Skip to content

Commit 54653ff

Browse files
ruromeroclaude
andauthored
fix: add uv to root-level ignore and use explicit paths (guacsec#448)
## Summary - Add root-level `ignore: [{dependency-name: "*"}]` for the uv ecosystem (missed in PR guacsec#431) - Remove redundant per-directory entries for ecosystems covered by root-level ignore-all - Replace `/**` glob patterns with explicit directory listings for maven test fixtures - Add test fixture dependabot guidance to CONVENTIONS.md ## Context PR guacsec#431 added root-level ignore-all for npm, pip, gomod, gradle, cargo but missed `uv`, causing Dependabot to create security PRs for pyproject.toml files in test fixtures (guacsec#439, guacsec#440, guacsec#441). Glob patterns are replaced with explicit paths since `/**` doesn't reliably match nested subdirectories for security updates. ## Test plan - [ ] Verify uv security PRs (guacsec#439, guacsec#440, guacsec#441) are closed by Dependabot - [ ] Verify no new security PRs appear for test fixture directories - [ ] Verify production maven dependency updates still work normally 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by Sourcery Update Dependabot configuration to correctly suppress updates for test fixtures while preserving production maven updates, and document project coding and Dependabot conventions. Bug Fixes: - Add root-level ignore-all entry for the uv ecosystem so Dependabot does not open security PRs for uv-based test fixtures. Enhancements: - Simplify Dependabot configuration by relying on root-level ignore-all entries for non-maven ecosystems and consolidating cargo configuration. - Restrict Dependabot handling of maven test fixtures to an explicit list of fixture directories to ensure they are not updated while keeping production maven updates active. CI: - Adjust .github/dependabot.yml to correct ecosystem entries and explicitly list maven test fixture directories for suppression. Documentation: - Add CONVENTIONS.md to document coding standards, dependencies, and guidance for managing Dependabot suppression of test fixtures. --------- Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent e8921c8 commit 54653ff

