guardian-framework 0.1.0

package/templates/pi/scripts/languages/go/validate-ci.sh

@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-ci.sh — Go
+# ============================================================================
+set -euo pipefail
+
+ERRORS=()
+WARNINGS=()
+PASS_COUNT=0
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  CI/MR Validation (Go)"
+echo "============================================"
+echo ""
+
+# ---------------------------------------------------------------------------
+# Build
+# ---------------------------------------------------------------------------
+echo "--- Build ---"
+if [ -f "go.mod" ]; then
+    if go build ./... 2>/dev/null; then
+        pass "Build succeeded"
+    else
+        fail "Build failed"
+    fi
+else
+    pass "No go.mod (not a Go module, skipping build)"
+fi
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Tests ---"
+if [ -f "go.mod" ]; then
+    TEST_FILES=$(find . -name "*_test.go" -not -path "./vendor/*" 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$TEST_FILES" -gt 0 ]; then
+        if go test ./... -count=1 2>/dev/null; then
+            pass "All tests passed"
+        else
+            fail "Tests failed"
+        fi
+    else
+        pass "No test files found (skipped)"
+    fi
+else
+    pass "No go.mod (skipping tests)"
+fi
+
+# ---------------------------------------------------------------------------
+# Lint
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Lint ---"
+if command -v golangci-lint &>/dev/null && [ -f "go.mod" ]; then
+    if golangci-lint run 2>/dev/null; then
+        pass "Lint passed"
+    else
+        fail "Lint failed"
+    fi
+elif command -v go &>/dev/null && [ -f "go.mod" ]; then
+    if go vet ./... 2>/dev/null; then
+        pass "go vet passed"
+    else
+        fail "go vet failed"
+    fi
+else
+    warn "No Go lint tools available, skipping lint"
+fi
+
+# ---------------------------------------------------------------------------
+# Format
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Format ---"
+if command -v gofmt &>/dev/null && [ -f "go.mod" ]; then
+    FMT_OUT=$(gofmt -d . 2>/dev/null | grep -c . || true)
+    if [ "$FMT_OUT" -eq 0 ]; then
+        pass "Format check passed"
+    else
+        fail "Format check failed (${FMT_OUT} files need formatting)"
+    fi
+else
+    warn "gofmt not available, skipping format check"
+fi
+
+# ---------------------------------------------------------------------------
+# Security Audit
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Security Audit ---"
+if command -v govulncheck &>/dev/null && [ -f "go.mod" ]; then
+    VULN_OUT=$(govulncheck ./... 2>&1 || true)
+    if echo "$VULN_OUT" | grep -q "No vulnerabilities found"; then
+        pass "No known vulnerabilities"
+    else
+        warn "govulncheck reported findings (review manually)"
+    fi
+else
+    warn "govulncheck not available, skipping vulnerability audit"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo "FAILURES:"
+    for err in "${ERRORS[@]}"; do
+        echo "  - $err"
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}All CI checks passed.${NC}"
+exit 0

package/templates/pi/scripts/languages/go/validate-integration.sh

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-integration.sh — Go
+# ============================================================================
+set -euo pipefail
+
+PASS_COUNT=0; ERRORS=(); WARNINGS=()
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  Integration Validation (Go)"
+echo "============================================"
+echo ""
+
+# ---------------------------------------------------------------------------
+# Integration Test Runner
+# ---------------------------------------------------------------------------
+echo "--- Integration Test Runner ---"
+if [ -f "go.mod" ]; then
+    HAS_INTEGRATION=false
+    # Check for dedicated integration test files
+    if find . -name "*_integration_test.go" -not -path "./vendor/*" 2>/dev/null | grep -q .; then
+        HAS_INTEGRATION=true
+    fi
+    # Check for tests/integration directory
+    if [ -d "tests/integration" ]; then
+        HAS_INTEGRATION=true
+    fi
+    # Check for integration build tag
+    if grep -rl '//go:build integration' --include="*_test.go" . 2>/dev/null | grep -q .; then
+        HAS_INTEGRATION=true
+    fi
+    if [ "$HAS_INTEGRATION" = true ]; then
+        if go test -tags=integration ./... -count=1 2>/dev/null; then
+            pass "Integration tests passed"
+        else
+            fail "Integration tests failed"
+        fi
+    else
+        pass "No integration test files found (skipped)"
+    fi
+else
+    pass "No go.mod (skipping integration tests)"
+fi
+
+# ---------------------------------------------------------------------------
+# Docker/Compose Dependencies
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Docker/Compose Dependencies ---"
+if [ -f "docker-compose.yml" ] || [ -f "docker-compose.yaml" ]; then
+    warn "Docker Compose file found; integration tests may require running services"
+elif [ -f "Dockerfile" ]; then
+    warn "Dockerfile found; integration tests may require containerized environment"
+else
+    pass "No Docker Compose files found"
+fi
+
+# ---------------------------------------------------------------------------
+# Contract Tests
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Contract Tests ---"
+if [ -f "go.mod" ]; then
+    CONTRACT_FILES=$(find . -name "*_contract_test.go" -not -path "./vendor/*" 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$CONTRACT_FILES" -gt 0 ]; then
+        pass "Contract test files found ($CONTRACT_FILES files)"
+    else
+        warn "No contract test files (*_contract_test.go) found"
+    fi
+else
+    pass "No Go source files to check"
+fi
+
+# ---------------------------------------------------------------------------
+# Mock/Stub Detection
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Mock/Stub Detection ---"
+if [ -f "go.mod" ]; then
+    MOCK_PATTERNS=0
+    grep -qE '"github.com/golang/mock' . -r --include="*.go" 2>/dev/null && MOCK_PATTERNS=$((MOCK_PATTERNS + 1))
+    grep -qE '"github.com/stretchr/testify/mock"' . -r --include="*.go" 2>/dev/null && MOCK_PATTERNS=$((MOCK_PATTERNS + 1))
+    grep -qE '"go.uber.org/mock' . -r --include="*.go" 2>/dev/null && MOCK_PATTERNS=$((MOCK_PATTERNS + 1))
+    # Check for manual mock directories
+    if [ -d "mock" ] || [ -d "mocks" ] || find . -name "mock_*" -path "*/test*" 2>/dev/null | grep -q .; then
+        MOCK_PATTERNS=$((MOCK_PATTERNS + 1))
+    fi
+    if [ "$MOCK_PATTERNS" -gt 0 ]; then
+        pass "Mock/stub patterns detected ($MOCK_PATTERNS approaches found)"
+    else
+        warn "No mock/stub patterns detected (consider gomock or testify/mock)"
+    fi
+else
+    warn "Not in a Go module, skipping mock detection"
+fi
+
+# ---------------------------------------------------------------------------
+# Database Integration
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Database Integration ---"
+if [ -f "go.mod" ]; then
+    DB_TEST_FILES=0
+    find . -name "*_integration_test.go" -not -path "./vendor/*" 2>/dev/null | grep -q . && DB_TEST_FILES=$((DB_TEST_FILES + 1))
+    find . -name "*db_test.go" -not -path "./vendor/*" 2>/dev/null | grep -q . && DB_TEST_FILES=$((DB_TEST_FILES + 1))
+    find . -name "*repository*_test.go" -not -path "./vendor/*" 2>/dev/null | grep -q . && DB_TEST_FILES=$((DB_TEST_FILES + 1))
+    if [ "$DB_TEST_FILES" -gt 0 ]; then
