quoll-cli 0.2.0__py3-none-any.whl

quoll/languages/cpp/detect.py

@@ -0,0 +1,84 @@
+from __future__ import annotations
+
+import re
+from typing import List
+
+from quoll.languages.base import Detection
+from quoll.project import Project
+from quoll.services import detect_services
+
+# Toolchains, as "<compiler>-<major>" (packages of the Ubuntu 24.04 runners and images).
+COMPILER_DEFAULT = "gcc-14"
+COMPILERS = ("gcc-14", "clang-18")
+
+# Libraries (CMake packages, vcpkg ports, Conan references) revealing a backing service.
+_SERVICE_LIBRARIES = {
+    "postgres": ("libpq", "libpqxx", "postgresql", "pq"),
+    "mysql": ("libmysqlclient", "mysqlclient", "mariadb-connector-c", "mysql-connector-cpp"),
+    "redis": ("hiredis", "redis-plus-plus"),
+    "mongodb": ("mongo-cxx-driver", "mongocxx", "mongo-c-driver"),
+}
+# What makes CTest run tests.
+_CTEST = re.compile(
+    r"\b(enable_testing|add_test|include\s*\(\s*CTest|gtest_discover_tests|catch_discover_tests)\b", re.I
+)
+
+
+def detect(project: Project) -> Detection:
+    det = Detection(version=COMPILER_DEFAULT, matrix_versions=list(COMPILERS))
+    meson = project.exists("meson.build") and not project.exists("CMakeLists.txt")
+    if meson:
+        det.package_manager = "meson"
+    elif project.glob_any("conanfile.txt", "conanfile.py"):
+        det.package_manager = "conan"
+        det.lockfile = "conan.lock" if project.exists("conan.lock") else ""
+    elif project.exists("vcpkg.json"):
+        det.package_manager = "vcpkg"
+    else:
+        det.package_manager = "cmake"
+    # Dependencies are resolved while configuring the build (FetchContent, Conan, vcpkg, wraps).
+    det.install = "meson setup build" if meson else "cmake -S . -B build"
+
+    det.lint_tools = [tool for tool, config in (("clang-format", ".clang-format"), ("clang-tidy", ".clang-tidy"))
+                      if project.exists(config)]
+    det.lint_tools.append("cppcheck")
+
+    build_files = cmake_files(project) if not meson else project.read_text("meson.build")
+    if meson and re.search(r"\btest\s*\(", build_files):
+        det.test_runner = "meson"
+    elif not meson and _CTEST.search(build_files):
+        det.test_runner = "ctest"
+    else:
+        det.warnings.append("No tests found (enable_testing()/add_test() or meson test()) — the test job is disabled.")
+    det.sanitizers = True
+
+    # osv-scanner reads conan.lock; there is no vulnerability database for other C/C++ dependencies.
+    det.audit = bool(det.lockfile)
+    if not det.audit:
+        det.warnings.append("No conan.lock: no dependency audit for C/C++ (Semgrep and the image scan still run).")
+
+    manifests = " ".join([build_files, project.read_text("vcpkg.json"), project.read_text("conanfile.txt"),
+                          project.read_text("conanfile.py")]).lower()
+    det.services = detect_services(
+        [lib for libs in _SERVICE_LIBRARIES.values() for lib in libs if re.search(rf"\b{re.escape(lib)}\b", manifests)],
+        _SERVICE_LIBRARIES,
+    )
+    det.build_command = "meson compile -C build" if meson else "cmake --build build"
+    return det
+
+
+def cmake_files(project: Project) -> str:
+    """The root CMakeLists.txt and those of the first-level directories (src/, tests/...)."""
+    nested = (p.relative_to(project.root).as_posix() for p in project.glob("*/CMakeLists.txt"))
+    paths: List[str] = ["CMakeLists.txt", *nested]
+    return "\n".join(project.read_text(p) for p in paths)
+
+
+def executable(project: Project) -> str:
+    """The first executable target that isn't a test."""
+    if project.exists("meson.build"):
+        pattern, text = r"executable\s*\(\s*['\"]([\w.-]+)['\"]", project.read_text("meson.build")
+    else:
+        pattern, text = r"add_executable\s*\(\s*([\w.-]+)", cmake_files(project)
+    names = [n for n in re.findall(pattern, text, re.I) if not re.search(r"test", n, re.I)]
+    return names[0] if names else ""