6 files changed

Lines changed: 314 additions & 58 deletions

File tree

.github/dependabot.yml

Lines changed: 29 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -34,91 +34,62 @@ updates:
3434
labels: []
3535
ignore:
3636
- dependency-name: "*"
37-
- package-ecosystem: "gomod"
37+
- package-ecosystem: "uv"
3838
directory: "/"
3939
schedule:
4040
interval: "monthly"
4141
open-pull-requests-limit: 0
4242
labels: []
4343
ignore:
4444
- dependency-name: "*"
45-
- package-ecosystem: "gradle"
45+
- package-ecosystem: "gomod"
4646
directory: "/"
4747
schedule:
4848
interval: "monthly"
4949
open-pull-requests-limit: 0
5050
labels: []
5151
ignore:
5252
- dependency-name: "*"
53-
- package-ecosystem: "cargo"
53+
- package-ecosystem: "gradle"
5454
directory: "/"
5555
schedule:
5656
interval: "monthly"
5757
open-pull-requests-limit: 0
5858
labels: []
5959
ignore:
6060
- dependency-name: "*"
61-
62-
# ── Test fixture manifests (suppress all updates including security) ─
63-
# These directories contain intentionally pinned dependencies used as
64-
# test fixtures. They must NOT be updated by dependabot.
65-
- package-ecosystem: "maven"
66-
directories:
67-
- "/src/test/resources/tst_manifests/maven/**"
68-
- "/src/test/resources/tst_manifests/it/maven/**"
69-
schedule:
70-
interval: "monthly"
71-
labels: []
72-
ignore:
73-
- dependency-name: "*"
74-
- package-ecosystem: "npm"
75-
directories:
76-
- "/src/test/resources/tst_manifests/npm/**"
77-
- "/src/test/resources/tst_manifests/pnpm/**"
78-
- "/src/test/resources/tst_manifests/yarn-berry/**"
79-
- "/src/test/resources/tst_manifests/yarn-classic/**"
80-
- "/src/test/resources/tst_manifests/it/npm/**"
81-
- "/src/test/resources/tst_manifests/it/pnpm/**"
82-
- "/src/test/resources/tst_manifests/it/yarn/**"
83-
schedule:
84-
interval: "monthly"
85-
labels: []
86-
ignore:
87-
- dependency-name: "*"
88-
- package-ecosystem: "pip"
89-
directories:
90-
- "/src/test/resources/tst_manifests/pip/**"
91-
- "/src/test/resources/tst_manifests/it/pypi/**"
92-
- "/src/test/resources/msc/python"
93-
schedule:
94-
interval: "monthly"
95-
labels: []
96-
ignore:
97-
- dependency-name: "*"
98-
- package-ecosystem: "gomod"
99-
directories:
100-
- "/src/test/resources/tst_manifests/golang/**"
101-
- "/src/test/resources/tst_manifests/it/golang/**"
102-
- "/src/test/resources/msc/golang/**"
103-
schedule:
104-
interval: "monthly"
105-
labels: []
106-
ignore:
107-
- dependency-name: "*"
108-
- package-ecosystem: "gradle"
109-
directories:
110-
- "/src/test/resources/tst_manifests/gradle-groovy/**"
111-
- "/src/test/resources/tst_manifests/gradle-kotlin/**"
112-
- "/src/test/resources/tst_manifests/it/gradle-groovy/**"
113-
- "/src/test/resources/tst_manifests/it/gradle-kotlin/**"
61+
- package-ecosystem: "cargo"
62+
directory: "/"
11463
schedule:
11564
interval: "monthly"
65+
open-pull-requests-limit: 0
11666
labels: []
11767
ignore:
11868
- dependency-name: "*"
119-
- package-ecosystem: "cargo"
69+
70+
# ── Test fixture manifests (maven only) ──────────────────────────────
71+
# Maven is the production ecosystem so it cannot use a root-level
72+
# ignore-all. Glob patterns (/**) don't reliably match nested
73+
# subdirectories for security updates, so every directory containing
74+
# a pom.xml is listed explicitly. Update this list when adding new
75+
# test fixtures.
76+
- package-ecosystem: "maven"
12077
directories:
121-
- "/src/test/resources/tst_manifests/cargo/**"
78+
- "/src/test/resources/tst_manifests/it/maven"
79+
- "/src/test/resources/tst_manifests/maven/deps_no_trivial_with_ignore"
80+
- "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_artifact"
81+
- "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_dependency"
82+
- "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_group"
83+
- "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_version"
84+
- "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_wrong"
85+
- "/src/test/resources/tst_manifests/maven/deps_with_no_ignore"
86+
- "/src/test/resources/tst_manifests/maven/empty"
87+
- "/src/test/resources/tst_manifests/maven/license/pom_with_empty_license"
88+
- "/src/test/resources/tst_manifests/maven/license/pom_with_license"
89+
- "/src/test/resources/tst_manifests/maven/license/pom_with_multiple_licenses"
90+
- "/src/test/resources/tst_manifests/maven/license/pom_without_license"
91+
- "/src/test/resources/tst_manifests/maven/pom_deps_with_no_ignore_common_paths"
92+
- "/src/test/resources/tst_manifests/maven/pom_deps_with_no_ignore_provided_scope"
12293
schedule:
12394
interval: "monthly"
12495
labels: []

