feat(scan): forward socket.json build-tool config into reachability (1.1.120, Coana 15.4.1) #1362
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,110 @@ | ||
| import type { SocketJson } from './socket-json.mts' | ||
|
|
||
| // Per-ecosystem build-tool options handed off to the Coana CLI — used both when | ||
| // generating manifests (`coana manifest <ecosystem>`) and, in socket mode, for | ||
| // reach-time dependency resolution (`coana run`). This mirrors the Coana-side | ||
| // `--auto-manifest-config` shape (REA-547): socket-cli owns mapping `socket.json` | ||
|
There was a problem hiding this comment. Internal ticket ID in commentsLow Severity New comments reference the internal tracker id Additional Locations (1)  Triggered by learned rule: No internal ticket references in code comments — remove Jira/tracker IDs Reviewed by Cursor Bugbot for commit 478fb22. Configure here. |
||
| // onto it, so Coana stays uncoupled from `socket.json`'s schema. Keeping the | ||
| // per-ecosystem options namespaced (rather than as flat CLI flags) avoids the | ||
| // ambiguity of a bare `--bin`/`--include-configs` when a repo has more than one | ||
| // build tool. | ||
| export type BuildToolOptions = { | ||
| // Build-tool executable override (e.g. `./gradlew`, `atlas-mvn`). | ||
| bin?: string | undefined | ||
| // Comma-separated config-name globs to skip. | ||
| excludeConfigs?: string | undefined | ||
| // `socket.json`'s per-ecosystem `ignoreUnresolved` (warn vs fail on unresolved | ||
| // dependencies), forwarded verbatim. NOTE: this is NOT the reach-time | ||
| // fail-closed switch — that's the run-wide `failOnBuildToolError` below. | ||
| ignoreUnresolved?: boolean | undefined | ||
| // Comma-separated config-name globs to resolve. | ||
| includeConfigs?: string | undefined | ||
| // Extra build-tool options, pre-split into argv. Coana maps these straight to | ||
| // the tool's opts (no splitting on its side). Mapped from `socket.json`'s | ||
| // `gradleOpts`/`sbtOpts` string. | ||
| opts?: string[] | undefined | ||
| } | ||
|
|
||
| // The Coana hand-off config. `failOnBuildToolError` is run-wide (top level) | ||
| // because `--auto-manifest` is a single CLI mode, not a per-package-manager | ||
| // setting. The per-ecosystem entries are present only for ecosystems configured | ||
| // (and not disabled) in `socket.json`; absent ecosystems fall to Coana's own | ||
| // defaults. | ||
| export type AutoManifestConfig = { | ||
| // Run-wide fail-closed switch. When true, Coana treats a build-tool step | ||
| // failure as fatal rather than tolerating it. socket-cli sets it true under | ||
| // `--auto-manifest`; left unset on plain `--reach` (permissive — Coana's | ||
| // default best-effort behaviour). | ||
| failOnBuildToolError?: boolean | undefined | ||
| gradle?: BuildToolOptions | undefined | ||
| sbt?: BuildToolOptions | undefined | ||
| } | ||
|
|
||
| // Splits a `socket.json` opts string (`gradleOpts`/`sbtOpts`) into argv, matching | ||
| // how the standalone `socket manifest` path splits it. Returns undefined when | ||
| // there's nothing to pass so the field is omitted from the config. | ||
| function parseOpts(value: string | undefined): string[] | undefined { | ||
| if (!value) { | ||
| return undefined | ||
| } | ||
| const parts = value | ||
| .split(' ') | ||
| .map(s => s.trim()) | ||
| .filter(Boolean) | ||
| return parts.length ? parts : undefined | ||
| } | ||
|
|
||
| // Maps `socket.json`'s `defaults.manifest.<ecosystem>` build-tool options onto | ||
| // the Coana hand-off config. | ||
| // | ||
| // `autoManifest` reflects whether the run is `--auto-manifest` (fail-closed: | ||
| // `failOnBuildToolError=true`) vs plain `--reach` (permissive: | ||
| // `failOnBuildToolError` left unset so Coana's default applies). Per-ecosystem | ||
| // options are forwarded verbatim from `socket.json`; disabled ecosystems are | ||
| // omitted so they fall back to Coana's defaults. | ||
| export function buildAutoManifestConfig( | ||
| sockJson: SocketJson, | ||
| { autoManifest }: { autoManifest: boolean }, | ||
| ): AutoManifestConfig { | ||
| const manifest = sockJson.defaults?.manifest | ||
| const config: AutoManifestConfig = {} | ||
|
|
||
| // `--auto-manifest` expects every build-tool command to succeed, so a | ||
| // build-tool step failure should be fatal rather than tolerated. | ||
| if (autoManifest) { | ||
| config.failOnBuildToolError = true | ||
| } | ||
|
|
||
| const gradle = manifest?.gradle | ||
| if (gradle && !gradle.disabled) { | ||
| config.gradle = { | ||
| bin: gradle.bin, | ||
| excludeConfigs: gradle.excludeConfigs, | ||
