rodin/review-bot
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

docs: allow approved third-party packages #59

Merged
rodin merged 4 commits from allow-deps into main 2026-05-10 21:07:10 +00:00
Conversation 14 Commits 4 Files Changed 3
+52 -25
3 changed files with 52 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 70267b68f4 - Show all commits
CONVENTIONS.md
+9 -5
View File
@@ -7,18 +7,22 @@
### Approved Third-Party Packages ### Approved Third-Party Packages
| Package | Use Case | | Package | Use Case | Scope |
|---------|----------| |---------|----------|-------|
| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | | `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
| `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) | | `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) | test only |
sonnet-review-bot commented 2026-05-10 20:54:44 +00:00
Review
Copy Link
Copy Source

[NIT] The table lists github.com/google/go-cmp with scope 'test only', but the enforcement script (check-deps.sh) does not differentiate between production and test-only scope — it checks all direct go.mod dependencies uniformly. If go-cmp ends up in go.mod as a direct dependency (which it will when used in _test.go files), it passes the allowlist check regardless of where it's imported. The 'test only' scope annotation is purely documentation with no mechanical enforcement. This is acceptable but worth noting so future maintainers don't assume it's enforced.

**[NIT]** The table lists `github.com/google/go-cmp` with scope 'test only', but the enforcement script (`check-deps.sh`) does not differentiate between production and test-only scope — it checks all direct go.mod dependencies uniformly. If `go-cmp` ends up in go.mod as a direct dependency (which it will when used in `_test.go` files), it passes the allowlist check regardless of where it's imported. The 'test only' scope annotation is purely documentation with no mechanical enforcement. This is acceptable but worth noting so future maintainers don't assume it's enforced.
sonnet-review-bot commented 2026-05-10 21:02:56 +00:00
Review
Copy Link
Copy Source

[NIT] The note 'Transitive dependencies of approved packages are automatically allowed' is a policy statement, but the enforcement script only checks direct module dependencies (via go list -m ... all with .Indirect filtered out). This is correct and intentional, but it's worth confirming the wording matches: transitive deps won't appear as violations, which aligns with the statement.

**[NIT]** The note 'Transitive dependencies of approved packages are automatically allowed' is a policy statement, but the enforcement script only checks direct module dependencies (via `go list -m ... all` with `.Indirect` filtered out). This is correct and intentional, but it's worth confirming the wording matches: transitive deps won't appear as violations, which aligns with the statement.
**Any import not in this table or the Go standard library is forbidden.** **Any import not in this table or the Go standard library is forbidden.**
Transitive dependencies of approved packages are automatically allowed.
To request a new dependency: To request a new dependency:
1. Open a PR that ONLY updates this table with justification 1. Open a PR that ONLY updates this table
sonnet-review-bot commented 2026-05-10 20:58:41 +00:00
Review
Copy Link
Copy Source

[NIT] The sentence 'Transitive dependencies of approved packages are automatically allowed' is a policy statement that the check-deps.sh script does NOT currently verify (it only checks direct deps via go list -m). This is correct behavior—you generally don't want to enumerate all transitive deps—but the wording could be clearer: something like 'Transitive dependencies pulled in by approved packages do not need to be listed here' to make it clear this is intentional, not an oversight.