.serena/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
/cache
2+
/project.local.yml
Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# GoModulesProvider Architecture
2+
3+
## Dependency Resolution Flow
4+
1. `getDependenciesSbom(Path, boolean)` orchestrates: runs `go mod graph`, `go mod edit -json`, determines main module version
5+
2. `buildGoModulesDependencies(Path)` - runs `go mod graph` to get full dependency graph
6+
3. `getDirectDependencyPaths(Path)` - runs `go mod edit -json` to identify direct vs indirect deps
7+
4. For stack analysis: `buildSbomFromGraph` builds full dependency tree
8+
5. For component analysis: `buildSbomFromList` lists only direct dependencies
9+
10+
## Direct vs Indirect Filtering (TC-4300)
11+
- Since Go 1.17, `go mod tidy` adds all transitively-imported modules to go.mod with `// indirect` marker
12+
- `go mod graph` emits root-level edges for ALL modules in go.mod (both direct and indirect)
13+
- `go mod edit -json` returns structured JSON with `Require` array where each entry has optional `Indirect: true`
14+
- Both `buildSbomFromGraph` and `buildSbomFromList` filter root-level deps to only include direct ones
15+
16+
## Key Gotcha: MVS Version Suffix
17+
After MVS processing (`getFinalPackagesVersionsForModule`), the root key in the edges map changes from `module/path` to `module/path@v0.0.0`. The root comparison must use `getModulePath()` to strip the version suffix for both sides, otherwise the filtering silently does nothing when MVS is enabled.
18+
19+
## Helper Methods
20+
- `getModulePath(String)` - strips `@version` suffix from `go mod graph` entries (e.g., `github.com/foo/bar@v1.2.3` -> `github.com/foo/bar`)
21+
- `extractPackageName(String)` - strips `//` comment from go.mod require lines (different purpose, don't confuse)
22+
- `getParentVertex(String)` / `getChildVertex(String)` - split `go mod graph` edge lines on space
23+
- `isGoToolchainEntry(String)` - filters out `go@` and `toolchain@` entries
24+
25+
## Test Fixtures
26+
- `src/test/resources/tst_manifests/golang/` - main test fixtures with 6 test folders
27+
- `src/test/resources/msc/golang/mvs_logic/` - MVS-specific test fixtures
28+
- Tests use `dropIgnoredKeepFormat()` to strip timestamps and goarch/goos before comparison
29+
- Tests use `prettyJson()` (Jackson) to normalize JSON formatting
Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# exhort-java-api Project Overview
2+
3+
## Purpose
4+
Java client library for the Dependency Analytics (DA) / Exhort vulnerability analysis backend. Generates SBOMs (CycloneDX JSON) from project manifests and submits them for analysis.
5+
6+
## Tech Stack
7+
- Java 17+, Maven build
8+
- Jackson for JSON, TOML parsing (com.moandjiezana.toml)
9+
- XMLStreamReader for POM parsing
10+
- CycloneDX SBOM model (custom `Sbom` class)
11+
12+
## Key Directories
13+
- `src/main/java/io/github/guacsec/trustifyda/providers/` - Provider implementations per ecosystem
14+
- `src/main/java/io/github/guacsec/trustifyda/tools/` - Utilities (Operations, Ecosystem, Environment)
15+
- `src/main/java/io/github/guacsec/trustifyda/utils/` - Shared utilities (IgnorePatternDetector, PythonControllerBase)
16+
- `src/test/resources/tst_manifests/` - Test fixtures per ecosystem
17+
18+
## Provider Pattern
19+
Each ecosystem has a Provider class extending `Provider` abstract class with methods:
20+
- `provideStack()` - Full dependency tree SBOM
21+
- `provideComponent()` - Direct dependencies only SBOM
22+
- `readLicenseFromManifest()` - License extraction
23+
- `validateLockFile(Path)` - Lock file validation
24+
25+
## Ignore Pattern Detection
26+
Centralized in `IgnorePatternDetector` with constants `IGNORE_PATTERN` ("trustify-da-ignore") and `LEGACY_IGNORE_PATTERN` ("exhortignore").
27+
28+
## Commands
29+
- Build: `mvn clean install`
30+
- Test: `mvn test`
31+
- Format: `mvn spotless:apply`

