Rodin
aeb0c8cb79
PR Ready Gate / clear-labels (pull_request) Successful in 2s
CI / test (pull_request) Successful in 14s
CI / review (anthropic--claude-4.6-sonnet, sonnet, SONNET_REVIEW_TOKEN) (pull_request) Successful in 35s
CI / review (gpt-5, security, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 1m46s
CI / review (gpt-5, gpt, GPT_REVIEW_TOKEN) (pull_request) Successful in 2m2s
Addresses review feedback: 1. MAJOR - Scope enforcement: Script now parses the Scope column and ensures 'test only' packages don't appear in non-test code. Uses 'go list -deps' to check production imports. 2. MINOR - Portability: Replaced 'grep -P' (GNU-only) with awk-based parsing that works on macOS/BSD. 3. MINOR - Robustness: Table parsing uses awk to split on '|' and extract columns properly, handling whitespace variations. 4. MINOR - Glob safety: Prefix matching now uses parameter expansion instead of glob patterns to prevent metacharacter issues.
123 lines
4.0 KiB
Bash
Executable File
123 lines
4.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# check-deps.sh - Enforces the strict dependency allowlist from CONVENTIONS.md
|
|
# Exit 1 if any unapproved import is found.
|
|
#
|
|
# The allowlist is parsed from CONVENTIONS.md to maintain a single source of truth.
|
|
# Also enforces Scope column: "test only" packages cannot appear in non-test code.
|
|
|
|
set -euo pipefail
|
|
|
|
CONVENTIONS_FILE="${1:-CONVENTIONS.md}"
|
|
|
|
if [ ! -f "$CONVENTIONS_FILE" ]; then
|
|
echo "❌ CONVENTIONS.md not found"
|
|
exit 1
|
|
fi
|
|
|
|
# Parse approved packages from CONVENTIONS.md table using awk (POSIX-compatible)
|
|
# Format: | `package` | use case | scope |
|
|
# Output: package:scope (e.g., "gopkg.in/yaml.v3:production")
|
|
declare -A ALLOWED_PROD=()
|
|
declare -A ALLOWED_TEST=()
|
|
|
|
while IFS= read -r line; do
|
|
# Use awk to extract package and scope from table row
|
|
# Split on | and extract backtick-wrapped package from column 1, scope from column 3
|
|
pkg=$(echo "$line" | awk -F'|' '{gsub(/^[[:space:]]*`|`[[:space:]]*$/, "", $2); print $2}')
|
|
scope=$(echo "$line" | awk -F'|' '{gsub(/^[[:space:]]+|[[:space:]]+$/, "", $4); print tolower($4)}')
|
|
|
|
if [ -n "$pkg" ] && [ "$pkg" != "Package" ] && [[ "$pkg" =~ ^[a-zA-Z] ]]; then
|
|
if [[ "$scope" == *"test"* ]]; then
|
|
ALLOWED_TEST["$pkg"]=1
|
|
else
|
|
ALLOWED_PROD["$pkg"]=1
|
|
fi
|
|
fi
|
|
done < <(grep '| `' "$CONVENTIONS_FILE" 2>/dev/null || true)
|
|
|
|
ALL_ALLOWED=("${!ALLOWED_PROD[@]}" "${!ALLOWED_TEST[@]}")
|
|
|
|
if [ ${#ALL_ALLOWED[@]} -eq 0 ]; then
|
|
echo "⚠️ No approved packages found in $CONVENTIONS_FILE"
|
|
echo " (This is fine if you want stdlib-only)"
|
|
fi
|
|
|
|
# Helper: check if import matches any package in an associative array (literal prefix, no glob)
|
|
matches_allowlist() {
|
|
local import="$1"
|
|
shift
|
|
local -n allowlist=$1
|
|
|
|
for allowed in "${!allowlist[@]}"; do
|
|
# Exact match
|
|
if [ "$import" = "$allowed" ]; then
|
|
return 0
|
|
fi
|
|
# Literal prefix match for subpackages (no glob interpretation)
|
|
if [ "${import#"$allowed/"}" != "$import" ]; then
|
|
return 0
|
|
fi
|
|
done
|
|
return 1
|
|
}
|
|
|
|
# Get DIRECT dependencies only (exclude indirect/transitive)
|
|
# Fail closed: if go list fails, we exit non-zero
|
|
IMPORTS=$(go list -m -f '{{if not .Indirect}}{{.Path}}{{end}}' all 2>&1) || {
|
|
echo "❌ Failed to list dependencies: $IMPORTS"
|
|
exit 1
|
|
}
|
|
|
|
# Filter out the module itself (first line) and empty lines
|
|
IMPORTS=$(echo "$IMPORTS" | tail -n +2 | grep -v '^$' || true)
|
|
|
|
if [ -z "$IMPORTS" ]; then
|
|
echo "✅ No external dependencies"
|
|
exit 0
|
|
fi
|
|
|
|
# Check all direct dependencies are in the allowlist
|
|
VIOLATIONS=""
|
|
while IFS= read -r import; do
|
|
[ -z "$import" ] && continue
|
|
|
|
if ! matches_allowlist "$import" ALLOWED_PROD && ! matches_allowlist "$import" ALLOWED_TEST; then
|
|
VIOLATIONS="${VIOLATIONS} - ${import} (not in allowlist)"$'\n'
|
|
fi
|
|
done <<< "$IMPORTS"
|
|
|
|
if [ -n "$VIOLATIONS" ]; then
|
|
echo "❌ UNAPPROVED DEPENDENCIES DETECTED"
|
|
echo ""
|
|
echo "The following imports are not in the allowlist:"
|
|
printf "%s" "$VIOLATIONS"
|
|
echo ""
|
|
echo "To add a dependency, update CONVENTIONS.md (requires Aaron's approval)"
|
|
exit 1
|
|
fi
|
|
|
|
# Enforce Scope: test-only packages must not appear in non-test code
|
|
# Get imports used by non-test code only
|
|
PROD_IMPORTS=$(go list -deps -f '{{if not .Standard}}{{.ImportPath}}{{end}}' ./... 2>/dev/null | grep -v '_test' || true)
|
|
|
|
TEST_ONLY_IN_PROD=""
|
|
for test_pkg in "${!ALLOWED_TEST[@]}"; do
|
|
if echo "$PROD_IMPORTS" | grep -q "^${test_pkg}"; then
|
|
TEST_ONLY_IN_PROD="${TEST_ONLY_IN_PROD} - ${test_pkg} (marked 'test only' but used in production code)"$'\n'
|
|
fi
|
|
done
|
|
|
|
if [ -n "$TEST_ONLY_IN_PROD" ]; then
|
|
echo "❌ TEST-ONLY DEPENDENCIES IN PRODUCTION CODE"
|
|
echo ""
|
|
printf "%s" "$TEST_ONLY_IN_PROD"
|
|
echo ""
|
|
echo "These packages are marked 'test only' in CONVENTIONS.md"
|
|
echo "and must only be imported from *_test.go files."
|
|
exit 1
|
|
fi
|
|
|
|
echo "✅ All dependencies are approved"
|
|
echo " Direct deps: $(echo "$IMPORTS" | wc -l | tr -d ' ')"
|
|
echo " Production: ${#ALLOWED_PROD[@]}, Test-only: ${#ALLOWED_TEST[@]}"
|