feat: adjust component analysis for java-api #128
Conversation
|
@zvigrinberg @ilan-pinto Please take a look. Thanks. |
| <vendor email="developers@redhat.com" url="https://www.redhat.com">Red-Hat</vendor> | ||
| <id>org.jboss.tools.intellij.analytics</id> | ||
| <name>Dependency Analytics</name> | ||
| <version>1.0</version> |
There was a problem hiding this comment.
There was a problem hiding this comment.
@xieshenzh seems to be Very good work!.
In addition to @ilan-pinto comment, see also couple of minor comments of mine.
kindly update README.md as well , to indicate that currently only npm and maven package managers are supported in this version.
Did you had a chance to test it on couple of pom.xml and package.json manifests?
have you had a chance to test it on manifests with the exhortignore feature? ( checking the behavior that the plugin ignore them completely - the java-api shouldn't return vulnerabilities/recommendations of dependencies marked in manifests with exhortignore back in the report) - i think we can approve at this stage without this feature, but it would be nice to check whether it's working as expected.
| public static boolean performAnalysis(String packageManager, | ||
| String fileName, | ||
| String filePath, | ||
| Collection<Dependency> dependencys) { |
There was a problem hiding this comment.
Kindly rename argument collection name to dependencies
| } | ||
|
|
||
| public static Map<Dependency, DependencyReport> getReports(String filePath, Collection<Dependency> dependencys) { | ||
| return getCache(filePath).getAllPresent(dependencys); |
There was a problem hiding this comment.
Kindly rename argument collection name to dependencies
|
Thanks @zvigrinberg README.md is updated in this PR: #129 I tested it mainly with these two projects: https://github.com/snyk-labs/java-goof and https://github.com/snyk-labs/nodejs-goof Scanning npm dependencies works when I changed the java-api to run the For maven projects, there is a scenario that the java-api doesn't work: the I also need to check |
Thanks @xieshenzh For what concern the error you've experienced with mvn help:effective-pom, Yes you're right, when starting the API Clients, we probably didn't take into account pom.xml with modules inside it, as it was designed only to pass content of the pom.xml and that's it( for component analysis), so in component analysis, we'll need to consider if we want to enhance it and to expose another overloaded method that will let you pass in a path/string of a directory containing pom.xml with directory modules - i'll track this activity by opening a new ticket. for exhortignore with maven, both cases you mentioned, i'll check it out. |
|
SonarCloud Quality Gate failed.
|
Get rid of the lsp. Create UI for component analysis that leverages exhort-java-api.