gurney_client 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6e7470d3ea652657be230f28b42b3035ee0e2c47122dc297533428831fc20b2b
-  data.tar.gz: 7e3bf5796d850cc8e600959a348f521d9d7ee10f5f7e329da391c0b125f57db0
+  metadata.gz: 1097c1c98d3799765d40e6a5263a1fe58baa6a4df542570f91654247218b7d64
+  data.tar.gz: 953fe191235e0c338cb71a690284ff5beed7e36f26a511fe1cb3f6311493ef82
 SHA512:
-  metadata.gz: c04cfc2febd10dcb6be12b4b8466f5c11d308954c57a7588a0bb41100f64eabc4656867af4d97d1c2d40ee607d5a3206e8fc3c0477021d04efd471c599abd540
-  data.tar.gz: cb327dd15bfd5aea5c30a87ff271555c17c9e29c8ec35379fa9bdb4ce3fd21b935e6ba80d1a0057abdd7f75b76d263da1089b209bce7576c857ca570f0f563e8
+  metadata.gz: 41cd13cf0b65dca7b568cd00f2a3dc95045ae3a6cdb8e896b24e9dcc755efc21fd24d3a328388604d3e783ce2a64f1dfe864d17f745df6ae957f032a4a1131b5
+  data.tar.gz: b00a53d0aa50995c7be657090d50c906e5914cf5ee1dd5d3b14c74679400f356b49ded4fc653c525ca962d1a2755ceba12be27f32c0361b358c6011d19477cad

data/CHANGELOG.md

@@ -1,13 +1,37 @@
-# Gurney changelog
+# Changelog
 
-## 0.4.0 (2024-11-15)
+All notable changes to this project will be documented in this file.
+This project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
+
+## Unreleased
+
+### Compatible changes
+
+### Breaking changes
+
+
+## 0.5.0 2025-03-26
+
+### Compatible changes
+* Dependencies are also parsed from package-lock.json and pnpm-lock.yaml if present.
+
+
+## 0.4.0 2024-11-15
+
+### Compatible changes
 * Added: Reporting of the repository path as identifier. Should it ever change,
   it is an indicator for an unchanged gurney.yml in a project fork, and the 
   API may respond with an error.
 
-## 0.3.0 (2024-11-14)
+
+## 0.3.0 2024-11-14
+
+### Compatible changes
 * Added: Compatibility with Ruby 3
 * Fixed: Support UTF-8 chars in branch names
 
-## 0.2.3 (2023-05-24)
+
+## 0.2.3 2023-05-24
+
+### Compatible changes
 * Added: Suppress Bundler's "the Bundler version is older than the one in the lockfile" warning.

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gurney_client (0.4.0)
+    gurney_client (0.5.0)
       bundler (< 3)
       colorize (~> 0.8)
       git (~> 1.5)

data/lib/gurney/cli.rb

@@ -40,7 +40,8 @@ module Gurney
       end
 
       config_file = MAIN_BRANCHES.find do |branch|
-        file = read_file(options.hook, branch, options.config_file)
+        git_file_reader = GitFileReader.new(git, branch, read_from_git: options.hook)
+        file = git_file_reader.read(options.config_file)
         break file if file
       end
       if options.hook && !config_file
@@ -64,18 +65,8 @@ module Gurney
 
     def run
       reporting_branches.each do |branch|
-        dependencies = []
-
-        yarn_source = Gurney::Source::Yarn.new(yarn_lock: read_file(options.hook || options.client_hook, branch, 'yarn.lock'))
-        dependencies.concat yarn_source.dependencies || []
-
-        bundler_source = Gurney::Source::Bundler.new(gemfile_lock: read_file(options.hook || options.client_hook, branch, 'Gemfile.lock'))
-        dependencies.concat bundler_source.dependencies || []
-
-        ruby_version_source = Gurney::Source::RubyVersion.new(ruby_version: read_file(options.hook || options.client_hook, branch, '.ruby-version'))
-        dependencies.concat ruby_version_source.dependencies || []
-
-        dependencies.compact!
+        git_file_reader = GitFileReader.new(git, branch, read_from_git: options.hook || options.client_hook)
+        dependencies = DependencyCollector.new(git_file_reader).collect_all
 
         api = Gurney::Api.new(base_url: options.api_url, token: options.api_token)
         api.post_dependencies(dependencies: dependencies, branch: branch, project_id: options.project_id, repo_path: git.repo.path)
@@ -115,17 +106,5 @@ module Gurney
       branches
     end
 