**[NIT]** The sentence 'Transitive dependencies of approved packages are automatically allowed' is a policy statement that the check-deps.sh script does NOT currently verify (it only checks direct deps via `go list -m`). This is correct behavior—you generally don't want to enumerate all transitive deps—but the wording could be clearer: something like 'Transitive dependencies pulled in by approved packages do not need to be listed here' to make it clear this is intentional, not an oversight.
2. Requires explicit approval from Aaron 2. Requires explicit approval from Aaron
3. After merge, a separate PR may use the package 3. After merge, a separate PR may use the package
*Enforcement: `scripts/check-deps.sh` parses this table — update only here.*
## Error Handling ## Error Handling
- Return errors; never panic. - Return errors; never panic.
Makefile
+1 -1
View File
@@ -1,4 +1,4 @@
.PHONY: build test test-integration lint clean coverage check-deps .PHONY: build test test-integration lint clean coverage check-deps precommit
build: build:
go build -o review-bot ./cmd/review-bot/ go build -o review-bot ./cmd/review-bot/
2
scripts/check-deps.sh
+42 -19
View File
@@ -1,27 +1,43 @@
#!/bin/bash #!/bin/bash
# check-deps.sh - Enforces the strict dependency allowlist from CONVENTIONS.md # check-deps.sh - Enforces the strict dependency allowlist from CONVENTIONS.md
# Exit 1 if any unapproved import is found. # Exit 1 if any unapproved import is found.
#
# The allowlist is parsed from CONVENTIONS.md to maintain a single source of truth.
set -euo pipefail set -euo pipefail
# Approved third-party packages (from CONVENTIONS.md) CONVENTIONS_FILE="${1:-CONVENTIONS.md}"
ALLOWED=(
"gopkg.in/yaml.v3"
"github.com/google/go-cmp"
)
# Build regex pattern from allowed list if [ ! -f "$CONVENTIONS_FILE" ]; then
ALLOWED_PATTERN="" echo "❌ CONVENTIONS.md not found"
for pkg in "${ALLOWED[@]}"; do exit 1
if [ -z "$ALLOWED_PATTERN" ]; then fi
ALLOWED_PATTERN="$pkg"
else # Parse approved packages from CONVENTIONS.md table
ALLOWED_PATTERN="$ALLOWED_PATTERN|$pkg" # Looks for lines like: | `gopkg.in/yaml.v3` | ...
ALLOWED=()
while IFS= read -r line; do
# Extract package from markdown table cell: | `package` |
pkg=$(echo "$line" | grep -oP '\| `\K[^`]+' | head -1 || true)
if [ -n "$pkg" ] && [[ "$pkg" != "Package" ]]; then
ALLOWED+=("$pkg")
gpt-review-bot commented 2026-05-10 20:55:39 +00:00
Review
Copy Link
Copy Source

[MINOR] Uses 'grep -P' (Perl regex), which is not available on macOS/BSD grep by default. This reduces cross-platform developer usability for the precommit hook.

**[MINOR]** Uses 'grep -P' (Perl regex), which is not available on macOS/BSD grep by default. This reduces cross-platform developer usability for the precommit hook.
fi fi
done done < <(grep -E '^\| `[a-zA-Z]' "$CONVENTIONS_FILE" || true)
# Get all imports from go.mod (excluding the module itself and stdlib) if [ ${#ALLOWED[@]} -eq 0 ]; then
IMPORTS=$(go list -m all 2>/dev/null | tail -n +2 | awk '{print $1}' || true) echo "⚠️ No approved packages found in $CONVENTIONS_FILE"
echo " (This is fine if you want stdlib-only)"
fi
# Get DIRECT dependencies only (exclude indirect/transitive)
gpt-review-bot commented 2026-05-10 21:04:14 +00:00
Review
Copy Link
Copy Source

[NIT] Parsing the markdown table with grep/awk is somewhat brittle (e.g., relies on backticks around package names and exact column positions). This is acceptable given the documented process, but a brief note in CONVENTIONS.md to preserve formatting would help avoid accidental breakage.

**[NIT]** Parsing the markdown table with `grep`/`awk` is somewhat brittle (e.g., relies on backticks around package names and exact column positions). This is acceptable given the documented process, but a brief note in CONVENTIONS.md to preserve formatting would help avoid accidental breakage.
# Fail closed: if go list fails, we exit non-zero
IMPORTS=$(go list -m -f '{{if not .Indirect}}{{.Path}}{{end}}' all 2>&1) || {
echo "❌ Failed to list dependencies: $IMPORTS"
gpt-review-bot commented 2026-05-10 21:04:14 +00:00
Review
Copy Link
Copy Source

[MINOR] The filter [[ "$pkg" =~ ^[a-zA-Z] ]] rejects valid import paths that begin with a digit (e.g., 9fans.net/go). Consider relaxing to ^[[:alnum:]] or removing the check, since the header row is already excluded by the grep.

