@produtype/core 0.91.0 → 0.93.0

package/dist/analyzer/analyzeProject.js

@@ -157,6 +157,34 @@ function parsePyprojectSections(text, runtimeOnly) {
     }
     return deps;
 }
+/**
+ * Everything after `src/main/java` is a package name, not a project layout.
+ *
+ * spring-petclinic lives in `org.springframework.samples.petclinic`, so every one of
+ * its thirty Java files sat under a path segment called `samples`, and the rule that
+ * removes sample code removed the whole application: twelve files, an HTML front end,
+ * no backend, and `client-app` at high confidence for a Spring Boot server.
+ *
+ * It was not only `samples`. `spring-test/src/main/java/org/springframework/mock/`
+ * holds forty-four files — `MockHttpServletRequest` and its neighbours, shipped in the
+ * jar and the whole point of that module — and the rule that removes `mocks/` removed
+ * every one of them. A package can be called anything: `vendor`, `testing`, `fixtures`
+ * are all ordinary domain words.
+ *
+ * Maven and Gradle fix the `src/main/<language>` prefix, so directory rules are
+ * applied to the path *up to* it and never to the package below.
+ *
+ * Only `main` is named, and that is a statement of intent rather than a rule doing
+ * work: `src/test/java/...` stays excluded either way, because the boundary itself
+ * contains `test` and the directory rule matches it. Writing `main|test` here fails
+ * no test, which is worth saying instead of implying a protection that is not there.
+ */
+const JVM_MAIN_SOURCE_ROOT = /(^|\/)src\/main\/(java|kotlin|scala|groovy)\//;
+/** The part of the path that describes layout rather than package. */
+function layoutPartOf(file) {
+    const root = JVM_MAIN_SOURCE_ROOT.exec(file);
+    return root ? file.slice(0, root.index + root[0].length) : file;
+}
 function isTestOrExamplePath(file) {
     // `__mocks__` was missing, and a mock is the most misleading file in a repository:
     // `application_fee_percent: null` inside a Stripe fixture made an open-source CRM read
@@ -164,7 +192,8 @@ function isTestOrExamplePath(file) {
     // `fixtures` was listed and `fixture` was not, so `extra/fixture/authsources.php`
     // made PHP one of the languages of an Elixir analytics product — and of cal.com,
     // which is TypeScript.
-    return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures?|frontend-example)(\/|$)/i.test(file)
+    const layout = layoutPartOf(file);
+    return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures?|frontend-example)(\/|$)/i.test(layout)
         /**
          * The conventions other ecosystems use, which this list did not know.
          *
@@ -175,7 +204,7 @@ function isTestOrExamplePath(file) {
          * would have parsed the same files and reached the same wrong conclusion, which is
          * the argument for fixing what gets read before fixing how.
          */
-        || /(^|\/)(spec|specs|e2e|integration-tests?|cypress|playwright|testing)(\/|$)/i.test(file)
+        || /(^|\/)(spec|specs|e2e|integration-tests?|cypress|playwright|testing)(\/|$)/i.test(layout)
         || /\.(e2e|e2e-spec|cy|stories)\.(ts|tsx|js|jsx|mjs|cjs)$/i.test(file)
         || /_spec\.rb$/i.test(file)
         || /_test\.(go|py|rb|java|cs|php)$/i.test(file)
@@ -219,7 +248,7 @@ function isTestOrExamplePath(file) {
          * spell it. A repository whose every source file is a sample now has no source
          * files, and says so — which is the honest answer for one.
          */
-        || /(^|\/)(samples?|snippets?|codesnippets)(\/|$)/i.test(file)
+        || /(^|\/)(samples?|snippets?|codesnippets)(\/|$)/i.test(layout)
         /**
          * Somebody else's code, vendored in.
          *
@@ -228,7 +257,7 @@ function isTestOrExamplePath(file) {
          * crate copied in whole. A manifest under a vendor directory is a statement about
          * that library, not about this product.
          */
-        || /(^|\/)(vendor|vendored|third[-_]?party|external[-_]crates)(\/|$)/i.test(file);
+        || /(^|\/)(vendor|vendored|third[-_]?party|external[-_]crates)(\/|$)/i.test(layout);
 }
 /**
  * Extensions the detectors can read.

package/dist/analyzer/detectObservability.js

@@ -60,7 +60,25 @@ async function detectObservability(ctx) {
     const healthFiles = ctx.files.all.filter((file) => /(^|\/)(health|healthz|readyz|liveness|readiness)(\/route|\.[a-z]+)?$|(^|\/)(health|healthz|readyz)\//i.test(file));
     for (const file of healthFiles)
         evidence.push({ type: 'file', value: file, claim: 'health' });
-    const hasHealth = healthFiles.length > 0 || hits.some((h) => /\/(health|healthz|readyz|livez|alive)\b/i.test(h.snippet));
+    /**
+     * Spring Boot Actuator, which is the endpoint rather than a route to it.
+     *
+     * Adding `spring-boot-starter-actuator` publishes `/actuator/health` — exposed by
+     * default, with no route written anywhere — so a project that has it cannot be
+     * found by searching for a path. spring-petclinic declares it in both its pom and
+     * its build.gradle and was reported as having no health endpoint.
+     *
+     * A deliberate dependency, unlike two things this file and its neighbour decline to
+     * count: Dropwizard's admin `/healthcheck`, which every Dropwizard application has
+     * for being Dropwizard, and Django's `SecurityMiddleware`, which `startproject`
+     * writes into every new project. Actuator is in no Spring application by default.
+     */
+    const actuator = (0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-boot-starter-actuator']);
+    for (const dep of actuator)
+        evidence.push({ type: 'dependency', value: dep, claim: 'health' });
+    const hasHealth = healthFiles.length > 0
+        || actuator.length > 0
+        || hits.some((h) => /\/(health|healthz|readyz|livez|alive)\b/i.test(h.snippet));
     const hasReqId = hits.some((h) => /x-request-id|correlation-id/i.test(h.snippet));
     // Structured logging without a logging library is still structured logging. What
     // matters is that entries are machine-readable and correlated, not which package

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.91.0",
+  "version": "0.93.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {