theaniketraj/scan

Purpose and Entry Points

SCAN is a Kotlin/JVM Gradle plugin for detecting secrets in project files and optionally failing builds. Consumers apply the published Gradle plugin and run its scan task; plugin metadata is registered at src/main/resources/META-INF/gradle-plugins/com.scan.properties. The root implementation is under src/main/kotlin/com/scan/plugin/ScanPlugin.kt; a separate sample/functional plugin module exists at plugin/src/main/kotlin/org/example/ScanPlugin.kt.

Gradle Integration Boundary

ScanPlugin installs the scan extension and scan task into a target Gradle build. ScanExtension exposes build-facing configuration, while ScanTask orchestrates execution and determines build failure behavior. Core paths: src/main/kotlin/com/scan/plugin/ScanPlugin.kt, src/main/kotlin/com/scan/plugin/ScanExtension.kt, src/main/kotlin/com/scan/plugin/ScanTask.kt.

Scan Orchestration and Domain Model

The engine receives a ScanConfiguration and scan context, coordinates file scanning, and returns structured findings/results rather than Gradle-specific objects. This separates reusable detection logic from task lifecycle concerns. Core paths: src/main/kotlin/com/scan/core/ScanEngine.kt, src/main/kotlin/com/scan/core/FileScanner.kt, src/main/kotlin/com/scan/core/ScanResult.kt.

File Selection and Filtering

Before content analysis, filters constrain scan scope by extension, path, test-file status, and whitelisted content. This is the primary noise/performance boundary between repository files and detection stages. Core paths: src/main/kotlin/com/scan/filters/FilterInterface.kt, src/main/kotlin/com/scan/filters/PathFilter.kt, src/main/kotlin/com/scan/filters/WhitelistFilter.kt.

Multi-Strategy Detection

Eligible file content is evaluated through composable detectors: regex/pattern matching, entropy analysis, and context-aware classification. Findings carry secret type, severity, confidence, validation state, and location-oriented result data. Core paths: src/main/kotlin/com/scan/detectors/CompositeDetector.kt, src/main/kotlin/com/scan/detectors/PatternDetector.kt, src/main/kotlin/com/scan/detectors/EntropyDetector.kt.

Pattern and Configuration Inputs

Built-in secret definitions are packaged as YAML resources; category classes represent API, crypto, database, and general secret patterns. Configuration loading supports repository-specific scan settings and custom patterns, with examples under config-examples/. Core paths: src/main/resources/patterns/default-patterns.yml, src/main/kotlin/com/scan/utils/ConfigurationLoader.kt, config-examples/scan-config.yml.

Reporting and External Integrations

Results flow into a reporting abstraction with console, JSON, HTML, and SARIF emitters. SARIF is the boundary for code-scanning consumers; a GitHub integration component supports GitHub Code Scanning workflows. Core paths: src/main/kotlin/com/scan/reporting/ReportGenerator.kt, src/main/kotlin/com/scan/reporting/SarifReporter.kt, src/main/kotlin/com/scan/integration/GitHubCodeScanning.kt.

Runtime, Delivery, and Documentation Site

The scanner runs in the Gradle/Kotlin JVM ecosystem and is built from the multi-project Gradle setup in settings.gradle.kts and build.gradle.kts. GitHub Actions provide CI and Pages deployment. The independent landing/ Next.js/TypeScript application publishes product and documentation content, not scanner execution. Core paths: .github/workflows/ci.yml, .github/workflows/pages.yml, landing/app/page.tsx.