quoll/languages/cpp/docker.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Dict, List
+
+from quoll.languages.base import Detection, DockerDefaults, DockerImage
+from quoll.languages.cpp.detect import executable
+from quoll.project import Project
+
+if TYPE_CHECKING:
+    from quoll.docker.config import DockerConfig
+
+
+# Build tools on top of the gcc image.
+_PACKAGES = {
+    "cmake": ("cmake", "ninja-build"),
+    "conan": ("cmake", "ninja-build", "pipx"),
+    "vcpkg": ("cmake", "ninja-build", "curl", "zip", "unzip", "tar", "pkg-config"),
+    "meson": ("meson", "ninja-build"),
+}
+
+
+class CppImage(DockerImage):
+    def defaults(self, project: Project, det: Detection) -> DockerDefaults:
+        warnings = ["C/C++ programs don't say which port they listen on — check docker.port."]
+        target = executable(project)
+        if not target:
+            warnings.append("No executable target found (add_executable / executable()) — check docker.command.")
+        if det.package_manager == "meson":
+            build = "meson setup build --buildtype=release && meson compile -C build"
+        else:
+            build = "cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release && cmake --build build"
+        return DockerDefaults(port=8080, command="/app", build_command=build, warnings=warnings)
+
+    def context(self, project: Project, cfg: DockerConfig) -> Dict[str, Any]:
+        compiler, _, major = cfg.version.partition("-")
+        return {
+            # The official gcc image builds both C and C++; clang projects build with the same major of GCC's
+            # libstdc++ either way.
+            "gcc_tag": major if compiler == "gcc" and major else "14",
+            "target": executable(project) or project.name,
+            "packages": " ".join(_PACKAGES[cfg.package_manager]),
+            "conan": cfg.package_manager == "conan",
+            "vcpkg": cfg.package_manager == "vcpkg",
+        }
+
+    def dockerignore(self, cfg: DockerConfig) -> List[str]:
+        return ["build", "build-*", "cmake-build-*", "out", ".env", ".env.*", "!.env.example"]

quoll/languages/dotnet/Dockerfile.j2

@@ -0,0 +1,21 @@
+{% block build %}
+FROM mcr.microsoft.com/dotnet/sdk:{{ cfg.version }} AS build
+WORKDIR /src
+COPY . .
+RUN --mount=type=cache,target=/root/.nuget/packages \
+    {{ cfg.build_command }}
+{% endblock %}
+
+{% block runtime %}
+FROM mcr.microsoft.com/dotnet/{{ "aspnet" if web else "runtime" }}:{{ cfg.version }}
+{{ os_updates }}
+WORKDIR /app
+COPY --from=build /out .
+{% if web %}
+ENV ASPNETCORE_HTTP_PORTS={{ cfg.port }}
+{% endif %}
+# Non-root user provided by the .NET images.
+USER $APP_UID
+EXPOSE {{ cfg.port }}
+CMD {{ cfg.command | exec_form }}
+{% endblock %}

quoll/languages/dotnet/__init__.py

@@ -0,0 +1,17 @@
+""".NET: C#, F# and VB projects and solutions."""
+
+from quoll.languages.base import Language
+from quoll.languages.dotnet.ci import DotnetCI
+from quoll.languages.dotnet.detect import detect
+from quoll.languages.dotnet.docker import DotnetImage
+
+language = Language(
+    name="dotnet",
+    markers=("*.sln", "*.slnx", "*.csproj", "*.fsproj", "*.vbproj"),
+    package_managers=("dotnet",),
+    lint_tools=("dotnet-format",),
+    test_runners=("dotnet",),
+    detect=detect,
+    ci=DotnetCI(),
+    docker=DotnetImage(),
+)

