Skip to content

Migrate existing lock file parsers to new Dependency Scanning analyzer

Why are we doing this work

In order to iterate quickly, we'll be re-using as much as possible from the Gemnasium project. The quickest wins are existing lock file parsers for packagers like npm or pnpm.

Relevant links

#473462 (closed)

Non-functional requirements

  • Documentation: We should document the lock file support in the CI/CD component README.
  • Feature flag:
  • Performance: We should verify the performance on large lock files.
  • Testing: We should ensure that the lock file parser tests continue to pass.

Implementation plan

Copy the following parsers along with their respective tests from the gemnasium project.

  • bundle
  • cargo
  • cocoapods
  • dot
  • gemfile
  • go Removed because of build removals.
  • npm
  • pipdeptree
  • pnpm
  • poetry
  • swift
  • yarn

Verification steps

  1. Run go test ./... and ensure that all the tests pass
  2. Verify that the CI/CD pipeline passes.
Edited by Oscar Tovar