[ aws . continuum ]

get-code-issue-artifact

Description

Retrieves one immutable artifact attached to an issue, including its content.

See also: AWS API Documentation

get-code-issue-artifact uses document type values. Document types follow the JSON data model where valid values are: strings, numbers, booleans, null, arrays, and objects. For command input, options and nested parameters that are labeled with the type document must be provided as JSON. Shorthand syntax does not support document types.

Synopsis

  get-code-issue-artifact
--environment-id <value>
--issue-id <value>
--artifact-id <value>
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
[--cli-error-format <value>]

Options

--environment-id (string) [required]

The environment that owns the issue.

Constraints:

• min: 1
• max: 64
• pattern: [a-z0-9]+

--issue-id (string) [required]

The issue the artifact is attached to.

Constraints:

• min: 1
• max: 64
• pattern: [a-z0-9]+

--artifact-id (string) [required]

The unique identifier of the artifact to retrieve.

Constraints:

• min: 1
• max: 64
• pattern: [a-z0-9]+

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

Global Options

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command’s default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

• json
• text
• table
• yaml
• yaml-stream
• off

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

• on
• off
• auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

--cli-binary-format (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.

• base64
• raw-in-base64-out

--no-cli-pager (boolean)

Disable cli pager for output.

--cli-auto-prompt (boolean)

Automatically prompt for CLI input parameters.

--no-cli-auto-prompt (boolean)

Disable automatically prompt for CLI input parameters.

--cli-error-format (string)

The formatting style for error output. By default, errors are displayed in enhanced format.

• legacy
• json
• yaml
• text
• table
• enhanced

Output

artifactId -> (string)

The unique identifier of the artifact.

Constraints:

• min: 1
• max: 64
• pattern: [a-z0-9]+

artifactType -> (string)

Semantic category of the artifact.

Possible values:

• EVIDENCE
• AGENT_COMMUNICATION
• VALIDATION_EVIDENCE
• REMEDIATION_PROPOSAL
• DECISION
• PATCH

mediaType -> (string)

MIME type the producer declared for its content.

Constraints:

• min: 3
• max: 255

body -> (tagged union structure)

The artifact body, projected against the shape defined for its artifactType. A type with a defined shape is returned as that structure, and anything else through IssueArtifactBody.raw .

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: validationEvidence, prevalidationSignals, remediationProposal, patch, raw.

validationEvidence -> (structure)

Projected VALIDATION_EVIDENCE content.

exploitable -> (string) [required]

Exploitability verdict. Explicit UNCERTAIN replaces the producer’s tri-state exploitable: true | false | null , so an absent verdict is never confused with a negative one.

Possible values:

• EXPLOITABLE
• NOT_EXPLOITABLE
• UNCERTAIN

terminalStatus -> (string)

How the validation run ended. Absent when the producer reported a status with no mapping yet: the rest of the body still projects, so one unmapped enum never costs a customer the whole artifact.

Possible values:

• COMPLETED
• FAILED
• NO_SOURCE_AVAILABLE
• PARTIAL

flowVerdicts -> (list)

One verdict per attack flow assessed in the bundle.

Constraints:

• min: 1
• max: 50

(structure)

Validation’s verdict for one attack flow.

flowId -> (string) [required]

Identifier of the attack flow assessed.

Constraints:

• min: 1
• max: 256

verdict -> (string) [required]

Outcome for this flow.

Possible values:

• CONFIRMED
• DENIED
• INCONCLUSIVE

confidence -> (double)

Confidence in this flow’s verdict. Absent when out of range.

evidence -> (list)

Citations supporting the verdict.

Constraints:

• min: 1
• max: 50

(string)

A citation supporting a claim: file:line, an HTTP response, or a graph node id.

1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.

Constraints:

• min: 1
• max: 1024

attackFlowsConfirmed -> (list)

Identifiers of attack flows upgraded to Confirmed provenance.

Constraints:

• min: 1
• max: 50

(string)

Identifier of an attack flow within a validation bundle.

Constraints:

• min: 1
• max: 256

exploitArtifact -> (structure)

Concrete payload and its observed effect, when validation produced one by sending an HTTP request.

Only an HTTP proof projects here. A validation agent that proves exploitability by RUNNING code against the repository projects executedProof , and one that proves it by reading the source projects sourceAnalysis . All three are mutually exclusive: at most one is present.

payload -> (string) [required]

The exact payload sent.

