feat: Go, NPM and Yarn detection#451
Conversation
df3ac6a to
49ee1ef
Compare
f2507a5 to
97e5244
Compare
dd80b32 to
4e5815d
Compare
|
We should also add pnpm ,pnpm-lock.yaml, and the publish command. |
Should this be a separate class or is it alright to roll it in with npm (i.e. npm build tool looks for both npm and pnpm files)? Since far as I can see from a quick glance for purposes of this its more or less same as npm except for the command/lock file, so I feel like an extra class would be a lot of repeat code that would be a pain to manage in future |
If they are mostly equivalent, we can add it to the |
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
…service Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
203af26 to
a7219b2
Compare
Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
a7219b2 to
96de341
Compare
This PR adds detection capabilities for projects using Go, npm and Yarn as their build tools. Note this PR does not add dependency resolution of these tools, only detection, but dependencies can be provided as a CycloneDX SBOM using `--sbom-path` CLI argument to analyze their dependencies. The `defaults.ini` file defines the specification for detection of Go, npm and Yarn projects in the relevant sections. Signed-off-by: Tim Yarkov <timdyarkov@gmail.com>
To increase the breadth of what macaron can detect, this PR adds detection capabilities for projects using Go, NPM and Yarn as their build tools. Note this does not include dependency resolution of these tools, only detection.
defaults.inidefines the patterns for detection of Go, NPM and Yarn projects in the relevant sectionsgo.modfile, with a build keyword of either build or install. Since go doesn't have any in-built publishing/deployment, the publisher is taken as usinggoreleaserwith the deploy keywordrelease. In a similar vein to thisgoreleaser/goreleaser-actionis the Github Action looked for.package.json/package-lock.json/.npmrc(whether to accept strange combinations of these like only having a.npmrcor something I'm going to assume is for later PRs), with a build keyword ofbuildand a deployment keyword ofpublish. For github actions it looks forJS-DevTools/npm-publish.npmrcit looks for.yarnrc(for yarn classic) or.yarnrc.yml(for yarn modern). For yarn classic the deployment keyword is stillpublish, but to support yarn modern the keywordnpm publishis also supported. Also, it doesn't have any associated CI actions defined as of now.Linked issues: #363 #443
To clarify before merging this PR:
go.modfiles within the codebase seems to break the pre-commit hooks at least (for each go related hook it's an exit code of 1 with the only shown errorgo: warning: "./..." matched no packages), guessing it would break more stuff. Need to sort out this out some sort of way