quoll/languages/dotnet/ci.py

@@ -0,0 +1,88 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Sequence
+
+from quoll.ci.steps import ROOT, Cache, Item, step
+from quoll.languages.base import CISteps, TestReports
+from quoll.platforms.github.actions import ACTIONS
+
+if TYPE_CHECKING:
+    from quoll.ci.config import CIConfig
+
+# `dotnet list package --vulnerable` always exits 0: fail on high or critical advisories ourselves.
+_AUDIT = """dotnet list package --vulnerable --include-transitive 2>&1 | tee vulnerable.txt
+if grep -qE "\\b(High|Critical)\\b" vulnerable.txt; then
+  echo "::error::Packages with high or critical vulnerabilities found"
+  exit 1
+fi"""
+
+# dotnet test writes TRX results; trx2junit, installed outside the project, converts them for the platforms. Tests
+# that fail still get their report: the status is kept until the conversion is done.
+_JUNIT = """status=0
+{test} || status=$?
+dotnet tool install --tool-path /tmp/quoll-trx2junit trx2junit >/dev/null
+/tmp/quoll-trx2junit/trx2junit TestResults/*.trx
+exit $status"""
+
+
+class DotnetCI(CISteps):
+    version_key = "dotnet-version"
+    codeql_language = "csharp"
+
+    def setup(self, cfg: CIConfig, version: Optional[str]) -> List[Item]:
+        with_: Dict[str, Any] = (
+            {"dotnet-version": version} if version else {"global-json-file": cfg.path(cfg.version_file)}
+        )
+        if cfg.cache:
+            with_["cache"] = True
+            with_["cache-dependency-path"] = cfg.path("**/packages.lock.json")
+        return [step("Set up .NET", uses=ACTIONS["setup-dotnet"], with_=with_)]
+
+    def image(self, cfg: CIConfig, version: str) -> str:
+        return f"mcr.microsoft.com/dotnet/sdk:{version}"
+
+    def cache(self, cfg: CIConfig) -> Optional[Cache]:
+        if not cfg.cache:
+            return None
+        return Cache("nuget", (".nuget/packages",), env={"NUGET_PACKAGES": f"{ROOT}/.nuget/packages"})
+
+    def install(self, cfg: CIConfig, packages: Sequence[str] = ()) -> List[Item]:
+        return [step("Restore dependencies", run=cfg.install)]
+
+    def lint(self, cfg: CIConfig, tools: List[str]) -> List[Item]:
+        steps = self.install(cfg)
+        if "dotnet-format" in tools:
+            steps.append(step("dotnet format", run="dotnet format --verify-no-changes --no-restore"))
+        return steps
+
+    def test(self, cfg: CIConfig) -> List[Item]:
+        t = cfg.test
+        cmd = "dotnet test --no-restore"
+        if t.coverage:
+            cmd += (
+                " -p:CollectCoverage=true -p:CoverletOutputFormat=cobertura"
+                f" -p:Threshold={t.coverage_threshold} -p:ThresholdType=line"
+            )
+        if t.reports:
+            cmd = _JUNIT.format(test=cmd + " --logger trx --results-directory TestResults")
+        name = "Tests" + (" with coverage" if t.coverage else "")
+        return [*self.install(cfg), step(name, run=cmd, secrets=t.env_secrets)]
+
+    def coverage_file(self, cfg: CIConfig) -> str:
+        return "**/coverage.cobertura.xml"
+
+    def reports(self, cfg: CIConfig) -> TestReports:
+        if not cfg.test.coverage:
+            return TestReports(junit="TestResults/*.xml")
+        # coverlet's summary table: | Total | 85.5% | ...
+        regex = r"/\|\s*Total\s*\|\s*(\d+(?:\.\d+)?)%/"
+        return TestReports(junit="TestResults/*.xml", cobertura="**/coverage.cobertura.xml", coverage_regex=regex)
+
+    def audit(self, cfg: CIConfig) -> List[Item]:
+        return [*self.install(cfg), step("Dependency vulnerability scan", run=_AUDIT)]
+
+    def build(self, cfg: CIConfig) -> List[Item]:
+        return [*self.install(cfg), step("Build", run=cfg.build.command)]
+
+    def dependabot_ecosystem(self, cfg: CIConfig) -> str:
+        return "nuget"

