Manifest parser new release v0.1.4 (AST-146208) - #23
Open
cx-anurag-dalke wants to merge 30 commits into
Open
Conversation
Captures the Parser/factory dispatch model, per-ecosystem quirks, and the invariants (0-based line numbers, "latest" sentinel, PackageManager strings) that downstream AST-CLI relies on. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Merges the CLAUDE.md documentation (Anurag's PR #20) into this branch alongside the Gradle parser work. README conflict resolved by keeping the comprehensive gradle_parser version; the AST-148815 change was a minor blank-line addition that is superseded by the rewritten README. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Addresses all inline review comments from PR #20 review: - Rename Overview → Project Overview, add status line - Add Technology Stack section (Go 1.23, testify, x/mod, stdlib, no DB) - Add Repository Structure section with folder tree - Rename Commands → Development Setup; add prerequisites, clone step, coverage HTML command, and sample JSON output - Add API / Interfaces section with full struct definitions including clarification that StartIndex/EndIndex are 0-based byte offsets - Update Architecture to include Gradle parser (missed in original) - Replace commit hash reference (9e490aa) with PR #15 link - Rename Invariants → Project Rules (Invariants); add PackageManager string for gradle and the StartIndex/EndIndex byte-offset clarification - Rename Tests & fixtures → Testing Strategy; add fixture tree, coverage HTML command, and expected new-parser pattern - Add Known Issues / Limitations section (consolidates pypi, npm, maven, dotnet, and all-parsers limitations) - Add External Integrations section (AST-CLI contract fields) - Add Deployment section (N/A — library, not a service) - Add Performance Considerations section (Maven two-pass, Gradle catalog, no caching) - Add Security & Access section (XXE posture, no file-size limit, no network calls) - Add Logging section (library vs CLI behaviour) - Add Coding Standards section (gofmt/vet, pkg vs internal, naming) - Add Debugging Steps section (5 concrete steps) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Implement a production-grade SBT parser that extracts dependencies from all .sbt files (build.sbt, plugins.sbt, dependencies.sbt, etc.). The parser supports val/lazy val/def variable declarations, all SBT operators (%, %%, %%%), Seq blocks, addSbtPlugin syntax, dependency modifiers (exclude, excludeAll, intransitive, withSources, withJavadoc, cross, classifier), block and inline comments, scope annotations, dependencyOverrides, and duplicate package detection. Includes 29 unit tests at 97.8% coverage with test fixtures containing known-vulnerable packages (Log4Shell, Jackson, Struts2, commons-collections, SnakeYAML) for security scanning validation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…E integration - gradle: emit 0-based line numbers (was off-by-one, broke IDE decorations) - gradle: default empty catalog versions to "latest" (was causing 400 from realtime-scanner) - gradle: multi-line dependency locations with rawLines tracking - maven/dotnet/golang: strip trailing \r so byte offsets are correct on CRLF files - CLAUDE.md: strengthen 0-based contract, add SBT to parser list - plugins.sbt: add known-vulnerable packages so IDE decorations can be visually verified Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ADDED - Three iOS/macOS package managers: Swift Package Manager (SwiftPM): - Package.swift (manifest) and Package.resolved (lock file) - Supports multiple version specifier formats: exact, from, upToNextMajor, upToNextMinor - Resolves ranges and branch/revision refs to "latest" - Handles Apple's Package@swift-X.Y.swift toolchain variants CocoaPods: - Podfile (manifest), Podfile.lock (lock), .podspec and .podspec.json (specs) - Parses Ruby DSL and JSON pod specifications - Supports semantic version ranges (~>, >=, <=, etc.) resolved to "latest" - Multi-file support with lock file version pinning Carthage: - Cartfile, Cartfile.private (manifests), Cartfile.resolved (lock file) - Handles all three file variants with unified syntax - Supports github, git, and binary origins - Range operators (~>, >=) resolved to "latest" FIXED: - Corrected Swift PM PackageManager enum from "swiftpm" to "swift" (aligns with Dustico API specification) - Updated all test assertions - Updated ast-cli mapping in sca-realtime-utils.go UPDATED: - manifest-file-selector.go: Added routing for all iOS manifest files - parser_factory.go: Added dispatches for iOS parsers and their variants - All parsers follow contract: 0-based line numbers, exact byte offsets, "latest" for ranges TESTS: All 13 parser packages pass (including new iOS parsers) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Remove excessive function and implementation detail comments from iOS parsers (swiftpm, cocoapods, carthage) to align with Go conventions. Keep only essential package-level documentation and exported API comments per standard Go style guidelines. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Remove .claude/settings.local.json (local settings) Remove IOS_PACKAGE_MANAGERS.md (internal documentation) Remove PACKAGE_MANAGER_ENUM_ALIGNMENT.md (internal documentation) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Introduces three new parser packages: - internal/parsers/composer: parses composer.json with composer.lock resolution (packagist) - internal/parsers/rubygems: parses Gemfile with Gemfile.lock resolution (rubygems) - internal/parsers/bower: parses bower.json with range-to-latest resolution (npm) Wires each parser into manifest-file-selector.go and parser_factory.go, adds fixture files under test/resources/, and includes comprehensive test suites. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…parser Fixes AST-160218. The Gradle parser previously matched only a hardcoded list of configuration keywords, missing all dynamically-generated Android variants: freeImplementation, paidDebugImplementation, debugApi, kaptTest, etc. These are auto-generated by the Android Gradle Plugin from product flavors and build types and contain real dependencies that need scanning. Changed configKeywords from exact-match to suffix-based regex covering: - *Implementation, *Api, *CompileOnly, *RuntimeOnly (any flavor/buildtype) - *Kapt, *Ksp, *AnnotationProcessor (test/androidTest scopes) - classpath, lintChecks (exact, no variants) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Enhanced pypi parser: VCS requirements, URL requirements (PEP 508), line continuations, --hash= stripping, pip option skipping, === operator - release.yml: use github.actor identity for git config; replace actions/create-release with gh release create CLI step Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When package-lock.json is absent, the npm parser now reads a sibling yarn.lock to resolve ranged versions in package.json (^, ~, *, >, <) to exact installed versions. Supports both Yarn 1 Classic and Yarn 2 Berry lockfile formats. yarn.lock is intentionally not a standalone manifest to avoid surfacing transitive dependencies. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Merges feature/parser-expansion changes from main (v1.0.3 release) into feature/ruby-parser to create a unified branch with complete parser support: ✅ From feature/parser-expansion (main): - Poetry (pyproject.toml) parser - Setuptools (setup.py, setup.cfg) parsers - Enhanced PyPI with 6 formats support - Gradle & SBT improvements with fixes - CLAUDE.md documentation ✅ From feature/ruby-parser (already present): - iOS parsers: CocoaPods, Carthage, SwiftPM - Composer (PHP) parser - RubyGems (Ruby) parser - Bower (JavaScript) parser Result: feature/ruby-parser now contains ALL parsers (7 ecosystems, 18 manifest types) Ready for merge to main and release as v1.0.4+ Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
cx-atish-jadhav
changed the title
cx-atish-jadhav
changed the title
Lock/resolved files (e.g., Package.resolved, Podfile.lock, Cartfile.resolved, pubspec.lock and multi-toolchain .resolved variants) are now treated as helper lockfiles and not returned as standalone manifests by selectManifestFile. Parser factory routing was updated to stop dispatching lockfile enums. Tests adjusted to assert these lockfiles return -1. Added internal testdata Package@swift-6.0.swift and updated manifest-file-selector tests accordingly. Affected files: pkg/parser/manifest-file-selector.go, pkg/parser/parser_factory.go, pkg/parser/manifest-file-selector_test.go, internal/testdata/Package@swift-6.0.swift.
Make Carthage, CocoaPods and SwiftPM parsers prefer exact versions from sibling lock files when present. Adds lock-file loaders and parsing helpers (Cartfile.resolved, Podfile.lock, Package.resolved), wires them into parse pipelines, and uses lock versions to override ranged/unspecified manifest specs (case-insensitive lookup for SwiftPM). Updates imports and minor struct formatting, and adjusts/extends unit tests to assert lockfile precedence and expected resolved versions.
Improve Composer parser filtering for virtual packages. Add an early return for names containing "/" so real vendor/package entries are never skipped, and extend prefix checks to cover php-, composer-, and hhvm virtual package names. Inline comments clarify intent and examples. This reduces false positives where real packages were previously excluded and broadens detection of virtual/platform package names. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
commit 385df47 Author: atishj99 <atish.jadhav@checkmarx.com> Date: Thu Jul 30 14:53:34 2026 +0530 Annotate CI unit-tests job with zizmor ignore Update .github/workflows/ci.yml: add an inline comment `# zizmor: ignore[anonymous-definition]` to the `unit-tests` job key and remove the redundant `name: Unit Tests` line. This silences the zizmor anonymous-definition warning without changing job behavior. commit 8a142ef Author: atishj99 <atish.jadhav@checkmarx.com> Date: Thu Jul 30 14:40:48 2026 +0530 Add Zizmor GitHub Actions security scanner and fix findings - Add .github/workflows/scan-github-action.yml to run Zizmor on PRs - Fix artipacked: Add persist-credentials: false to all checkout steps - Fix concurrency-limits: Add concurrency blocks to all workflows - Fix template-injection: Move ${{ }} expressions to env variables - Fix anonymous-definition: Add name fields to jobs - Fix excessive-permissions: Add explicit permissions blocks - Fix undocumented-permissions: Add comments to write permissions All Zizmor findings resolved. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Contributor
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-atish-jadhav) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
cx-atish-jadhav
self-requested a review
August 4, 2026 15:09
cx-atish-jadhav
previously approved these changes
Aug 5, 2026
Expose GITHUB_TOKEN and update the remote URL to include it so the release workflow can push git tags non-interactively. Adds GITHUB_TOKEN to the job env and runs `git remote set-url origin https://${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git` before tagging and pushing to avoid auth errors in CI.
Update the release workflow to set the git remote URL with the x-access-token prefix (https://x-access-token:${GITHUB_TOKEN}@github.com/...) so the GITHUB_TOKEN is passed correctly during tagging/push and avoids authentication issues.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Complete parser expansion for manifest-parser v1.0.4+, consolidating all new ecosystem support:
From feature/ruby-parser (newly added):
From feature/parser-expansion (v1.0.3, merged in):
Total Manifest Support (18 types across 11 ecosystems)
Security Status
✅ CxOne SCA Scan: ZERO EXPLOITABLE VULNERABILITIES
✅ All identified vulnerabilities marked as "NE" (Not Exploitable)
Code Quality
Changes from v1.0.3 to v1.0.4
New Parsers (4):
Enhanced Parsers:
Total Changes:
Test Plan
go test ./...✅go test ./... -coverprofile cover.out✅Related
🤖 Generated with Claude Code