Remove loose source-file fallback from language project detection#92
Remove loose source-file fallback from language project detection#92
Conversation
All language collectors (Go, Rust, Python, Java, PHP) had a fallback in their is_*_project() check that detected stray source files (e.g. .go, .rs, .java) via find. This caused false positives: repos with a few source files but no project manifest (go.mod, Cargo.toml, etc.) would trigger collectors that then wrote empty/error data to Component JSON. Now each detector requires its language's manifest file(s), matching the Node.js collector which already only checked for package.json. Also removes a now-redundant Cargo.toml guard in rust/clippy.sh since is_rust_project() already guarantees it.
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughThis PR tightens language project detection to require manifest files (no source-file fallbacks), adjusts Rust clippy preflight behavior, and makes Syft Rust license-detection path and existence checks more explicit and robust. Changes
Sequence Diagram(s)sequenceDiagram
participant Generate as collectors/syft/generate.sh
participant Cargo as cargo
participant FS as FileSystem
participant Py as rust-license-map.py
participant Logger as stderr
Generate->>Cargo: cargo fetch (populate registry)
Cargo-->>Generate: exit (success/failure)
Generate->>FS: test -d $REGISTRY_SRC
alt REGISTRY_SRC exists
Generate->>FS: test -f $PLUGIN_DIR/rust-license-map.py
alt python script exists
Generate->>Py: invoke rust-license-map.py with registry path
Py-->>Generate: output (license map)
else python script missing
Generate->>Logger: write "rust-license-map.py missing" error
end
else REGISTRY_SRC missing
Generate->>Logger: write "cargo registry source not found" error
end
Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Claude Auto-Approve ReviewSummary: Tightens language project detection across Go, Java, PHP, Python, and Rust collectors to require a build manifest file (go.mod, pom.xml, Cargo.toml, etc.) rather than falling back to scanning for loose source files. This is a sound change: the downstream tools in each collector (golangci-lint, cargo clippy, composer, etc.) all require these manifests to function, so detecting a "project" without one would just lead to failures later. The redundant Cargo.toml check in clippy.sh is correctly removed since is_rust_project now guarantees it. The syft/generate.sh change adds useful diagnostic logging and fixes a BASH_SOURCE portability edge case. All changes are consistent, well-commented, and low-risk. Scope: ISOLATED
Conclusion: ✅ Auto-approved (isolated changes, no issues) |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Related to: https://github.com/earthly/lunar-lib/pull/85/changes One PR makes the language detection more strict, the other makes policies leverage it so they are also not overly generous with applying to things they shouldn't |
Instead of only checking the repo root for manifest files, also search subdirectories via git ls-files (fast, reads the git index). This handles monorepos and projects with nested language roots. Falls back gracefully to root-only detection outside a git repo. Applies the same pattern to all six language helpers: golang, java, nodejs, php, python, rust.
|
Pushed 9f1dedf — all six language helpers (Go, Java, Node.js, PHP, Python, Rust) now search subdirs for manifest files using |
2 participants
Summary
All language collectors (Go, Rust, Python, Java, PHP) had a
find-based fallback in theiris_*_project()helper that detected stray source files (e.g..go,.rs,.javawithin depth 3). This caused false positives: repos with a few source files but no project manifest would trigger collectors that then wrote empty/error data to Component JSON — e.g. a Go block withgo_mod_exists: false,go_sum_exists: false, and golangci-lint failing with "directory prefix . does not contain main module."Now each detector requires its language's manifest file(s), matching the Node.js collector which already only checked for
package.json.Changes
go.modOR.gofilesgo.modonlyCargo.tomlOR.rsfilesCargo.tomlonly.pyfilespom.xml/build.gradleOR.javafilescomposer.jsonOR.phpfilescomposer.jsononlyAlso removes a now-redundant
Cargo.tomlguard inrust/clippy.shsinceis_rust_project()already guarantees it.🤖 This PR was implemented by an AI agent.
Summary by CodeRabbit