quoll/languages/dotnet/detect.py

@@ -0,0 +1,53 @@
+from __future__ import annotations
+
+import re
+
+from quoll.languages.base import Detection
+from quoll.project import Project
+from quoll.services import detect_services
+
+DOTNET_DEFAULT = "10.0"
+DOTNET_LTS = ("8.0", "10.0")
+
+# NuGet packages revealing a backing service.
+_SERVICE_PACKAGES = {
+    "postgres": ("Npgsql",),
+    "mysql": ("MySqlConnector", "MySql.Data", "Pomelo.EntityFrameworkCore.MySql"),
+    "redis": ("StackExchange.Redis",),
+    "mongodb": ("MongoDB.Driver",),
+}
+_TEST_MARKERS = ("Microsoft.NET.Test.Sdk", "<IsTestProject>true", "xunit", "NUnit", "MSTest")
+
+
+def detect(project: Project) -> Detection:
+    det = Detection(package_manager="dotnet", lint_tools=["dotnet-format"])
+    projects = "\n".join(p.read_text() for p in project.glob("**/*.csproj", "**/*.fsproj", "**/*.vbproj"))
+
+    locked = project.glob_any("**/packages.lock.json")
+    det.lockfile = "packages.lock.json" if locked else ""
+    det.install = "dotnet restore --locked-mode" if locked else "dotnet restore"
+    # setup-dotnet can only cache NuGet packages keyed on lock files.
+    det.cache = locked
+
+    if project.exists("global.json"):
+        det.version_file = "global.json"
+        global_json = project.read_json("global.json")
+        sdk = global_json.get("sdk", {}) if isinstance(global_json, dict) else {}
+        m = re.search(r"(\d+\.\d+)", str(sdk.get("version", "")))
+        det.version = m.group(1) if m else DOTNET_DEFAULT
+    else:
+        frameworks = [int(v) for v in re.findall(r"net(\d+)\.0", projects)]
+        det.version = f"{max(frameworks)}.0" if frameworks else DOTNET_DEFAULT
+    low = float(det.version)
+    det.matrix_versions = [v for v in DOTNET_LTS if float(v) >= low] or [det.version]
+
+    if any(marker in projects for marker in _TEST_MARKERS):
+        det.test_runner = "dotnet"
+        # Thresholds need coverlet.msbuild; the default coverlet.collector only reports.
+        det.coverage = "coverlet.msbuild" in projects
+    else:
+        det.warnings.append("No test project found (Microsoft.NET.Test.Sdk) — the test job is disabled.")
+    found = [p for packages in _SERVICE_PACKAGES.values() for p in packages if f'"{p}' in projects]
+    det.services = detect_services(found, _SERVICE_PACKAGES)
+    det.build_command = "dotnet build --no-restore --configuration Release"
+    return det

quoll/languages/dotnet/docker.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, Dict, List, Optional
+
+from quoll.languages.base import Detection, DockerDefaults, DockerImage
+from quoll.project import Project
+
+if TYPE_CHECKING:
+    from quoll.docker.config import DockerConfig
+
+_TEST_MARKERS = ("Microsoft.NET.Test.Sdk", "<IsTestProject>true")
+
+
+class DotnetImage(DockerImage):
+    def defaults(self, project: Project, det: Detection) -> DockerDefaults:
+        app = _app_project(project)
+        if app is None:
+            return DockerDefaults(port=8080, warnings=["No application project found — set docker.build_command."])
+        rel = app.relative_to(project.root).as_posix()
+        assembly = re.search(r"<AssemblyName>([^<]+)</AssemblyName>", app.read_text())
+        name = assembly.group(1) if assembly else app.stem
+        return DockerDefaults(
+            port=8080,
+            command=f"dotnet {name}.dll",
+            build_command=f"dotnet publish {rel} --configuration Release --output /out",
+        )
+
+    def context(self, project: Project, cfg: DockerConfig) -> Dict[str, Any]:
+        published = re.search(r"dotnet publish (\S+)", cfg.build_command)
+        csproj = project.read_text(published.group(1)) if published else ""
+        return {"web": 'Sdk="Microsoft.NET.Sdk.Web"' in csproj}
+
+    def dockerignore(self, cfg: DockerConfig) -> List[str]:
+        return ["**/bin", "**/obj", "**/TestResults", ".vs", "*.user", ".env", ".env.*", "!.env.example"]
+
+
+def _app_project(project: Project) -> Optional[Path]:
+    """The project to publish: a web project first, then any non-test project, shallowest first."""
+    candidates = [
+        p
+        for p in project.glob("*.csproj", "*/*.csproj", "*/*/*.csproj", "*.fsproj", "*/*.fsproj", "*/*/*.fsproj")
+        if not any(marker in p.read_text() for marker in _TEST_MARKERS)
+    ]
+    candidates.sort(key=lambda p: ("Microsoft.NET.Sdk.Web" not in p.read_text(), len(p.parts)))
+    return candidates[0] if candidates else None

quoll/languages/go/Dockerfile.j2

@@ -0,0 +1,25 @@
+{% block build %}
+FROM golang:{{ go_tag }} AS build
+WORKDIR /src
+# Dependencies first: code changes don't download them again.
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=bind,source=go.mod,target=go.mod \
+{% if go_sum %}
+    --mount=type=bind,source=go.sum,target=go.sum \
+{% endif %}
+    go mod download
+COPY . .
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 {{ cfg.build_command }}
+{% endblock %}
+
+{% block runtime %}
+# Static binary on distroless: no shell, no package manager, non-root.
+FROM gcr.io/distroless/static-debian13:nonroot
+COPY --from=build /out/app /app
+# distroless' nonroot, numeric: Kubernetes can then check it isn't root (runAsNonRoot).
+USER 65532:65532
+EXPOSE {{ cfg.port }}
+CMD {{ cfg.command | exec_form }}
+{% endblock %}

quoll/languages/go/__init__.py

@@ -0,0 +1,17 @@
+"""Go modules."""
+
+from quoll.languages.base import Language
+from quoll.languages.go.ci import GoCI
+from quoll.languages.go.detect import detect
+from quoll.languages.go.docker import GoImage
+
+language = Language(
+    name="go",
+    markers=("go.mod",),
+    package_managers=("go",),
+    lint_tools=("gofmt", "vet", "golangci-lint"),
+    test_runners=("go",),
+    detect=detect,
+    ci=GoCI(),
+    docker=GoImage(),
+)