| ignoreUnresolved: gradle.ignoreUnresolved, | ||
| includeConfigs: gradle.includeConfigs, | ||
| opts: parseOpts(gradle.gradleOpts), | ||
| } | ||
| } | ||
|
|
||
| const sbt = manifest?.sbt | ||
| if (sbt && !sbt.disabled) { | ||
| config.sbt = { | ||
| bin: sbt.bin, | ||
| excludeConfigs: sbt.excludeConfigs, | ||
| ignoreUnresolved: sbt.ignoreUnresolved, | ||
| includeConfigs: sbt.includeConfigs, | ||
| opts: parseOpts(sbt.sbtOpts), | ||
| } | ||
| } | ||
|
|
||
| return config | ||
| } | ||
|
|
||
| // True when there's nothing to hand to Coana: no per-ecosystem options and the | ||
| // run mode is left at Coana's permissive default. When true, the | ||
| // `--auto-manifest-config` option should be omitted entirely. | ||
| export function isAutoManifestConfigEmpty(config: AutoManifestConfig): boolean { | ||
| return ( | ||
| !config.gradle && !config.sbt && config.failOnBuildToolError === undefined | ||
| ) | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,95 @@ | ||
| import { describe, expect, it } from 'vitest' | ||
|
|
||
| import { | ||
| buildAutoManifestConfig, | ||
| isAutoManifestConfigEmpty, | ||
| } from './auto-manifest-config.mts' | ||
|
|
||
| import type { SocketJson } from './socket-json.mts' | ||
|
|
||
| // Builds a minimal SocketJson for the mapping under test; only | ||
| // `defaults.manifest` is read, so the header/version fields are irrelevant. | ||
| function socketJson( | ||
| manifest?: NonNullable<NonNullable<SocketJson['defaults']>['manifest']>, | ||
| ): SocketJson { | ||
| return { defaults: { manifest } } as SocketJson | ||
| } | ||
|
|
||
| describe('buildAutoManifestConfig', () => { | ||
| it('returns an empty config for plain --reach with no manifest defaults', () => { | ||
| expect( | ||
| buildAutoManifestConfig(socketJson(), { autoManifest: false }), | ||
| ).toEqual({}) | ||
| }) | ||
|
|
||
| it('sets top-level failOnBuildToolError=true under --auto-manifest (fail-closed)', () => { | ||
| expect( | ||
| buildAutoManifestConfig(socketJson(), { autoManifest: true }), | ||
| ).toEqual({ failOnBuildToolError: true }) | ||
| }) | ||
|
|
||
| it('leaves failOnBuildToolError unset on plain --reach (Coana default permissive)', () => { | ||
| const config = buildAutoManifestConfig( | ||
| socketJson({ gradle: { bin: './gradlew' } }), | ||
| { autoManifest: false }, | ||
| ) | ||
| expect(config.failOnBuildToolError).toBeUndefined() | ||
| }) | ||
|
|
||
| it('maps gradle/sbt options, *Opts -> opts, ignoreUnresolved passthrough', () => { | ||
| const config = buildAutoManifestConfig( | ||
| socketJson({ | ||
| gradle: { | ||
| bin: './gradlew', | ||
| excludeConfigs: 'testCompileClasspath', | ||
| gradleOpts: '--offline --no-daemon', | ||
| ignoreUnresolved: true, | ||
| includeConfigs: '*RuntimeClasspath', | ||
| }, | ||
| sbt: { bin: 'sbt', sbtOpts: '-batch' }, | ||
| }), | ||
| { autoManifest: true }, | ||
| ) | ||
| expect(config).toEqual({ | ||
| failOnBuildToolError: true, | ||
| gradle: { | ||
| bin: './gradlew', | ||
| excludeConfigs: 'testCompileClasspath', | ||
| ignoreUnresolved: true, | ||
| includeConfigs: '*RuntimeClasspath', | ||
| opts: ['--offline', '--no-daemon'], | ||
| }, | ||
| sbt: { bin: 'sbt', opts: ['-batch'] }, | ||
| }) | ||
| }) | ||
|
|
||
| it('omits disabled ecosystems so they fall back to Coana defaults', () => { | ||
| const config = buildAutoManifestConfig( | ||
| socketJson({ | ||
| gradle: { disabled: true, includeConfigs: '*RuntimeClasspath' }, | ||
| sbt: { bin: 'sbt' }, | ||
| }), | ||
| { autoManifest: false }, | ||
| ) | ||
| expect(config.gradle).toBeUndefined() | ||
| expect(config.sbt).toBeDefined() | ||
| }) | ||
| }) | ||
|
|
||
| describe('isAutoManifestConfigEmpty', () => { | ||
| it('is true when there are no ecosystems and the run mode is default', () => { | ||
| expect(isAutoManifestConfigEmpty({})).toBe(true) | ||
| }) | ||
|
|
||
| it('is false when failOnBuildToolError is set (fail-closed must reach Coana)', () => { | ||
| expect(isAutoManifestConfigEmpty({ failOnBuildToolError: true })).toBe( | ||
| false, | ||
| ) | ||
| }) | ||
|
|
||
| it('is false when an ecosystem is configured', () => { | ||
| expect(isAutoManifestConfigEmpty({ gradle: { bin: './gradlew' } })).toBe( | ||
| false, | ||
| ) | ||
| }) | ||
| }) |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Config flag needs Coana version
Medium Severity
Reachability now appends
--auto-manifest-configwhenever the mapped config is non-empty, butreachVersion(or a local Coana path) can still invoke a Coana build older than15.4.1that does not implement that flag, causing reach analysis to fail unexpectedly.Reviewed by Cursor Bugbot for commit 478fb22. Configure here.