+        pass "Database integration test patterns found ($DB_TEST_FILES patterns)"
+    else
+        warn "No database integration test files found (*_integration_test.go, *db_test.go)"
+    fi
+else
+    pass "No Go source files to check"
+fi
+
+# ---------------------------------------------------------------------------
+# HTTP Integration
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- HTTP Integration ---"
+if [ -f "go.mod" ]; then
+    HTTPTEST_COUNT=$(grep -rl '"net/http/httptest"' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$HTTPTEST_COUNT" -gt 0 ]; then
+        pass "HTTP integration tests found (httptest in $HTTPTEST_COUNT files)"
+    else
+        warn "No httptest usage found (consider net/http/httptest for HTTP integration tests)"
+    fi
+else
+    pass "No Go source files to check"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo "FAILURES:"
+    for err in "${ERRORS[@]}"; do
+        echo "  - $err"
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}Integration validation passed.${NC}"
+exit 0

package/templates/pi/scripts/languages/go/validate-operations.sh

@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-operations.sh — Go
+# ============================================================================
+set -euo pipefail
+
+PASS_COUNT=0; ERRORS=(); WARNINGS=()
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  Operations Validation (Go)"
+echo "============================================"
+echo ""
+
+# ---------------------------------------------------------------------------
+# Structured Logging
+# ---------------------------------------------------------------------------
+echo "--- Structured Logging ---"
+if [ -f "go.mod" ]; then
+    LOG_FRAMEWORKS=""
+    grep -qE '"log/slog"' . -r --include="*.go" 2>/dev/null && LOG_FRAMEWORKS="${LOG_FRAMEWORKS:+$LOG_FRAMEWORKS, }slog"
+    grep -qE '"go.uber.org/zap"' . -r --include="*.go" 2>/dev/null && LOG_FRAMEWORKS="${LOG_FRAMEWORKS:+$LOG_FRAMEWORKS, }zap"
+    grep -qE '"github.com/sirupsen/logrus"' . -r --include="*.go" 2>/dev/null && LOG_FRAMEWORKS="${LOG_FRAMEWORKS:+$LOG_FRAMEWORKS, }logrus"
+    grep -qE '"github.com/rs/zerolog"' . -r --include="*.go" 2>/dev/null && LOG_FRAMEWORKS="${LOG_FRAMEWORKS:+$LOG_FRAMEWORKS, }zerolog"
+    if [ -n "$LOG_FRAMEWORKS" ]; then
+        pass "Structured logging found ($LOG_FRAMEWORKS)"
+    else
+        warn "No structured logging framework detected (consider slog, zap, logrus, or zerolog)"
+    fi
+else
+    warn "Not in a Go module, skipping logging check"
+fi
+
+# ---------------------------------------------------------------------------
+# Health Checks
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Health Checks ---"
+if [ -f "go.mod" ]; then
+    HEALTH_ENDPOINTS=$(grep -rE '("/health|/healthz|/ready|/readiness)' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$HEALTH_ENDPOINTS" -gt 0 ]; then
+        pass "Health/readiness endpoint handlers found ($HEALTH_ENDPOINTS references)"
+    else
+        warn "No health check endpoints found (/health, /healthz, /ready)"
+    fi
+else
+    pass "No Go source files to check"
+fi
+
+# ---------------------------------------------------------------------------
+# Graceful Shutdown
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Graceful Shutdown ---"
+if [ -f "go.mod" ]; then
+    SHUTDOWN_PATTERNS=0
+    grep -qE 'signal\.Notify' . -r --include="*.go" 2>/dev/null && SHUTDOWN_PATTERNS=$((SHUTDOWN_PATTERNS + 1))
+    grep -qE 'context\.WithCancel' . -r --include="*.go" 2>/dev/null && SHUTDOWN_PATTERNS=$((SHUTDOWN_PATTERNS + 1))
+    grep -qE 'defer\s+.*cancel' . -r --include="*.go" 2>/dev/null && SHUTDOWN_PATTERNS=$((SHUTDOWN_PATTERNS + 1))
+    if [ "$SHUTDOWN_PATTERNS" -gt 0 ]; then
