Add declarations for more package ecosystems - #75
Open
andrew wants to merge 7 commits into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR expands the manifest parsing surface to emit Declarations for additional ecosystems (Cargo, RubyGems, Go, NuGet, Hex, Gleam) with stable per-source Locations, preserved parser-supplied PURLs, and a new Direct flag to distinguish explicit vs indirect requirements.
Changes:
- Add
DirecttoDeclarationand standardize stable location generation viacore.NextLocation. - Extend multiple ecosystem parsers to populate
Result.Declarations(including NuGet central package management viaDirectory.Packages.props). - Preserve parser-supplied declaration PURLs in the public
Parsewrapper, and update tests/docs/testdata accordingly.
Reviewed changes
Copilot reviewed 22 out of 22 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| testdata/nuget/Directory.Packages.props | Adds NuGet central package management fixture. |
| README.md | Documents new Direct field and expanded declaration support; adds NuGet file type. |
| manifests.go | Preserves parser-supplied declaration PURLs via declarationPURL. |
| manifests_test.go | Adds declaration PURL/directness test cases for new ecosystems and preservation behavior. |
| internal/pypi/pypi.go | Uses core.NextLocation for stable declaration locations; marks declarations direct. |
| internal/nuget/nuget.go | Adds declarations for NuGet manifests and adds Directory.Packages.props parser. |
| internal/nuget/nuget_test.go | Adds/extends tests validating NuGet declarations and location stability. |
| internal/npm/npm.go | Marks npm declarations as direct. |
| internal/maven/declarations.go | Marks Maven declarations as direct. |
| internal/hex/hex.go | Adds Hex declarations with alias/non-registry handling and stable locations. |
| internal/hex/hex_test.go | Adds tests for Mix declarations and non-registry filtering. |
| internal/golang/golang.go | Adds Go module declarations; skips replaced modules; introduces replace scanning. |
| internal/golang/golang_test.go | Adds tests for Go declarations, including indirect/tool/replace behavior. |
| internal/gleam/gleam.go | Adds Gleam declarations for runtime and dev dependencies. |
| internal/gleam/gleam_test.go | Adds tests verifying Gleam declarations and directness. |
| internal/github_actions/github_actions.go | Uses core.NextLocation and marks action declarations direct. |
| internal/gem/rubygems.go | Adds Gemfile/gemspec declarations with registry/non-registry handling and stable locations. |
| internal/gem/gem_test.go | Adds tests for Gemfile/gemspec declarations and block/context behavior. |
| internal/core/types.go | Adds Direct to core.Declaration with documentation. |
| internal/core/helpers.go | Introduces core.NextLocation helper for stable repeated-entry locations. |
| internal/cargo/cargo.go | Adds Cargo declarations across tables/targets/workspace with registry filtering. |
| internal/cargo/cargo_test.go | Adds tests validating Cargo declarations and ensuring Dependencies behavior is unchanged. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Strip trailing comments before Gemfile block detection so a gem line whose comment ends in the word 'do' is not treated as a block opener. Add bitbucket to the Bundler non-registry source patterns and organization to the Hex non-registry pattern so private packages do not produce public-registry declarations. Extract the repeated location suffix logic into core.NextLocation.
consumeContextLine treated any line ending in ' do' as a block opener, so a gem line whose trailing comment lacked a leading space and ended in the word 'do' was swallowed before collectGemLine could see it. Bundler's gem call never takes a block, so bail out on gem-prefixed lines before the catch-all. Add a regression case to TestGemfileDeclarationBlockContexts. Also drop the redundant equality clause from the replace-block check in collectReplacedModules.
A nuspec <group> with no targetFramework is valid and previously produced dependency-groups//<id> locations. Only append the framework segment when it is non-empty, matching the Condition handling in the csproj and central-packages parsers. Extend the Gemfile comment strip to accept a tab before # so a block opener written as 'group :test do<tab># ...' is still recognised.
andrew
force-pushed
the
codex/more-source-declarations
branch
from
August 19, 2026 16:56
de179e1 to
ddc3c1f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add source declarations for Cargo, Go, NuGet, Hex, and Gleam so callers can identify and compare requirements without parsing each manifest again.
Declarations now carry direct versus indirect status, preserve parser-supplied PURLs, and use stable source locations for aliases, target-specific dependencies, and repeated entries. Registry checks exclude local, Git, replaced, workspace, and other non-registry sources while leaving the existing dependency inventory intact. NuGet central package management through
Directory.Packages.propsis included.Hex alias locations stay tied to the source atom. Cargo and NuGet retain their prior
Dependenciesbehavior while exposing the extra declaration data.