Vetrix Docs

Auto-detection reference

The detector looks at marker files and directory names in the repo tree. It does NOT inspect source code — every signal is a file presence check. Detection is run against the default branch HEAD and is cacheable by commit SHA.

Detection matrix

Marker Language / framework Scanners proposed
go.mod Go gosec, govulncheck, trivy fs
package.json Node.js ESLint (security plugin), trivy fs, OSV
package.json with next / react / vue in deps Node.js + framework + prettier, + eslint fixable
requirements.txt / pyproject.toml / Pipfile Python Bandit, ruff, trivy fs, OSV
pom.xml / build.gradle / build.gradle.kts Java Dependency-Check (opt-in), trivy fs
composer.json PHP Psalm, phpcs, trivy fs, OSV
composer.json + app/etc/Magento/ marker PHP / Magento2 + magento2 phpcs ruleset
composer.json + core/lib/Drupal.php PHP / Drupal + drupal phpcs ruleset
composer.json + config/packages/ PHP / Symfony + symfony phpcs ruleset
Gemfile Ruby Brakeman, RuboCop (security), OSV
config/routes.rb Ruby / Rails + rails brakeman profile
Dockerfile IaC / container trivy image, hadolint
*.tf files IaC / Terraform Checkov
.github/workflows/*.yml IaC / Actions Checkov + semgrep
k8s/ or *.kustomization.yaml IaC / Kubernetes Checkov
Always All gitleaks (pre-receive), TruffleHog (CI verify, opt-in)

Resolution rules

  • A marker at repo root is global scope.
  • A marker under services/<name>/ sets a path override scoping the detected scanners to that subtree. See schema.md under paths: for monorepo examples.
  • Multiple markers at the same depth compose — a PHP + Node monorepo runs both scanner sets, each scoped to its subtree.

Why the matrix is narrow

The detector intentionally prefers false-negatives over false-positives: it is safer to miss a language and let the user add it than to scaffold an irrelevant scanner set the operator must disable. If a language is missing, add its block to .vetrix/tooling.yml and re-run Configure.

When to skip the wizard

Auto-detection is optional. An organisation with a shared template can commit .vetrix/tooling.yml directly; subsequent Configure visits display the committed config and propose diffs, not a fresh scaffold.