+        pass "Graceful shutdown patterns found ($SHUTDOWN_PATTERNS patterns detected)"
+    else
+        warn "No graceful shutdown patterns found (signal.Notify, context.WithCancel, defer cleanup)"
+    fi
+else
+    pass "No Go source files to check"
+fi
+
+# ---------------------------------------------------------------------------
+# Metrics
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Metrics ---"
+if [ -f "go.mod" ]; then
+    METRICS_LIBS=""
+    grep -qE '"github.com/prometheus' . -r --include="*.go" 2>/dev/null && METRICS_LIBS="${METRICS_LIBS:+$METRICS_LIBS, }prometheus"
+    grep -qE '"go.opentelemetry.io' . -r --include="*.go" 2>/dev/null && METRICS_LIBS="${METRICS_LIBS:+$METRICS_LIBS, }opentelemetry"
+    grep -qE '"expvar"' . -r --include="*.go" 2>/dev/null && METRICS_LIBS="${METRICS_LIBS:+$METRICS_LIBS, }expvar"
+    if [ -n "$METRICS_LIBS" ]; then
+        pass "Metrics/telemetry libraries found ($METRICS_LIBS)"
+    else
+        warn "No metrics libraries detected (consider prometheus, opentelemetry, or expvar)"
+    fi
+else
+    warn "Not in a Go module, skipping metrics check"
+fi
+
+# ---------------------------------------------------------------------------
+# Error Wrapping
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Error Wrapping ---"
+if [ -f "go.mod" ]; then
+    WRAP_COUNT=$(grep -rE 'fmt\.Errorf\(.*%w' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$WRAP_COUNT" -gt 0 ]; then
+        pass "Error wrapping with %w found ($WRAP_COUNT usages)"
+    else
+        warn "No error wrapping patterns found (use fmt.Errorf(\"... %w\", err))"
+    fi
+else
+    pass "No Go source files to check"
+fi
+
+# ---------------------------------------------------------------------------
+# Configuration
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Configuration ---"
+if [ -f "go.mod" ]; then
+    CONFIG_PATTERNS=0
+    grep -qE '"github.com/spf13/viper"' . -r --include="*.go" 2>/dev/null && CONFIG_PATTERNS=$((CONFIG_PATTERNS + 1))
+    grep -qE '"github.com/kelseyhightower/envconfig"' . -r --include="*.go" 2>/dev/null && CONFIG_PATTERNS=$((CONFIG_PATTERNS + 1))
+    grep -qE 'os\.Getenv' . -r --include="*.go" 2>/dev/null && CONFIG_PATTERNS=$((CONFIG_PATTERNS + 1))
+    if [ "$CONFIG_PATTERNS" -gt 0 ]; then
+        pass "Configuration management patterns found ($CONFIG_PATTERNS approaches detected)"
+    else
+        warn "No configuration management patterns found (consider viper, envconfig, or os.Getenv with defaults)"
+    fi
+else
+    warn "Not in a Go module, skipping configuration check"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo "FAILURES:"
+    for err in "${ERRORS[@]}"; do
+        echo "  - $err"
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}Operations validation passed.${NC}"
+exit 0

package/templates/pi/scripts/languages/go/validate-security.sh

@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-security.sh — Go
+# ============================================================================
+set -euo pipefail
+
+PASS_COUNT=0; ERRORS=(); WARNINGS=()
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; WARNINGS+=("$1"); }
+
+echo "============================================"
+echo "  Security Scan (Go)"
+echo "============================================"
+echo ""
+
+# ---------------------------------------------------------------------------
+# Hardcoded Secrets
+# ---------------------------------------------------------------------------
+echo "--- Hardcoded Secrets ---"
+if [ -f "go.mod" ]; then
+    SECRET_COUNT=$(grep -rE '(apiKey|secretKey|password|secret|token)\s*=\s*"[^"]{8,}"' . --include="*.go" 2>/dev/null \
+        | grep -v "_test.go" \
+        | grep -vE '(example|placeholder|dummy|TODO|FIXME)' \
