Expose a static only Go modules tactic. #1486
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
csasarak
force-pushed
the
go-static-analysis
branch
from
0b26dd9 to
1847732
Compare
csasarak
requested review from
a team and
jssblck
and removed request for
a team
jssblck
approved these changes
Dec 3, 2024
Comment on lines
+400
to
+401
| -- | This variant of analyze will not attempt to fill in transitive dependencies. | ||
| analyzeStatic :: (Has ReadFS sig m, Has Diagnostics sig m) => Path Abs File -> m (Graphing Dependency, GraphBreadth) |
There was a problem hiding this comment.
If this isn't in the user facing docs already please add it!
There was a problem hiding this comment.
Good idea, I've added it.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
We initially didn't expose a static only analysis method in the CLI for Go modules despite there being a pretty low-effort path to providing one. This PR makes a truly static Go analysis method and exposes it for use with the
--static-only-analysisflag.Acceptance criteria
It is possible to analyze go projects statically.
Testing plan
Compare running
fossa analyze --static-only-analysison this branch and in a release version. Static Go analysis fails using the current release version:But succeeds in the one on this branch:
Risks
The main risk is that projects which didn't produce a result in the past may start to. This is the correct thing to do, but may result in more questions.
Metrics
References
slack thread
Checklist
docs/.docs/README.msand gave consideration to how discoverable or not my documentation is.Changelog.md. If this PR did not mark a release, I added my changes into an## Unreleasedsection at the top..fossa.ymlorfossa-deps.{json.yml}, I updateddocs/references/files/*.schema.jsonAND I have updated example files used byfossa initcommand. You may also need to update these if you have added/removed new dependency type (e.g.pip) or analysis target type (e.g.poetry).docs/references/subcommands/<subcommand>.md.