpace(lhs[:i]) |
| 78 | input = strings.TrimSpace(lhs[i+1:]) |
| 79 | if policy == "" { |
| 80 | return nil, fmt.Errorf("invalid --policy-input-from-file %q: missing policy scope before %q", raw, scopeDelimiter) |
| 81 | } |
| 82 | // A bare "<policy>@sha256:<digest>" (no input) would be mis-split into |
| 83 | // policy "<policy>@sha256" and input "<digest>"; reject it with guidance. |
| 84 | if strings.HasSuffix(policy, digestScheme) { |
| 85 | return nil, fmt.Errorf("invalid --policy-input-from-file %q: versioned policy scope is missing an input name; expected <policy>@sha256:<digest>:<input>=<file>", raw) |
| 86 | } |
| 87 | } else { |
| 88 | input = strings.TrimSpace(lhs) |
| 89 | } |
| 90 | |
| 91 | rhs = strings.TrimSpace(rhs) |
| 92 | if input == "" { |
| 93 | return nil, fmt.Errorf("invalid --policy-input-from-file %q: missing input name", raw) |
| 94 | } |
| 95 | if rhs == "" { |
| 96 | return nil, fmt.Errorf("invalid --policy-input-from-file %q: missing file path", raw) |
| 97 | } |
| 98 | |
| 99 | // Default the column to the input name; override it only when a ":<column>" |
| 100 | // suffix is present and unambiguously a column (no path separator). |
| 101 | file := rhs |
| 102 | column := input |
| 103 | if i := strings.LastIndex(rhs, ":"); i >= 0 { |
| 104 | if candidate := strings.TrimSpace(rhs[i+1:]); candidate != "" && !strings.ContainsAny(candidate, `/\`) { |
| 105 | file = strings.TrimSpace(rhs[:i]) |
| 106 | column = candidate |
| 107 | } |
| 108 | } |
| 109 | |
| 110 | if file == "" { |
| 111 | return nil, fmt.Errorf("invalid --policy-input-from-file %q: missing file path", raw) |
| 112 | } |
| 113 | |
| 114 | return &PolicyInputFromFile{Policy: policy, Input: input, Column: column, File: file}, nil |
| 115 | } |
| 116 | |
| 117 | // ExtractColumnValues reads the given CSV or JSON file and returns the values of |
| 118 | // the named column/field. Format is detected by extension, with a content-sniff |
no outgoing calls