**[MINOR]** The filter `[[ "$pkg" =~ ^[a-zA-Z] ]]` rejects valid import paths that begin with a digit (e.g., 9fans.net/go). Consider relaxing to `^[[:alnum:]]` or removing the check, since the header row is already excluded by the grep.
exit 1
}
# Filter out the module itself (first line) and empty lines
IMPORTS=$(echo "$IMPORTS" | tail -n +2 | grep -v '^$' || true)
if [ -z "$IMPORTS" ]; then if [ -z "$IMPORTS" ]; then
echo "✅ No external dependencies" echo "✅ No external dependencies"
@@ -30,10 +46,9 @@ fi
VIOLATIONS="" VIOLATIONS=""
while IFS= read -r import; do while IFS= read -r import; do
# Skip empty lines
[ -z "$import" ] && continue [ -z "$import" ] && continue
# Check if import matches any allowed pattern (prefix match for subpackages) # Check if import matches any allowed package (prefix match for subpackages)
MATCHED=false MATCHED=false
for allowed in "${ALLOWED[@]}"; do for allowed in "${ALLOWED[@]}"; do
if [[ "$import" == "$allowed" ]] || [[ "$import" == "$allowed/"* ]]; then if [[ "$import" == "$allowed" ]] || [[ "$import" == "$allowed/"* ]]; then
1
 @@ -43,13 +58,20 @@ while IFS= read -r import; do
done done
if [ "$MATCHED" = false ]; then if [ "$MATCHED" = false ]; then
VIOLATIONS="$VIOLATIONS\n - $import" VIOLATIONS="${VIOLATIONS} - ${import}"$'\n'
fi fi
done <<< "$IMPORTS" done <<< "$IMPORTS"
if [ -n "$VIOLATIONS" ]; then if [ -n "$VIOLATIONS" ]; then
echo "❌ UNAPPROVED DEPENDENCIES DETECTED" echo "❌ UNAPPROVED DEPENDENCIES DETECTED"
echo -e "The following imports are not in the allowlist:$VIOLATIONS" echo ""
echo "The following imports are not in the allowlist:"
printf "%s" "$VIOLATIONS"
echo ""
echo "Approved packages (from CONVENTIONS.md):"
sonnet-review-bot commented 2026-05-10 21:02:56 +00:00
Review
Copy Link
Copy Source

[MINOR] If go list returns non-module output (e.g. build errors) the error is captured in DIRECT_IMPORTS and the early-exit error message will contain the raw go toolchain output. This works adequately but the error message could be confusing. Minor quality-of-life issue.

**[MINOR]** If `go list` returns non-module output (e.g. build errors) the error is captured in `DIRECT_IMPORTS` and the early-exit error message will contain the raw go toolchain output. This works adequately but the error message could be confusing. Minor quality-of-life issue.
for pkg in "${ALLOWED[@]}"; do
echo " - $pkg"
sonnet-review-bot commented 2026-05-10 21:02:56 +00:00
Review
Copy Link
Copy Source

[MINOR] The script checks go.mod direct dependencies for allowlist compliance, but the scope enforcement (lines 97-111) checks the full production import graph via go list -deps. These two checks are at different granularities and could diverge. For example, a direct dependency might be test-only in practice but go list -deps ./... (which doesn't filter test files) would still traverse it. Using go list -deps -test=false ./... more explicitly conveys intent, though the current flag-less form already excludes test builds.

**[MINOR]** The script checks `go.mod` direct dependencies for allowlist compliance, but the scope enforcement (lines 97-111) checks the full production import graph via `go list -deps`. These two checks are at different granularities and could diverge. For example, a direct dependency might be test-only in practice but `go list -deps ./...` (which doesn't filter test files) would still traverse it. Using `go list -deps -test=false ./...` more explicitly conveys intent, though the current flag-less form already excludes test builds.
done
echo "" echo ""
echo "To add a dependency:" echo "To add a dependency:"
echo " 1. Open a PR that ONLY updates CONVENTIONS.md" echo " 1. Open a PR that ONLY updates CONVENTIONS.md"
@@ -59,3 +81,4 @@ if [ -n "$VIOLATIONS" ]; then
fi fi
echo "✅ All dependencies are approved" echo "✅ All dependencies are approved"
echo " Direct deps: $(echo "$IMPORTS" | wc -l | tr -d ' ')"