quoll/languages/go/ci.py

@@ -0,0 +1,126 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Sequence
+
+from quoll.ci.steps import ROOT, SUMMARY_FILE, Cache, Item, Step, step
+from quoll.languages.base import THRESHOLD_REGEX, CISteps, TestReports
+from quoll.platforms.github.actions import ACTIONS
+
+if TYPE_CHECKING:
+    from quoll.ci.config import CIConfig
+
+# Only tracked files: container jobs keep the module cache inside the project.
+_GOFMT = """unformatted=$(git ls-files -z '*.go' | xargs -0 -r gofmt -l)
+if [ -n "$unformatted" ]; then
+  echo "::error::These files are not gofmt-formatted:"
+  echo "$unformatted"
+  exit 1
+fi"""
+
+_COVERAGE_CHECK = """total=$(go tool cover -func=coverage.out | awk '/^total:/ {{ sub("%", "", $3); print $3 }}')
+echo "### Coverage: ${{total}}%" >> {summary}
+awk -v total="$total" -v min={threshold} 'BEGIN {{
+  if (total + 0 < min) {{ printf "::error::Coverage %.1f%% is below the %d%% threshold\\n", total, min; exit 1 }}
+  printf "Coverage %.1f%% (threshold %d%%)\\n", total, min
+}}'"""
+
+_GOTESTSUM = "GOTOOLCHAIN=auto go run gotest.tools/gotestsum@latest"
+_COBERTURA = "GOTOOLCHAIN=auto go run github.com/boumenot/gocover-cobertura@latest < coverage.out > coverage.xml"
+_GOLANGCI_LINT = """curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b "$(go env GOPATH)/bin"
+"$(go env GOPATH)/bin/golangci-lint" run"""
+
+
+def _working_directory(cfg: CIConfig) -> Dict[str, str]:
+    return {"working-directory": cfg.directory} if cfg.directory != "." else {}
+
+
+class GoCI(CISteps):
+    version_key = "go-version"
+    codeql_language = "go"
+    codeql_build_mode = "autobuild"
+
+    def setup(self, cfg: CIConfig, version: Optional[str]) -> List[Item]:
+        with_: Dict[str, Any] = {"go-version": version} if version else {"go-version-file": cfg.path(cfg.version_file)}
+        if not cfg.cache:
+            with_["cache"] = False
+        elif cfg.directory != ".":
+            with_["cache-dependency-path"] = cfg.path("go.sum")
+        return [step("Set up Go", uses=ACTIONS["setup-go"], with_=with_)]
+
+    def image(self, cfg: CIConfig, version: str) -> str:
+        if version == "oldstable":
+            raise ValueError("Go 'oldstable' has no image: list explicit versions (e.g. 1.25) in [ci] versions")
+        # The "1" tag follows the latest release, like setup-go's "stable".
+        return f"golang:{'1' if version == 'stable' else version}"
+
+    def cache(self, cfg: CIConfig) -> Optional[Cache]:
+        if not cfg.cache:
+            return None
+        env = {"GOMODCACHE": f"{ROOT}/.go/mod", "GOCACHE": f"{ROOT}/.go/build"}
+        return Cache("go", (".go/mod", ".go/build"), key_files=("go.sum",), env=env)
+
+    def install(self, cfg: CIConfig, packages: Sequence[str] = ()) -> List[Step]:
+        return [step("Download modules", run=cfg.install)]
+
+    def lint(self, cfg: CIConfig, tools: List[str]) -> List[Item]:
+        steps = self.install(cfg)
+        for tool in tools:
+            if tool == "gofmt":
+                steps.append(step("gofmt", run=_GOFMT))
+            elif tool == "vet":
+                steps.append(step("go vet", run="go vet ./..."))
+            elif tool == "golangci-lint":
+                steps.append(
+                    step(
+                        "golangci-lint",
+                        run=_GOLANGCI_LINT,
+                        uses=ACTIONS["golangci-lint"],
+                        with_={"version": "latest", **_working_directory(cfg)},
+                    )
+                )
+        return steps
+
+    def test(self, cfg: CIConfig) -> List[Item]:
+        t = cfg.test
+        # gotestsum runs `go test` and writes JUnit results.
+        go_test = f"{_GOTESTSUM} --junitfile junit.xml --" if t.reports else "go test"
+        if not t.coverage:
+            return [*self.install(cfg), step("Tests", run=f"{go_test} -race ./...", secrets=t.env_secrets)]
+        return [
+            *self.install(cfg),
+            step(
+                "Tests with coverage",
+                run=f"{go_test} -race -covermode=atomic -coverprofile=coverage.out ./...",
+                secrets=t.env_secrets,
+            ),
+            *([step("Coverage report (Cobertura)", run=_COBERTURA)] if t.reports else []),
+            step(
+                "Coverage threshold",
+                run=_COVERAGE_CHECK.format(threshold=t.coverage_threshold, summary=SUMMARY_FILE),
+            ),
+        ]
+
+    def coverage_file(self, cfg: CIConfig) -> str:
+        return "coverage.out"
+
+    def reports(self, cfg: CIConfig) -> TestReports:
+        coverage = cfg.test.coverage
+        return TestReports(
+            junit="junit.xml",
+            cobertura="coverage.xml" if coverage else "",
+            coverage_regex=THRESHOLD_REGEX if coverage else "",
+        )
+
+    def audit(self, cfg: CIConfig) -> List[Item]:
+        # govulncheck@latest may need a newer Go than the project's: let go fetch it to build the tool, while the
+        # scan itself uses the project's toolchain (setup-go and the golang images pin GOTOOLCHAIN=local).
+        return [
+            *self.install(cfg),
+            step("govulncheck", run="GOTOOLCHAIN=auto go run golang.org/x/vuln/cmd/govulncheck@latest ./..."),
+        ]
+
+    def build(self, cfg: CIConfig) -> List[Item]:
+        return [*self.install(cfg), step("Build", run=cfg.build.command)]
+
+    def dependabot_ecosystem(self, cfg: CIConfig) -> str:
+        return "gomod"

quoll/languages/go/detect.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+import re
+
+from quoll.languages.base import Detection
+from quoll.project import Project
+from quoll.services import detect_services
+
+# Modules revealing a backing service.
+_SERVICE_MODULES = {
+    "postgres": ("github.com/lib/pq", "github.com/jackc/pgx", "gorm.io/driver/postgres"),
+    "mysql": ("github.com/go-sql-driver/mysql", "gorm.io/driver/mysql"),
+    "redis": ("github.com/redis/go-redis", "github.com/go-redis/redis", "github.com/gomodule/redigo"),
+    "mongodb": ("go.mongodb.org/mongo-driver",),
+}
+
+
+def detect(project: Project) -> Detection:
+    det = Detection(package_manager="go", install="go mod download", version_file="go.mod")
+    det.lockfile = "go.sum" if project.exists("go.sum") else ""
+    det.cache = bool(det.lockfile)
+    m = re.search(r"^go\s+(\d+\.\d+)", project.read_text("go.mod"), re.M)
+    det.version = m.group(1) if m else "stable"
+    det.matrix_versions = ["oldstable", "stable"]
+    det.lint_tools = ["gofmt", "vet", "golangci-lint"]
+    det.test_runner = "go"
+    det.build_command = "go build ./..."
+    go_mod = project.read_text("go.mod")
+    det.services = detect_services([m for ms in _SERVICE_MODULES.values() for m in ms if m in go_mod], _SERVICE_MODULES)
+    return det

