@produtype/core 1.20.0 → 1.21.1

package/dist/analyzer/detectObservability.js

@@ -33,15 +33,57 @@ const LOGGING_PACKAGES = [
 ];
 /** Elixir reaches for a backend rather than a logger: Logger itself is in OTP. */
 const ELIXIR_LOGGING_PACKAGES = ['logger_json', 'logger_file_backend', 'sentry'];
+/**
+ * The route, in every spelling somebody writes it.
+ *
+ * `\/(health|healthz|readyz|livez|alive)\b` does not match `/healthcheck`: after
+ * `health` comes a `c`, and the boundary fails. Netflix's dispatch declares
+ * `@api_router.get("/healthcheck")` and was told it has no health endpoint — the
+ * plainest spelling there is, missed by the pattern meant to find it.
+ *
+ * This does not disturb the decision recorded below about Dropwizard. That one is
+ * about an endpoint the *framework* publishes, which no Dropwizard application writes
+ * in its own source; a line like dispatch's is somebody declaring the route
+ * themselves.
+ */
+const HEALTH_ROUTE = /\/(health|healthz|healthcheck|health[-_]check|readyz|livez|alive)\b/i;
 async function detectObservability(ctx) {
     const evidence = [];
-    const logDeps = [...(0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES), ...(0, detectContext_1.hasAnyElixirDep)(ctx, ELIXIR_LOGGING_PACKAGES)];
+    /**
+     * .NET names its logging in the project file and nothing here was reading it.
+     *
+     * Radarr declares `NLog`, `NLog.Extensions.Logging` and
+     * `NLog.Layouts.ClefJsonLayout` — CLEF being the compact JSON event format — and
+     * was reported as logging something but not structurally. The npm list has had
+     * winston and pino since the beginning and treats the dependency alone as enough;
+     * these are the same statement in another manifest.
+     */
+    const DOTNET_LOGGING_PACKAGES = ['NLog', 'NLog.Extensions.Logging', 'Serilog', 'Serilog.AspNetCore', 'Microsoft.Extensions.Logging', 'log4net'];
+    const logDeps = [
+        ...(0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES),
+        ...(0, detectContext_1.hasAnyElixirDep)(ctx, ELIXIR_LOGGING_PACKAGES),
+        ...(0, detectContext_1.hasAnyDotnetDep)(ctx, DOTNET_LOGGING_PACKAGES),
+    ];
     const sentryDeps = (0, detectContext_1.hasAnyDep)(ctx, ['@sentry/node', 'sentry-sdk']);
     for (const d of logDeps)
         evidence.push({ type: 'dependency', value: d, claim: 'logging' });
     for (const d of sentryDeps)
         evidence.push({ type: 'dependency', value: d, claim: 'logging' });
-    const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/\/(health|healthz|readyz|livez|alive)\b/i, /x-request-id/i, /correlation-id/i, /error\s*handler/i, /RotatingFileHandler/i], 25);
+    /**
+     * An import path is not a route.
+     *
+     * `import Health from 'typings/Health';` is a TypeScript type in Radarr's frontend,
+     * and `/Health'` matches the route pattern exactly as `/health` in a URL does. It
+     * was the evidence behind Radarr's passing health check — a false pass, which is
+     * the direction that raises a score rather than lowering one.
+     *
+     * Imports are good evidence elsewhere and are left alone there; this is the search
+     * for a *route*, and a module specifier is never one. Filtered inside the search so
+     * that a frontend full of them cannot spend the budget before a real route is
+     * reached.
+     */
+    const IMPORT_LINE = /^\s*(?:import\b|from\s+['"]|const\s+\{?[\w\s,}]*\}?\s*=\s*require\()/;
+    const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [HEALTH_ROUTE, /x-request-id/i, /correlation-id/i, /error\s*handler/i, /RotatingFileHandler/i], 25, (match) => !IMPORT_LINE.test(match.snippet));
     /**
      * One search, three answers, so the claim is decided per hit rather than per search.
      *
@@ -50,7 +92,7 @@ async function detectObservability(ctx) {
      * is what the line is evidence of.
      */
     for (const m of hits) {
-        const claim = /\/(health|healthz|readyz|livez|alive)\b/i.test(m.snippet)
+        const claim = HEALTH_ROUTE.test(m.snippet)
             ? 'health'
             : /x-request-id|correlation-id/i.test(m.snippet)
                 ? 'request-id'
@@ -116,7 +158,7 @@ async function detectObservability(ctx) {
     const hasHealth = declaredProbes.length > 0
         || healthFiles.length > 0
         || actuator.length > 0
-        || hits.some((h) => /\/(health|healthz|readyz|livez|alive)\b/i.test(h.snippet));
+        || hits.some((h) => HEALTH_ROUTE.test(h.snippet));
     const hasReqId = hits.some((h) => /x-request-id|correlation-id/i.test(h.snippet));
     // Structured logging without a logging library is still structured logging. What
     // matters is that entries are machine-readable and correlated, not which package

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.20.0",
+  "version": "1.21.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {