@produtype/core 0.91.0 → 0.92.0

package/dist/analyzer/analyzeProject.js

@@ -157,6 +157,23 @@ function parsePyprojectSections(text, runtimeOnly) {
     }
     return deps;
 }
+/**
+ * Everything after `src/main/java` is a package name, not a project layout.
+ *
+ * spring-petclinic lives in `org.springframework.samples.petclinic`, so every one of
+ * its thirty Java files sits under a path segment called `samples` — and the rule that
+ * removes sample code removed the whole application. The report saw a project with no
+ * Java in it at all: twelve files, an HTML front end, no backend, and a profile of
+ * `client-app` at high confidence for a Spring Boot server.
+ *
+ * Maven and Gradle both fix that prefix, so the segments after it are the author's
+ * package and mean nothing about the layout. A real sample directory sits beside
+ * `src`, not inside its source root — ktor-documentation keeps its under
+ * `codeSnippets/snippets/`, which this still removes.
+ */
+function isAPackageName(file) {
+    return /(^|\/)src\/(main|test)\/(java|kotlin|scala|groovy)\//.test(file);
+}
 function isTestOrExamplePath(file) {
     // `__mocks__` was missing, and a mock is the most misleading file in a repository:
     // `application_fee_percent: null` inside a Stripe fixture made an open-source CRM read
@@ -219,7 +236,7 @@ function isTestOrExamplePath(file) {
          * spell it. A repository whose every source file is a sample now has no source
          * files, and says so — which is the honest answer for one.
          */
-        || /(^|\/)(samples?|snippets?|codesnippets)(\/|$)/i.test(file)
+        || (/(^|\/)(samples?|snippets?|codesnippets)(\/|$)/i.test(file) && !isAPackageName(file))
         /**
          * Somebody else's code, vendored in.
          *

package/dist/analyzer/detectObservability.js

@@ -60,7 +60,25 @@ async function detectObservability(ctx) {
     const healthFiles = ctx.files.all.filter((file) => /(^|\/)(health|healthz|readyz|liveness|readiness)(\/route|\.[a-z]+)?$|(^|\/)(health|healthz|readyz)\//i.test(file));
     for (const file of healthFiles)
         evidence.push({ type: 'file', value: file, claim: 'health' });
-    const hasHealth = healthFiles.length > 0 || hits.some((h) => /\/(health|healthz|readyz|livez|alive)\b/i.test(h.snippet));
+    /**
+     * Spring Boot Actuator, which is the endpoint rather than a route to it.
+     *
+     * Adding `spring-boot-starter-actuator` publishes `/actuator/health` — exposed by
+     * default, with no route written anywhere — so a project that has it cannot be
+     * found by searching for a path. spring-petclinic declares it in both its pom and
+     * its build.gradle and was reported as having no health endpoint.
+     *
+     * A deliberate dependency, unlike two things this file and its neighbour decline to
+     * count: Dropwizard's admin `/healthcheck`, which every Dropwizard application has
+     * for being Dropwizard, and Django's `SecurityMiddleware`, which `startproject`
+     * writes into every new project. Actuator is in no Spring application by default.
+     */
+    const actuator = (0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-boot-starter-actuator']);
+    for (const dep of actuator)
+        evidence.push({ type: 'dependency', value: dep, claim: 'health' });
+    const hasHealth = healthFiles.length > 0
+        || actuator.length > 0
+        || hits.some((h) => /\/(health|healthz|readyz|livez|alive)\b/i.test(h.snippet));
     const hasReqId = hits.some((h) => /x-request-id|correlation-id/i.test(h.snippet));
     // Structured logging without a logging library is still structured logging. What
     // matters is that entries are machine-readable and correlated, not which package

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.91.0",
+  "version": "0.92.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {