Migrate existing lock file parsers to new Dependency Scanning analyzer
Why are we doing this work
In order to iterate quickly, we'll be re-using as much as possible
from the Gemnasium project. The quickest wins are existing lock file
parsers for packagers like npm or pnpm.
Relevant links
Non-functional requirements
-
Documentation: We should document the lock file support in the CI/CD component README. -
Feature flag: -
Performance: We should verify the performance on large lock files. -
Testing: We should ensure that the lock file parser tests continue to pass.
Implementation plan
Copy the following parsers along with their respective tests from the gemnasium project.
-
bundle -
cargo -
cocoapods -
dot -
gemfile -
goRemoved because of build removals. -
npm -
pipdeptree -
pnpm -
poetry -
swift -
yarn
Verification steps
- Run
go test ./...and ensure that all the tests pass - Verify that the CI/CD pipeline passes.
Edited by Oscar Tovar