quoll/languages/go/docker.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Dict, List
+
+from quoll.languages.base import Detection, DockerDefaults, DockerImage
+from quoll.project import Project
+
+if TYPE_CHECKING:
+    from quoll.docker.config import DockerConfig
+
+
+class GoImage(DockerImage):
+    def defaults(self, project: Project, det: Detection) -> DockerDefaults:
+        package, warnings = _main_package(project)
+        return DockerDefaults(
+            port=8080,
+            command="/app",
+            build_command=f'go build -trimpath -ldflags="-s -w" -o /out/app {package}',
+            warnings=warnings,
+        )
+
+    def context(self, project: Project, cfg: DockerConfig) -> Dict[str, Any]:
+        # go.mod without a go directive reads as "stable": use the latest Go.
+        return {"go_tag": "1" if cfg.version == "stable" else cfg.version, "go_sum": project.exists("go.sum")}
+
+    def dockerignore(self, cfg: DockerConfig) -> List[str]:
+        return ["bin", "coverage.out", ".env", ".env.*", "!.env.example"]
+
+
+def _main_package(project: Project):
+    """The package to build: the root, cmd/, or the only cmd/<name>/."""
+    if project.exists("main.go"):
+        return ".", []
+    if project.exists("cmd/main.go"):
+        return "./cmd", []
+    commands = sorted(p.parent.relative_to(project.root).as_posix() for p in project.glob("cmd/*/main.go"))
+    if not commands:
+        return ".", ["No main package found (main.go or cmd/<name>/main.go) — check docker.build_command."]
+    warnings = [] if len(commands) == 1 else [f"Several commands in cmd/ — building ./{commands[0]}."]
+    return f"./{commands[0]}", warnings

quoll/languages/java/Dockerfile.j2

@@ -0,0 +1,28 @@
+{% block build %}
+FROM {{ build_image }} AS build
+WORKDIR /src
+COPY . .
+RUN --mount=type=cache,target={{ cache }} \
+{% if wrapper %}
+    chmod +x {{ wrapper }} \
+    && {{ cfg.build_command }} \
+{% else %}
+    {{ cfg.build_command }} \
+{% endif %}
+    && mkdir -p /out \
+    && cp "$(find {{ jar_dir }} -maxdepth 1 -name '*.jar' ! -name '*-plain.jar' ! -name '*-sources.jar' ! -name '*-javadoc.jar' | head -n 1)" /out/app.jar
+{% endblock %}
+
+{% block runtime %}
+FROM eclipse-temurin:{{ cfg.version }}-jre
+{{ os_updates }}
+# A numeric user: Kubernetes can then check it isn't root (runAsNonRoot).
+RUN groupadd --system --gid 10001 app && useradd --system --uid 10001 --gid app --no-create-home app
+WORKDIR /app
+{% block app_files %}
+COPY --from=build --chown=app:app /out/app.jar /app/app.jar
+{% endblock %}
+USER 10001:10001
+EXPOSE {{ cfg.port }}
+CMD {{ cfg.command | exec_form }}
+{% endblock %}

quoll/languages/java/__init__.py

@@ -0,0 +1,20 @@
+"""JVM projects (Java, Kotlin) built with Maven or Gradle."""
+
+from quoll.languages.base import Language
+from quoll.languages.java.ci import JavaCI
+from quoll.languages.java.detect import detect
+from quoll.languages.java.docker import JavaImage
+from quoll.languages.java.frameworks import spring_boot
+
+language = Language(
+    name="java",
+    markers=("pom.xml", "build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"),
+    # The -wrapper variants run the committed ./mvnw or ./gradlew.
+    package_managers=("maven", "maven-wrapper", "gradle", "gradle-wrapper"),
+    lint_tools=("spotless", "checkstyle", "ktlint", "detekt", "spotbugs", "pmd"),
+    test_runners=("junit",),
+    detect=detect,
+    ci=JavaCI(),
+    frameworks=(spring_boot.framework,),
+    docker=JavaImage(),
+)