Constraints:

• min: 1
• max: 8192

targetUrl -> (string) [required]

Target the payload was sent to.

Constraints:

• min: 1
• max: 1024

httpMethod -> (string) [required]

HTTP method the payload was sent with.

Possible values:

• GET
• HEAD
• POST
• PUT
• PATCH
• DELETE
• OPTIONS

headers -> (map)

Headers sent with the payload.

Constraints:

• min: 0
• max: 50

key -> (string)

A citation supporting a claim: file:line, an HTTP response, or a graph node id.

1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.

Constraints:

• min: 1
• max: 1024

value -> (string)

A bounded free-text field in a projected artifact body.

8192 rather than 4096: a validation agent’s reasoning claim runs to ~5.6K in practice, and a claim dropped on length takes its whole ReasoningStep with it. Deliberately NOT raised to the proof-body bound — this type is also the member of a 50-entry ReasoningSteps list and of ArtifactHeaders , so its bound multiplies into the worst-case response size.

The product of these bounds is NOT what actually caps a response. Every projected body is read out of one IssueArtifactContent , itself bounded at 5 MiB, so no projection can exceed the size of the content it came from whatever the member bounds permit. Keeping this one modest is about not inflating a typical response, not about the ceiling.

Constraints:

• min: 1
• max: 8192

responseStatus -> (integer)

HTTP status observed in the response.

responseSnippet -> (string)

Leading portion of the response body, bounded by the producer.

Constraints:

• min: 1
• max: 16384

effect -> (string) [required]

Effect observed from sending the payload.

Possible values:

• DATA_LEAKED
• ERROR_REVEALED
• BEHAVIOR_CHANGED
• NO_EFFECT

executedProof -> (structure)

Proof the agent produced by executing code against the repository under test, with the output that execution produced.

code -> (structure) [required]

The code that was run. Not a request payload: it imports the repository’s own modules and drives the vulnerable code path directly.

proofCode -> (list) [required]

Proof program files, main file first, in their retained order.

Constraints:

• min: 1
• max: 64

(structure)

One proof program file. Further members, such as path and purpose, can be added later as optional details.

content -> (string) [required]

The file’s non-blank text, exactly as retained.

Constraints:

• min: 1
• max: 131072

output -> (structure)

What the execution printed, including the agent’s own PASS/FAIL assertions. Absent when the run printed nothing retained.

consoleOutput -> (string) [required]

What the run printed: standard output and standard error merged, as retained. The text may be empty.

Constraints:

• min: 0
• max: 131072

observedEffect -> (string)

Effect the execution actually produced. observedEffect rather than effect : this one was witnessed, and the name has to stay distinguishable from ValidationSourceAnalysis.inferredEffect , which was not.

Possible values:

• DATA_LEAKED
• ERROR_REVEALED
• BEHAVIOR_CHANGED
• NO_EFFECT

sourceAnalysis -> (structure)

Proof the agent produced by reading the repository’s source, with nothing built or run.

summary -> (string) [required]

The non-blank analysis as Markdown: the annotated entry-to-sink walk, its citations, and why the checked guards are absent or bypassed.

Constraints:

• min: 1
• max: 16384

inferredEffect -> (string)

Effect the agent concluded WOULD occur. Deliberately not effect : nothing was executed, so this is reasoned from the source and must not be read as an observation. See ValidationExecutedProof.observedEffect .

Possible values:

• DATA_LEAKED
• ERROR_REVEALED
• BEHAVIOR_CHANGED
• NO_EFFECT

perFindingResults -> (list)

Per-finding breakdown for a multi-finding bundle. Absent for a single-finding bundle.

Constraints:

• min: 1
• max: 50

(structure)

Validation’s result for one finding within a multi-finding bundle.

findingId -> (string) [required]

The finding assessed.

Constraints:

• min: 1
• max: 64
• pattern: [a-z0-9]+

exploitable -> (string) [required]

Exploitability verdict for this finding.

Possible values:

• EXPLOITABLE
• NOT_EXPLOITABLE
• UNCERTAIN

confidence -> (double)

Confidence in this finding’s verdict. Absent when out of range.

flowVerdicts -> (list)

Per-flow verdicts recorded for this finding.

Constraints:

• min: 1
• max: 50

(structure)

Validation’s verdict for one attack flow.

flowId -> (string) [required]

Identifier of the attack flow assessed.

Constraints:

• min: 1
• max: 256

verdict -> (string) [required]

Outcome for this flow.

Possible values:

• CONFIRMED
• DENIED
• INCONCLUSIVE

confidence -> (double)

Confidence in this flow’s verdict. Absent when out of range.

evidence -> (list)

Citations supporting the verdict.

Constraints:

• min: 1
• max: 50

(string)

A citation supporting a claim: file:line, an HTTP response, or a graph node id.

1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.

Constraints:

• min: 1
• max: 1024

reasoningChain -> (list)

Reasoning chain recorded for this finding.

Constraints:

• min: 1
• max: 50

(structure)

One step in the validation agent’s reasoning chain.

step -> (integer) [required]

Position of this step in the chain.

claim -> (string) [required]

The claim or conclusion reached at this step.

Constraints:

• min: 1
• max: 8192

source -> (string) [required]

Citation supporting the claim.

Constraints:

• min: 1
• max: 1024

confidence -> (double)

Confidence in this individual claim, on the producer’s native 0-1 scale.

exploitArtifact -> (structure)

Exploit artifact produced for this finding, when there was one.

payload -> (string) [required]

The exact payload sent.

Constraints:

• min: 1
• max: 8192

targetUrl -> (string) [required]

Target the payload was sent to.

Constraints:

• min: 1
• max: 1024

httpMethod -> (string) [required]

HTTP method the payload was sent with.

Possible values:

• GET
• HEAD
• POST
• PUT
• PATCH
• DELETE
• OPTIONS

headers -> (map)

Headers sent with the payload.

Constraints:

• min: 0
• max: 50

key -> (string)

A citation supporting a claim: file:line, an HTTP response, or a graph node id.

1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.

Constraints:

• min: 1
• max: 1024

value -> (string)

A bounded free-text field in a projected artifact body.

8192 rather than 4096: a validation agent’s reasoning claim runs to ~5.6K in practice, and a claim dropped on length takes its whole ReasoningStep with it. Deliberately NOT raised to the proof-body bound — this type is also the member of a 50-entry ReasoningSteps list and of ArtifactHeaders , so its bound multiplies into the worst-case response size.

The product of these bounds is NOT what actually caps a response. Every projected body is read out of one IssueArtifactContent , itself bounded at 5 MiB, so no projection can exceed the size of the content it came from whatever the member bounds permit. Keeping this one modest is about not inflating a typical response, not about the ceiling.

Constraints:

• min: 1
• max: 8192

responseStatus -> (integer)

HTTP status observed in the response.

responseSnippet -> (string)

Leading portion of the response body, bounded by the producer.

Constraints:

• min: 1
• max: 16384

effect -> (string) [required]

Effect observed from sending the payload.

Possible values:

• DATA_LEAKED
• ERROR_REVEALED
• BEHAVIOR_CHANGED
• NO_EFFECT

prevalidationSignals -> (structure)

Projected EVIDENCE content whose stored envelope declares artifact_kind: prevalidation_signals — the severity signals prioritization uses.

One artifactType can select different members here: EVIDENCE also carries the prioritization markdown narrative, which is not JSON and so returns through raw . The member is therefore chosen by artifactType AND, for a type that carries more than one payload kind, the content’s own discriminator.

producedBy -> (string)

The agent that produced this signal set.

Constraints:

• min: 1
• max: 128
• pattern: [a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}

signals -> (list)

The signals backing the Issue’s proposed severity.

Constraints:

• min: 1
• max: 50

(structure)

One producer’s conclusion about one subject on one scoring dimension.

subjectRef -> (string)

What this signal is about, such as a finding or issue reference.

Constraints:

• min: 1
• max: 1024

dimension -> (string)

The axis this signal speaks to. Absent when the producer reported a dimension with no mapping yet.

Possible values:

• EXPLOITABILITY
• BLAST_RADIUS
• NETWORK_EXPOSURE
• PRECONDITION
• CODE_CONTEXT
• LIKELIHOOD_ASSESSMENT
• IMPACT_ASSESSMENT

signalStrength -> (string)

The signal’s own rating. This is an input to scoring and is NOT the finding’s severity.

Possible values:

• NONE
• WEAK
• MODERATE
• STRONG

conclusion -> (string)

The producer’s conclusion.

Constraints:

• min: 1
• max: 8192

producerId -> (string)

Stable name of the producer that emitted this signal.

Constraints:

• min: 1
• max: 128
• pattern: [a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}

producerVersion -> (string)

Version of that producer.

Constraints:

• min: 1
• max: 1024

confidence -> (double)

The producer’s confidence in this conclusion, on its native 0-1 scale. Absent when the stored value falls outside 0-1.

confidenceReasoning -> (structure)

Why the producer is or is not sure, kept structured rather than prose.

summary -> (string) [required]

One-line rationale.

Constraints:

• min: 1
• max: 8192

factors -> (list)

The individual factors behind it.

Constraints:

• min: 1
• max: 50

(string)

A citation supporting a claim: file:line, an HTTP response, or a graph node id.

1024 rather than 512: validation agents cite a span of reasoning rather than a single location, reaching ~930 characters, and an over-long citation drops its entire ReasoningStep — claim included — rather than just the citation.

Constraints:

• min: 1
• max: 1024

computed -> (structure)

The deterministic values the producer computed from its assessment.

likelihoodBand -> (string)

Computed likelihood band, on a likelihood signal.

Possible values:

• VERY_LOW
• LOW
• MODERATE
• HIGH

impactBand -> (string)

Computed impact band, on an impact signal.

Possible values:

• VERY_LOW
• LOW
• MODERATE
• HIGH

barriers -> (integer)

How many of the four exploit preconditions act as barriers (0-4).

preconditions -> (structure)

The four exploit preconditions a likelihood signal assessed, each with the basis the producer had for it.

reachableFromAttacker -> (structure)

Whether the vulnerable code path is reachable by an attacker.

value -> (boolean)

The producer’s determination.

A Boolean rather than an enum, against the Common Terms preference for enums on extensibility grounds. The question each precondition answers is closed — is the code reachable, is configuration required, must a user other than the attacker interact — and the only third state, “not determined”, is already expressed by omitting this member, which the projection does whenever the stored value is not a bool. An enum would give two ways to say the same thing, while basis and missingInfo already qualify how firm the answer is.

basis -> (string)

Where the producer’s determination came from.

Possible values:

• CODE
• GRAPH
• FINDING
• INFERRED
• NO_EVIDENCE_DEFAULT

reason -> (string)

The producer’s explanation.

Constraints:

• min: 1
• max: 8192

missingInfo -> (string)

What the producer could not determine, when anything was missing.

Constraints:

• min: 1
• max: 8192

configurationNeeded -> (structure)

Whether exploitation depends on a non-default configuration.

value -> (boolean)

The producer’s determination.

A Boolean rather than an enum, against the Common Terms preference for enums on extensibility grounds. The question each precondition answers is closed — is the code reachable, is configuration required, must a user other than the attacker interact — and the only third state, “not determined”, is already expressed by omitting this member, which the projection does whenever the stored value is not a bool. An enum would give two ways to say the same thing, while basis and missingInfo already qualify how firm the answer is.

basis -> (string)

Where the producer’s determination came from.

Possible values:

• CODE
• GRAPH
• FINDING
• INFERRED
• NO_EVIDENCE_DEFAULT

reason -> (string)

The producer’s explanation.

Constraints:

• min: 1
• max: 8192

missingInfo -> (string)

What the producer could not determine, when anything was missing.

Constraints:

• min: 1
• max: 8192

accessLevel -> (structure)

What level of access exploitation requires.

value -> (string)

The level of access exploitation requires. Absent when the producer reported a level with no mapping yet.

Possible values:

• NONE
• ANY_AUTHENTICATED
• PRIVILEGED

basis -> (string)

Where the producer’s determination came from.

Possible values:

• CODE
• GRAPH
• FINDING
• INFERRED
• NO_EVIDENCE_DEFAULT

reason -> (string)

The producer’s explanation.

Constraints:

• min: 1
• max: 8192

missingInfo -> (string)

What the producer could not determine, when anything was missing.

Constraints:

• min: 1
• max: 8192

userInteractionRequired -> (structure)

Whether exploitation requires a user other than the attacker to take part, for example by opening a link or a file (CVSS User Interaction).

value -> (boolean)

The producer’s determination.

A Boolean rather than an enum, against the Common Terms preference for enums on extensibility grounds. The question each precondition answers is closed — is the code reachable, is configuration required, must a user other than the attacker interact — and the only third state, “not determined”, is already expressed by omitting this member, which the projection does whenever the stored value is not a bool. An enum would give two ways to say the same thing, while basis and missingInfo already qualify how firm the answer is.

basis -> (string)

Where the producer’s determination came from.