.serena/project.yml

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
# the name by which the project can be referenced within Serena
2+
project_name: "trustify-da-java-client"
3+
4+
5+
# list of languages for which language servers are started; choose from:
6+
# al ansible bash clojure cpp
7+
# cpp_ccls crystal csharp csharp_omnisharp dart
8+
# elixir elm erlang fortran fsharp
9+
# go groovy haskell haxe hlsl
10+
# java json julia kotlin lean4
11+
# lua luau markdown matlab msl
12+
# nix ocaml pascal perl php
13+
# php_phpactor powershell python python_jedi python_ty
14+
# r rego ruby ruby_solargraph rust
15+
# scala solidity swift systemverilog terraform
16+
# toml typescript typescript_vts vue yaml
17+
# zig
18+
# (This list may be outdated. For the current list, see values of Language enum here:
19+
# https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py
20+
# For some languages, there are alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
21+
# Note:
22+
# - For C, use cpp
23+
# - For JavaScript, use typescript
24+
# - For Free Pascal/Lazarus, use pascal
25+
# Special requirements:
26+
# Some languages require additional setup/installations.
27+
# See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
28+
# When using multiple languages, the first language server that supports a given file will be used for that file.
29+
# The first language is the default language and the respective language server will be used as a fallback.
30+
# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
31+
languages:
32+
- java
33+
34+
# the encoding used by text files in the project
35+
# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
36+
encoding: "utf-8"
37+
38+
# line ending convention to use when writing source files.
39+
# Possible values: unset (use global setting), "lf", "crlf", or "native" (platform default)
40+
# This does not affect Serena's own files (e.g. memories and configuration files), which always use native line endings.
41+
line_ending:
42+
43+
# The language backend to use for this project.
44+
# If not set, the global setting from serena_config.yml is used.
45+
# Valid values: LSP, JetBrains
46+
# Note: the backend is fixed at startup. If a project with a different backend
47+
# is activated post-init, an error will be returned.
48+
language_backend:
49+
50+
# whether to use project's .gitignore files to ignore files
51+
ignore_all_files_in_gitignore: true
52+
53+
# list of additional paths to ignore in this project.
54+
# Same syntax as gitignore, so you can use * and **.
55+
# Note: global ignored_paths from serena_config.yml are also applied additively.
56+
ignored_paths: []
57+
58+
# whether the project is in read-only mode
59+
# If set to true, all editing tools will be disabled and attempts to use them will result in an error
60+
# Added on 2025-04-18
61+
read_only: false
62+
63+
# list of tool names to exclude.
64+
# This extends the existing exclusions (e.g. from the global configuration)
65+
# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
66+
excluded_tools: []
67+
68+
# list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default).
69+
# This extends the existing inclusions (e.g. from the global configuration).
70+
# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
71+
included_optional_tools: []
72+
73+
# fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools.
74+
# This cannot be combined with non-empty excluded_tools or included_optional_tools.
75+
# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
76+
fixed_tools: []
77+
78+
# list of mode names to that are always to be included in the set of active modes
79+
# The full set of modes to be activated is base_modes + default_modes.
80+
# If the setting is undefined, the base_modes from the global configuration (serena_config.yml) apply.
81+
# Otherwise, this setting overrides the global configuration.
82+
# Set this to [] to disable base modes for this project.
83+
# Set this to a list of mode names to always include the respective modes for this project.
84+
base_modes:
85+
86+
# list of mode names that are to be activated by default, overriding the setting in the global configuration.
87+
# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
88+
# If the setting is undefined/empty, the default_modes from the global configuration (serena_config.yml) apply.
89+
# Otherwise, this overrides the setting from the global configuration (serena_config.yml).
90+
# Therefore, you can set this to [] if you do not want the default modes defined in the global config to apply
91+
# for this project.
92+
# This setting can, in turn, be overridden by CLI parameters (--mode).
93+
# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
94+
default_modes:
95+
96+
# initial prompt for the project. It will always be given to the LLM upon activating the project
97+
# (contrary to the memories, which are loaded on demand).
98+
initial_prompt: ""
99+
100+
# time budget (seconds) per tool call for the retrieval of additional symbol information
101+
# such as docstrings or parameter information.
102+
# This overrides the corresponding setting in the global configuration; see the documentation there.
103+
# If null or missing, use the setting from the global configuration.
104+
symbol_info_budget:
105+
106+
# list of regex patterns which, when matched, mark a memory entry as read‑only.
107+
# Extends the list from the global configuration, merging the two lists.
108+
read_only_memory_patterns: []
109+
110+
# list of regex patterns for memories to completely ignore.
111+
# Matching memories will not appear in list_memories or activate_project output
112+
# and cannot be accessed via read_memory or write_memory.
113+
# To access ignored memory files, use the read_file tool on the raw file path.
114+
# Extends the list from the global configuration, merging the two lists.
115+
# Example: ["_archive/.*", "_episodes/.*"]
116+
ignored_memory_patterns: []
117+
118+
# advanced configuration option allowing to configure language server-specific options.
119+
# Maps the language key to the options.
120+
# Have a look at the docstring of the constructors of the LS implementations within solidlsp (e.g., for C# or PHP) to see which options are available.
121+
# No documentation on options means no options are available.
122+
ls_specific_settings: {}
123+
124+
# list of mode names to be activated additionally for this project, e.g. ["query-projects"]
125+
# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
126+
# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
127+
added_modes:

0 commit comments

Comments
 (0)