Add filter suite option for scan

Dockerfile

@@ -20,6 +20,7 @@ LABEL org.opencontainers.image.source=https://github.com/safedep/vet
 LABEL org.opencontainers.image.description="Open source software supply chain security tool"
 LABEL org.opencontainers.image.licenses=Apache-2.0
 
+COPY ./samples/ /vet/samples
 COPY --from=build /build/vet /usr/local/bin/vet
 
 USER nonroot:nonroot

README.md

@@ -84,9 +84,16 @@ Learn more about [filtering with vet](docs/filtering.md).
 Look at [filter input spec](api/filter_input_spec.proto) on attributes
 available to the filter expression.
 
-## Policy Evaluation
+### Using Filter Suite
 
-TODO
+Filter suites can be used to implement security gating in CI. [Example](samples/filter-suites/fs-generic.yml)
+file suite contains rules to enforce generic OSS consumption best practices.
+
+```bash
+vet scan -D /path/to/dir --filter-suite /path/to/suite.yml --filter-fail
+```
+
+Read more about filter suites in [filtering guide](docs/filtering.md)
 
 ## FAQ
 

docs/filtering.md

@@ -142,7 +142,6 @@ The filter suite will be evaluated as:
 
 * Ordered list of filters as given in the suite file
 * Stop on first rule match for a given package
-* Stop on first evaluation error for a given package
 
 ## FAQ
 

scan.go

@@ -23,6 +23,7 @@ var (
 	concurrency          int
 	dumpJsonManifestDir  string
 	celFilterExpression  string
+	celFilterSuiteFile   string
 	celFilterFailOnMatch bool
 	markdownReportPath   string
 	consoleReport        bool
@@ -63,6 +64,8 @@ func newScanCommand() *cobra.Command {
 		"Dump enriched package manifests as JSON files to dir")
 	cmd.Flags().StringVarP(&celFilterExpression, "filter", "", "",
 		"Filter and print packages using CEL")
+	cmd.Flags().StringVarP(&celFilterSuiteFile, "filter-suite", "", "",
+		"Filter packages using CEL Filter Suite from file")
 	cmd.Flags().BoolVarP(&celFilterFailOnMatch, "filter-fail", "", false,
 		"Fail the scan if the filter match any package (security gate)")
 	cmd.Flags().StringVarP(&markdownReportPath, "report-markdown", "", "",
@@ -118,6 +121,16 @@ func internalStartScan() error {
 		analyzers = append(analyzers, task)
 	}
 
+	if !utils.IsEmptyString(celFilterSuiteFile) {
+		task, err := analyzer.NewCelFilterSuiteAnalyzer(celFilterSuiteFile,
+			celFilterFailOnMatch)
+		if err != nil {
+			return err
+		}
+
+		analyzers = append(analyzers, task)
+	}
+
 	reporters := []reporter.Reporter{}
 	if consoleReport {
 		rp, err := reporter.NewConsoleReporter()