Possible values:

• CODE
• GRAPH
• FINDING
• INFERRED
• NO_EVIDENCE_DEFAULT

reason -> (string)

The producer’s explanation.

Constraints:

• min: 1
• max: 8192

missingInfo -> (string)

What the producer could not determine, when anything was missing.

Constraints:

• min: 1
• max: 8192

impactDimensions -> (structure)

The three impact dimensions an impact signal assessed, each with the basis the producer had for it. These are what the computed impact band is derived from.

attackerGains -> (structure)

What the attacker gains from exploitation.

value -> (string)

The capability exploitation grants. Absent when the producer reported a value with no mapping yet.

Possible values:

• EXECUTE
• MODIFY_PRIVILEGED
• MODIFY_DATA
• MODIFY_COSMETIC
• READ
• NEITHER

basis -> (string)

Where the producer’s determination came from.

Possible values:

• CODE
• GRAPH
• FINDING
• INFERRED
• NO_EVIDENCE_DEFAULT

reason -> (string)

The producer’s explanation.

Constraints:

• min: 1
• max: 8192

missingInfo -> (string)

What the producer could not determine, when anything was missing.

Constraints:

• min: 1
• max: 8192

blastRadius -> (structure)

How far the consequences reach.

value -> (string)

How far the consequences reach. Absent when the producer reported a value with no mapping yet.

Possible values:

• CROSS_TENANT
• OTHER_USERS_IN_TENANT
• OWN_SCOPE

basis -> (string)

Where the producer’s determination came from.

Possible values:

• CODE
• GRAPH
• FINDING
• INFERRED
• NO_EVIDENCE_DEFAULT

reason -> (string)

The producer’s explanation.

Constraints:

• min: 1
• max: 8192

missingInfo -> (string)

What the producer could not determine, when anything was missing.

Constraints:

• min: 1
• max: 8192

targetValue -> (structure)

How valuable the target is, which can shift the band off its base value.

value -> (string)

How valuable the target is. Absent when the producer reported a value with no mapping yet.

Possible values:

• HIGH
• MEDIUM
• LOW

basis -> (string)

Where the producer’s determination came from.

Possible values:

• CODE
• GRAPH
• FINDING
• INFERRED
• NO_EVIDENCE_DEFAULT

reason -> (string)

The producer’s explanation.

Constraints:

• min: 1
• max: 8192

missingInfo -> (string)

What the producer could not determine, when anything was missing.

Constraints:

• min: 1
• max: 8192

exploitability -> (structure)

What validation established about exploitability, on an exploitability signal. This summarizes the verdict the signal was derived from; the proof itself is the VALIDATION_EVIDENCE artifact it cites.

verdict -> (string)

Validation’s verdict. UNCERTAIN covers a run that was inconclusive — out of budget, an ambiguous failure, or no decisive layer reached — and is never a refutation.

Possible values:

• EXPLOITABLE
• NOT_EXPLOITABLE
• UNCERTAIN

reachedCrownJewels -> (boolean)

Whether validation reached the high-value sink the attack path posited.

A Boolean rather than an enum: the sink was either reached or it was not, and how far the walk got when it was not is already carried, with more precision, by highestLayerReached . An unknown is the absent member.

highestLayerReached -> (integer)

The highest impact layer validation reached, 1-5, as a measure of how far the attack path was walked.

confidenceTier -> (string)

How strong the evidence behind the verdict is.

Possible values:

• SOURCE_READ
• STATIC_PROVEN
• BUILD_PROVEN
• RUNTIME_PROVEN

scriptable -> (boolean)

Whether the proven exploit is automatable rather than one-off.

A Boolean for the same reason as SignalPrecondition.value : validation records a bool, and an unknown is the absent member.

sourceValidationArtifactId -> (string)

The VALIDATION_EVIDENCE artifact on this same issue holding the proof this verdict summarizes. Fetch it with GetCodeIssueArtifact for the full reasoning chain and exploit artifact.

Constraints:

• min: 1
• max: 64
• pattern: [a-z0-9]+

remediationProposal -> (structure)

Projected REMEDIATION_PROPOSAL content: a patch the remediation agent produced, with the descriptors needed to apply and verify it.

REMEDIATION_PROPOSAL content that does not match this shape is returned through raw .

patch -> (string) [required]

The patch exactly as the remediation agent produced it, unmodified.

Constraints:

• min: 1
• max: 5242880

format -> (string)

The patch’s wire format, which determines how to apply it. Absent when the producer recorded a format with no mapping yet.

