Repository navigation
Batch: 3 fixes, one commit each - #46
Merged
Merged
Conversation
…foo-1.0.tar.gz, as manifest lines this scan did not read (#42) A requirements.txt line that begins with a dot or a path separator, such as ./vendor/foo-1.0.tar.gz, ../lib or /opt/wheels/foo.whl, declares a dependency the parser does not read. unreadLines listed only -r includes, -e lines and lines holding ://, so such a line was dropped with no entry, and the block of lines the scan did not read read as complete while the line was missing from it. The line is now listed with its path, cut before any per-requirement option or environment marker, and the reason "local path requirements are not read, so this dependency is not analyzed", under unreadLines in JSON and in that block of the table and markdown reports. For the requirements.txt in the issue, unreadLines now holds lines 2 and 3 and dependencies holds cryptography only. The parser skips the line explicitly, which is what the requirement pattern already did by not matching it. Fixes #42
…ts/*.txt files, not only in requirements.txt (#43) The scan reads the requirements-*.txt family and requirements/*.txt files with the same reader as requirements.txt, but listed the lines that reader skips ("-r" includes, "-e" lines and URL requirements) only for a file named exactly requirements.txt. For a directory holding requirements.txt and a requirements-dev.txt with "-r requirements.txt" and an "-r" include of a URL, analyze --offline --format json reported both files as projects and gave neither an unreadLines entry, and a directory holding only requirements/dev.txt with the same two lines gave no unreadLines entry either. The unread-lines check now selects files through the parser lookup the directory scan uses, and leaves out pyproject.toml and Pipfile, which the Python parser reads with readers of their own. Both directories now list line 1 (requirements.txt) and line 2 (an included requirements URL, by line number and kind only) under unreadLines and in the table and markdown reports. The exit code and the JSON totalSummary are unchanged on both directories. A test checks that requirements-dev.txt, requirements_test.txt, requirements.prod.txt and requirements/dev.txt list the same unread lines as a requirements.txt holding the same content, and that pyproject.toml and Pipfile list none. Fixes #43
… when listing unread lines, so "-r \" and a URL on the next line are one URL include (#44) pip reads a line that ends in a backslash together with the next line, so a requirements.txt holding cryptography==42.0.0, "-r \" and https://example.invalid/continued.txt on three lines declares one -r URL include. The unread-lines block read one physical line at a time and listed "line 2: \: included requirements files are not followed, ..." and "line 3: URL requirements are not read, ...", with "name": "\\" in the JSON unreadLines entry. Continued lines are now joined as pip joins them and numbered by their first line, so that file lists only "line 2: included requirements URLs are not followed, so the dependencies it declares are not analyzed", with no name. A comment line is not continued. The dependency parser is unchanged: the JSON output for that file differs only in unreadLines and timestamps, and the exit code is 1 before and after. Fixes #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request lands 3 commits in
internal/manifest,pkg/typesandCHANGELOG.md.Included
Verified on this exact tree
go build ./...: exit 0go vet ./...: exit 0gofmt -l cmd internal pkg: 0 files listedgolangci-lint run ./...(golangci-lint 2.12.2): not verified, exits 3 withcan't load config: unsupported version of the configuration: "";.golangci.ymlis unchanged by this pull requestgo test -p 4 -race -count=1 -json ./...: exit 0; 16 packages, 13ok, 3[no test files]TestIntegration_FetchPyPIPackageininternal/analyzer/source, outputpip not available, skipping testNot included
go test -count=1 -run TestNetworkUseGoesThroughNetguard ./internal/netguard/failed withos/exec.Command for a program not known to be local; start it with netguard.Commandforcmd/gendb/main.go; the same test passes onmain.Closes
Fixes #42
Fixes #43
Fixes #44
How to merge
Rebase and merge, so that each change stays its own commit on
main.