Merge branch 'main' into lsep/fix-url-encoding

dist/index.js

@@ -3589,6 +3589,17 @@ class PackageCache {
         this.addPackage(dep);
         return dep;
     }
+    /**
+     * Provided a "matcher" object with any of the string fields 'namespace',
+     * 'name', or 'version', returns all packages matching fields specified by
+     * the matcher stored by the PackageCache
+     *
+     * @param {Object} matcher
+     * @returns {boolean}
+     */
+    packagesMatching(matcher) {
+        return Object.values(this.database).filter((pkg) => pkg.matching(matcher));
+    }
     /**
      * addPackage adds a package, even if it already exists in the cache.
      *
@@ -3707,6 +3718,15 @@ class Package {
     packageID() {
         return this.packageURL.toString();
     }
+    /**
+     * namespace of the package
+     *
+     * @returns {string}
+     */
+    namespace() {
+        var _a;
+        return (_a = this.packageURL.namespace) !== null && _a !== void 0 ? _a : null;
+    }
     /**
      * name of the package
      *
@@ -3723,6 +3743,23 @@ class Package {
     version() {
         return this.packageURL.version || '';
     }
+    /**
+     * Provided a "matcher" object with any of the string fields 'namespace',
+     * 'name', or 'version', returns true if the Package has values matching the
+     * matcher.
+     *
+     * @param {Object} matcher
+     * @returns {boolean}
+     */
+    matching(matcher) {
+        // prettier-ignore
+        return ((matcher.namespace === undefined ||
+            this.packageURL.namespace === matcher.namespace) &&
+            (matcher.name === undefined ||
+                this.packageURL.name === matcher.name) &&
+            (matcher.version === undefined ||
+                this.packageURL.version === matcher.version));
+    }
 }
 exports.Package = Package;
 //# sourceMappingURL=package.js.map

dist/parse.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseGoModGraph = exports.parseGoList = exports.parseGoPackage = void 0;
+const path_1 = __importDefault(require("path"));
+const packageurl_js_1 = require("packageurl-js");
+function parseGoPackage(pkg) {
+    const [qualifiedPackage, version] = pkg.split('@');
+    let namespace = null;
+    let name;
+    if (qualifiedPackage.indexOf('/') !== -1) {
+        namespace = path_1.default.dirname(qualifiedPackage);
+        name = path_1.default.basename(qualifiedPackage);
+    }
+    else {
+        name = qualifiedPackage;
+    }
+    return new packageurl_js_1.PackageURL('golang', namespace, name, version !== null && version !== void 0 ? version : null, null, null);
+}
+exports.parseGoPackage = parseGoPackage;
+/**
+ * parseGoList parses a list of Go packages (one per line) matching the format
+ * "${GO_PACKAGE}@v{VERSION}" into Package URLs. This expects the output of 'go
+ * list -deps' as input.
+ *
+ * @param {string} contents
+ * @returns {Array<PackageURL>}
+ */
+function parseGoList(contents) {
+    // split the input by newlines, sort, and dedup
+    const packages = Array.from(new Set(contents.split('\n').map((p) => p.trim())));
+    const purls = [];
+    packages.forEach((pkg) => {
+        if (!pkg.trim())
+            return;
+        purls.push(parseGoPackage(pkg));
+    });
+    return purls;
+}
+exports.parseGoList = parseGoList;
+/**
+ * parseGoModGraph parses an *associative list* of Go packages into tuples into
+ * an associative list of PackageURLs. This expects the output of 'go mod
+ * graph' as input
+ */
+function parseGoModGraph(contents) {
+    const pkgAssocList = [];
+    contents.split('\n').forEach((line) => {
+        if (!line.trim())
+            return;
+        const [parentPkg, childPkg] = line.split(' ');
+        pkgAssocList.push([parseGoPackage(parentPkg), parseGoPackage(childPkg)]);
+    });
+    return pkgAssocList;
+}
+exports.parseGoModGraph = parseGoModGraph;

dist/process.js

@@ -0,0 +1,87 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.processGoBuildTarget = exports.processGoGraph = void 0;
+const path_1 = __importDefault(require("path"));
+const exec = __importStar(require("@actions/exec"));
+const core = __importStar(require("@actions/core"));
+const dependency_submission_toolkit_1 = require("@github/dependency-submission-toolkit");
+const parse_1 = require("./parse");
+function processGoGraph(goModDir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        console.log(`Running 'go mod graph' in ${goModDir}`);
+        const goModGraph = yield exec.getExecOutput('go', ['mod', 'graph'], {
+            cwd: goModDir
+        });
+        if (goModGraph.exitCode !== 0) {
+            core.error(goModGraph.stderr);
+            core.setFailed("'go mod graph' failed!");
+            throw new Error("Failed to execute 'go mod graph'");
+        }
+        const cache = new dependency_submission_toolkit_1.PackageCache();
+        const packageAssocList = (0, parse_1.parseGoModGraph)(goModGraph.stdout);
+        packageAssocList.forEach(([parentPkg, childPkg]) => {
+            cache.package(parentPkg).dependsOn(cache.package(childPkg));
+        });
+        return cache;
+    });
+}
+exports.processGoGraph = processGoGraph;
+// For a specific Go _build target_, this template lists all dependencies used
+// to build the build target It does not provide association between the
+// dependencies (i.e. which dependencies depend on which)
+// eslint-disable-next-line quotes
+// eslint-disable-next-line no-useless-escape
+const GO_LIST_DEP_TEMPLATE = '{{define "M"}}{{.Path}}@{{.Version}}{{end}}{{with .Module}}{{if not .Main}}{{if .Replace}}{{template "M" .Replace}}{{else}}{{template "M" .}}{{end}}{{end}}{{end}}';
+function processGoBuildTarget(goModDir, goBuildTarget, cache) {
+    return __awaiter(this, void 0, void 0, function* () {
+        console.log(`Running go package detection in ${goModDir} on build target ${goBuildTarget}`);
+        const goList = yield exec.getExecOutput('go', ['list', '-deps', '-f', GO_LIST_DEP_TEMPLATE, goBuildTarget], { cwd: goModDir });
+        if (goList.exitCode !== 0) {
+            core.error(goList.stderr);
+            core.setFailed("'go list' failed!");
+            throw new Error("Failed to execute 'go list'");
+        }
+        const dependencies = (0, parse_1.parseGoList)(goList.stdout);
+        const manifest = new dependency_submission_toolkit_1.BuildTarget(goBuildTarget, path_1.default.join(goModDir, goBuildTarget));
+        dependencies.forEach((dep) => {
+            manifest.addBuildDependency(cache.package(dep));
+        });
+        return manifest;
+    });
+}
+exports.processGoBuildTarget = processGoBuildTarget;

package-lock.json

@@ -5705,9 +5705,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "5.2.0",
+      "version": "5.5.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.5.1.tgz",
-      "integrity": "sha512-XY6+NS3WH9b3TKOHeNz2CjR+qrVz/k4fO9g3etPpLozRvULoQmZ1+dk9JbIz40ehn27xzFk4jYVU2MU3Nle62A==",
+      "integrity": "sha512-MEvryPLf18HvlCbLSzCW0U00IMftKGI5udnjrQbC5D4P0Hodwffhv+iGfWuJwg16Y/TK11ZFK8i+BPVW2z/eAw==",
       "engines": {
         "node": ">=12.18"
       }
@@ -10105,9 +10105,9 @@
       }
     },
     "undici": {
-      "version": "5.2.0",
+      "version": "5.5.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.5.1.tgz",
-      "integrity": "sha512-XY6+NS3WH9b3TKOHeNz2CjR+qrVz/k4fO9g3etPpLozRvULoQmZ1+dk9JbIz40ehn27xzFk4jYVU2MU3Nle62A=="
+      "integrity": "sha512-MEvryPLf18HvlCbLSzCW0U00IMftKGI5udnjrQbC5D4P0Hodwffhv+iGfWuJwg16Y/TK11ZFK8i+BPVW2z/eAw=="
     },
     "universal-user-agent": {
       "version": "6.0.0",