+        | wc -l | tr -d ' ')
+    if [ "$SECRET_COUNT" -eq 0 ]; then
+        pass "No hardcoded secrets detected"
+    else
+        fail "Potential hardcoded secrets found ($SECRET_COUNT occurrences)"
+    fi
+else
+    pass "No Go source files to check"
+fi
+
+# ---------------------------------------------------------------------------
+# SQL/Query Injection
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Injection Patterns ---"
+if [ -f "go.mod" ]; then
+    # Check for db.Exec/db.Query combined with fmt.Sprintf (string interpolation into queries)
+    INJECT_COUNT=0
+    # Find files using db.Exec or db.Query with fmt.Sprintf
+    for file in $(grep -rlE '(db\.Exec|db\.Query)\s*\(\s*fmt\.Sprintf' . --include="*.go" 2>/dev/null); do
+        INJECT_COUNT=$((INJECT_COUNT + 1))
+    done
+    if [ "$INJECT_COUNT" -eq 0 ]; then
+        pass "No obvious SQL injection patterns (no Exec/Query with Sprintf)"
+    else
+        fail "Potential SQL injection patterns ($INJECT_COUNT files use Exec/Query with fmt.Sprintf)"
+    fi
+else
+    pass "No Go source files to check"
+fi
+
+# ---------------------------------------------------------------------------
+# Dependency Audit
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Dependency Audit ---"
+if command -v govulncheck &>/dev/null && [ -f "go.mod" ]; then
+    VULN_OUT=$(govulncheck ./... 2>&1 || true)
+    if echo "$VULN_OUT" | grep -q "No vulnerabilities found"; then
+        pass "No known vulnerabilities"
+    else
+        warn "govulncheck reported findings (review manually)"
+    fi
+elif [ -f "go.mod" ]; then
+    DEP_COUNT=$(go list -m all 2>/dev/null | wc -l | tr -d ' ')
+    warn "govulncheck not available; $DEP_COUNT dependencies require manual review"
+else
+    warn "Not in a Go module, skipping dependency audit"
+fi
+
+# ---------------------------------------------------------------------------
+# TLS/HTTPS Usage
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- TLS/HTTPS Usage ---"
+if [ -f "go.mod" ]; then
+    # Check for hardcoded http:// URLs in non-test files (excluding localhost and examples)
+    HTTP_URLS=$(grep -rE 'https?://[^"'\''`\s]+' . --include="*.go" 2>/dev/null \
+        | grep -v "_test.go" \
+        | grep -vE '(localhost|127\.0\.0\.1|example\.com|example\.org)' \
+        | grep -c 'http://' || true)
+    if [ "$HTTP_URLS" -eq 0 ]; then
+        pass "No production http:// URLs found (using https://)"
+    else
+        warn "Found $HTTP_URLS potential http:// URLs (consider https://)"
+    fi
+else
+    pass "No Go source files to check"
+fi
+
+# ---------------------------------------------------------------------------
+# Input Validation (HTML vs Text Template)
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Input Validation ---"
+if [ -f "go.mod" ]; then
+    TEXT_TEMPLATE=$(grep -rl '"text/template"' . --include="*.go" 2>/dev/null | grep -v "_test.go" | wc -l | tr -d ' ')
+    HTML_TEMPLATE=$(grep -rl '"html/template"' . --include="*.go" 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$TEXT_TEMPLATE" -eq 0 ]; then
+        pass "No text/template usage in production code (html/template auto-escapes)"
+    elif [ "$HTML_TEMPLATE" -gt 0 ]; then
+        warn "Found text/template in $TEXT_TEMPLATE files; html/template used in $HTML_TEMPLATE files (prefer html/template for HTML output)"
+    else
+        fail "Found text/template in $TEXT_TEMPLATE production files (use html/template for HTML output)"
+    fi
+else
+    pass "No Go source files to check"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+    echo "FAILURES:"
+    for err in "${ERRORS[@]}"; do
+        echo "  - $err"
+    done
+    exit 1
+fi
+
+echo -e "${GREEN}Security scan passed.${NC}"
+exit 0