-    def read_file(from_git, branch, filename)
-      if from_git
-        begin
-          git.show("#{branch}:#{filename}")
-        rescue Git::GitExecuteError
-          # happens if branch does not exist
-        end
-      else
-        File.read(filename) if File.exist?(filename)
-      end
-    end
-
   end
 end

data/lib/gurney/dependency_collector.rb

@@ -0,0 +1,64 @@
+module Gurney
+  class DependencyCollector
+
+    def initialize(git_file_reader)
+      @git_file_reader = git_file_reader
+    end
+
+    def collect_all
+      dependencies = []
+
+      dependencies.concat npm_dependencies
+      dependencies.concat bundler_dependencies
+      dependencies.concat ruby_version_dependencies
+
+      dependencies.compact
+    end
+
+    private
+
+    def bundler_dependencies
+      bundler_source = Gurney::Source::Bundler.new(gemfile_lock: @git_file_reader.read('Gemfile.lock'))
+      bundler_source.dependencies || []
+    end
+
+    def ruby_version_dependencies
+      ruby_version_source = Gurney::Source::RubyVersion.new(ruby_version: @git_file_reader.read('.ruby-version'))
+      ruby_version_source.dependencies || []
+    end
+
+    def npm_dependencies
+      npm_dependencies = []
+
+      if yarn_lock
+        yarn_source = Gurney::Source::Yarn.new(yarn_lock: yarn_lock)
+        npm_dependencies.concat(yarn_source.dependencies || [])
+      end
+
+      if package_lock_json
+        npm_source = Gurney::Source::Npm.new(package_lock_json: package_lock_json)
+        npm_dependencies.concat(npm_source.dependencies || [])
+      end
+
+      if pnpm_lock
+        pnpm_source = Gurney::Source::Pnpm.new(pnpm_lock: pnpm_lock)
+        npm_dependencies.concat(pnpm_source.dependencies || [])
+      end
+
+      npm_dependencies
+    end
+
+    def yarn_lock
+      @yarn_lock ||= @git_file_reader.read('yarn.lock')
+    end
+
+    def package_lock_json
+      @package_lock_json = @git_file_reader.read('package-lock.json')
+    end
+
+    def pnpm_lock
+      @pnpm_lock = @git_file_reader.read('pnpm-lock.yaml')
+    end
+
+  end
+end

data/lib/gurney/git_file_reader.rb

@@ -0,0 +1,23 @@
+module Gurney
+  class GitFileReader
+
+    def initialize(git, branch, read_from_git:)
+      @git = git
+      @branch = branch
+      @read_from_git = read_from_git
+    end
+
+    def read(filename)
+      if @read_from_git
+        begin
+          @git.show("#{@branch}:#{filename}")
+        rescue Git::GitExecuteError
+          # happens if branch does not exist
+        end
+      else
+        File.read(filename) if File.exist?(filename)
+      end
+    end
+
+  end
+end

data/lib/gurney/source/npm.rb

@@ -0,0 +1,58 @@
+require 'json'
+require 'colorize'
+
+module Gurney
+  module Source
+    class Npm < Base
+
+      SUPPORTED_LOCKFILE_VERSIONS = [2, 3].freeze
+     
+      def initialize(package_lock_json:)
+        @package_lock_json = package_lock_json
+      end
+
+      def present?
+        !@package_lock_json&.empty?
+      end
+
+      def dependencies
+        if present?
+          parsed_lock = JSON.parse(@package_lock_json)
+
+          if SUPPORTED_LOCKFILE_VERSIONS.include?(parsed_lock['lockfileVersion'])
+            extract_dependencies(parsed_lock)
+          else
+            puts "package-lock.json: Lockfile version #{parsed_lock['lockfileVersion']} is unsupported. No npm dependencies reported.".yellow
+            []
+          end
+        end
+      rescue JSON::ParserError => e
+        raise Gurney::Error.new("Invalid package-lock.json format: #{e.message}")
+      end
+
+      private
+
+      attr_reader :package_lock_json
+
+      def extract_dependencies(parsed_lock)
+        dependencies = []
+
+        if parsed_lock['packages']
+          parsed_lock['packages'].each do |path_to_package, details|
+            next if path_to_package == ''
+
+            name = path_to_package.sub(/^node_modules\//, '') # remove "node_modules/" prefix to get package name
+            dependencies << Dependency.new(
+              ecosystem: 'npm',
+              name: name,
+              version: details['version']
+            )
+          end
+        end
+
+        dependencies
+      end
+
+    end
+  end
+end

data/lib/gurney/source/pnpm.rb

@@ -0,0 +1,54 @@
+require 'yaml'
+require 'colorize'
+
+module Gurney
+  module Source
+    class Pnpm < Base
+      def initialize(pnpm_lock:)
+        @pnpm_lock = pnpm_lock
+      end
+
+      def present?
+        !@pnpm_lock&.empty?
+      end
+
+      def dependencies
+        if present?
+          parsed_lock = YAML.safe_load(@pnpm_lock)
+
+          major_version = parsed_lock['lockfileVersion'].split('.').first
+          if major_version == '9'
+            extract_dependencies(parsed_lock)
+          else
+            puts "pnpm-lock.yaml: Lockfile version #{major_version} is unsupported. No npm dependencies reported.".yellow
+            []
+          end
+        end
+      rescue Psych::SyntaxError => e
+        raise Gurney::Error.new("Invalid pnpm-lock.yaml format: #{e.message}")
+      end
+
+      private
+
+      attr_reader :pnpm_lock
+
+      def extract_dependencies(parsed_lock)
+        dependencies = []
+
+        # dependency_id has format <scoped_pkg_name>@<pkg_version>
+        # see https://github.com/pnpm/spec/blob/master/lockfile/9.0.md#packages
+        parsed_lock['packages'].each_key do |dependency_id|
+          name, _, version = dependency_id.rpartition('@')
+          dependencies << Dependency.new(
+            ecosystem: 'npm',
+            name: name,
+            version: version
+          )
+        end
+
+        dependencies
+      end
+
+    end
+  end
+end 

data/lib/gurney/version.rb

@@ -1,3 +1,3 @@
 module Gurney
-  VERSION = '0.4.0'
+  VERSION = '0.5.0'
 end

data/lib/gurney.rb

@@ -1,8 +1,12 @@
 require_relative 'gurney/version'
 require_relative 'gurney/config'
+require_relative 'gurney/git_file_reader'
 require_relative 'gurney/dependency'
+require_relative 'gurney/dependency_collector'
 require_relative 'gurney/source/base'
 require_relative 'gurney/source/yarn'
+require_relative 'gurney/source/npm'
+require_relative 'gurney/source/pnpm'
 require_relative 'gurney/source/bundler'
 require_relative 'gurney/source/ruby_version'
 require_relative 'gurney/api'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gurney_client
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Martin Schaflitzl
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-11-15 00:00:00.000000000 Z
+date: 2025-03-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize
@@ -66,7 +66,7 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.5'
-description: 
+description:
 email:
 - martin.schaflitzl@makandra.de
 executables:
@@ -93,8 +93,12 @@ files:
 - lib/gurney/cli/option_parser.rb
 - lib/gurney/config.rb
 - lib/gurney/dependency.rb
+- lib/gurney/dependency_collector.rb
+- lib/gurney/git_file_reader.rb
 - lib/gurney/source/base.rb
 - lib/gurney/source/bundler.rb
+- lib/gurney/source/npm.rb
+- lib/gurney/source/pnpm.rb
 - lib/gurney/source/ruby_version.rb
 - lib/gurney/source/yarn.rb
 - lib/gurney/version.rb
@@ -103,7 +107,7 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -118,8 +122,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.1.0
+signing_key:
 specification_version: 4
 summary: Gurney is a small tool to extract yarn and RubyGems dependencies from project
   files and report them to a web api.