Class ComplianceFindingsCollector

java.lang.Object
com.cloudforgeci.api.core.rules.ComplianceFindingsCollector
public final class ComplianceFindingsCollector extends Object
Thread-local side channel for framework-rule (FrameworkRules.install(T)) ADVISORY-mode findings -- see NagReportReader for cdk-nag's own equivalent, file-based mechanism.

Every FrameworkRules implementation's Node.addValidation callback returns an empty list in ComplianceMode.ADVISORY specifically so app.synth() doesn't throw -- that's the whole point of advisory mode not blocking synthesis. But an empty return also means the violation detail (until now, only ever written to a Logger.warning call) never reaches any caller as data. A caller that wants to actually show those findings to a user (an on-demand advisory compliance check, not a real deploy) has no other way to see them, since the Node.addValidation return value is the only channel back out of the callback and it has to stay empty.

A plain ThreadLocal is safe here specifically because CloudForgeSynthesizer #synthesize already serializes every synth call behind a single static lock (see that class's own javadoc for why) -- no two synth calls ever run concurrently in the same JVM, regardless of which thread invokes them, so there's no risk of one synth's findings leaking into another's.

  • Method Details

    • start

      public static void start()
      Call before app.synth() to start collecting on this thread. A synth run that never calls this (every normal deploy today) leaves record(List) a no-op, so this is fully opt-in and changes nothing for existing callers.

    • record

      public static void record(List<ComplianceRule> failedRules)
      Called from a FrameworkRules implementation's ADVISORY branch, alongside (not instead of) its existing LOG.warning calls.

    • drain

      public static List<NagReportReader.ComplianceFinding> drain()
      Stops collecting and returns everything gathered since the matching start() -- always pair this with a finally block, or a later synth on the same thread would otherwise keep appending to a stale, already-returned list indefinitely.