Possible values:

• GIT_MAILBOX_PATCH
• GIT_BINARY_DIFF
• GIT_DIFF

filename -> (string)

Filename the producer suggests for the patch, when it named one.

Constraints:

• min: 1
• max: 1024

patchSha256 -> (string)

SHA-256 of the patch bytes in lowercase hex, as recorded by the producer.

Lets a caller confirm the patch it applies is byte-for-byte the one that was reviewed. Computed over the patch bytes, so it is verifiable against patch without trusting this value.

Constraints:

• min: 64
• max: 64
• pattern: [0-9a-f]{64}

patch -> (structure)

Projected PATCH content: the remediation patch for one repository, with the descriptors needed to verify and apply it and the state of its delivery to the customer’s own bucket or repository.

Every PATCH projects here. The descriptors come from members Control Plane computes or owns when it stores the patch, not from producer metadata, so this member is the whole PATCH contract and metadata is omitted for it.

patch -> (string) [required]

The patch exactly as stored, unmodified. Control Plane accepted it only as a text unified diff, so git apply applies it.

Constraints:

• min: 1
• max: 5242880

format -> (string)

The patch’s wire format, read from the patch itself, which determines how to apply it. Absent when the patch starts with neither a git mailbox header nor a diff --git header.

Possible values:

• GIT_MAILBOX_PATCH
• GIT_BINARY_DIFF
• GIT_DIFF

repositoryName -> (string)

The repository the patch applies to, as named in the source snapshot it was generated against.

Constraints:

• min: 1
• max: 128
• pattern: [a-zA-Z0-9_-]+

patchSha256 -> (string) [required]

SHA-256 of the patch’s UTF-8 bytes in lowercase hex, computed by Control Plane when it stored the patch.

Lets a caller confirm the patch it applies is byte-for-byte the one that was reviewed. Computed over the patch bytes, so it is verifiable against patch without trusting this value.

Constraints:

• min: 64
• max: 64
• pattern: [0-9a-f]{64}

sizeBytes -> (long) [required]

Size of the patch in UTF-8 bytes, the unit the digest is computed over.

delivery -> (structure)

Delivery of the patch to the customer’s bucket or repository. Absent when the artifact has no delivery destination.

status -> (string) [required]

How far delivery to the destination has progressed.

Possible values:

• PENDING
• SUCCEEDED
• FAILED
• SKIPPED
• ABANDONED

target -> (tagged union structure)

Where the patch was or will be delivered. Absent while the destination is still being resolved, or when delivery was skipped before a destination was known.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: s3, github.

s3 -> (structure)

The S3 object the patch is delivered to.

bucket -> (string) [required]

Customer-managed S3 bucket name.

Constraints:

• min: 3
• max: 63
• pattern: [a-z0-9][a-z0-9.\-]{1,61}[a-z0-9]

key -> (string) [required]

The object key of the delivered patch.

Constraints:

• min: 1
• max: 1024

version -> (string)

The S3 version ID of the delivered object, when the bucket is versioned.

Constraints:

• min: 1
• max: 1024

github -> (structure)

The GitHub repository the patch is delivered to, including the pull request once it is opened.

owner -> (string) [required]

The GitHub user or organization that owns the repository.

Constraints:

• min: 1
• max: 100

repository -> (string) [required]

The repository name.

Constraints:

• min: 1
• max: 100

pullRequestNumber -> (long)

Repository-scoped pull request number assigned by GitHub.

Constraints:

• min: 1

headSha -> (string)

The head commit SHA of the pull request. Absent until the pull request is opened.

Constraints:

• min: 40
• max: 40
• pattern: [a-fA-F0-9]{40}

updatedAt -> (timestamp) [required]

When the delivery status last changed.

raw -> (string)

The producer’s content verbatim, for an artifactType with no defined shape or content that failed to parse against its shape.

Constraints:

• min: 1
• max: 5242880

metadata -> (document)

Producer-defined structured metadata, when the producer supplied any.

Returned only for an artifactType whose content has no defined shape, so that the artifact stays inspectable. For an artifactType with a defined shape, body carries the content and this member is omitted.

producer -> (structure)

The agent that produced the artifact.

agent -> (string) [required]

Stable producer name, such as ContinuumValidation.

Constraints:

• min: 1
• max: 128
• pattern: [a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}

createdAt -> (timestamp)

The timestamp when the artifact was created.