feat: implement --show-diff for rust, php, and js languages (#100)

Summary
The --show-diff flag was only implemented for Go. Rust, PHP, and JS all copied the flag into their internal config types but never read it — --show-diff was silently ignored.

This adds the same before/after snapshot + cmp.Diff pattern to all three:

Rust: diffs Cargo.lock before and after DoUpdate
JS: diffs package.json before and after ApplyOverrides
PHP: diffs all manifest files (from the detected build tool) before and after buildTool.Update
Follows the existing Go implementation in pkg/languages/golang/updater.go.

🤖 Generated with Claude Code

Author: justinvreeland

pkg/languages/js/js.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/chainguard-dev/clog"
 	"github.com/chainguard-dev/omnibump/pkg/languages"
+	"github.com/google/go-cmp/cmp"
 )
 
 // PackageJSON is the canonical manifest filename for JavaScript projects.
@@ -105,10 +106,22 @@ func (j *JS) Update(ctx context.Context, cfg *languages.UpdateConfig) error {
 		return nil
 	}
 
+	var originalContent []byte
+	if cfg.ShowDiff {
+		originalContent, _ = os.ReadFile(pkgPath) //nolint:gosec // pkgPath validated by os.Stat above
+	}
+
 	if err := ApplyOverrides(pkgPath, managers, overrides); err != nil {
 		return fmt.Errorf("apply overrides: %w", err)
 	}
 
+	if cfg.ShowDiff && originalContent != nil {
+		newContent, _ := os.ReadFile(pkgPath) //nolint:gosec // pkgPath validated by os.Stat above
+		if diff := cmp.Diff(string(originalContent), string(newContent)); diff != "" {
+			log.Infof("Diff for %s:\n%s", pkgPath, diff)
+		}
+	}
+
 	log.Infof("Successfully applied overrides to %s", pkgPath)
 	return nil
 }

pkg/languages/php/php.go

@@ -9,10 +9,13 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"os"
+	"path/filepath"
 
 	"github.com/chainguard-dev/clog"
 	"github.com/chainguard-dev/omnibump/pkg/languages"
 	"github.com/chainguard-dev/omnibump/pkg/languages/php/composer"
+	"github.com/google/go-cmp/cmp"
 )
 
 // ErrNoBuildToolFound indicates no supported PHP build tool was detected.
@@ -80,8 +83,33 @@ func (p *PHP) Update(ctx context.Context, cfg *languages.UpdateConfig) error {
 
 	log.Infof("Detected PHP build tool: %s", p.buildTool.Name())
 
+	// Snapshot manifest files for --show-diff.
+	var snapshots map[string][]byte
+	if cfg.ShowDiff {
+		snapshots = make(map[string][]byte)
+		for _, name := range p.buildTool.GetManifestFiles() {
+			path := filepath.Join(cfg.RootDir, name)
+			if data, err := os.ReadFile(path); err == nil { //nolint:gosec // path built from cfg.RootDir + known manifest filenames
+				snapshots[path] = data
+			}
+		}
+	}
+
 	// Delegate to the build tool
-	return p.buildTool.Update(ctx, cfg)
+	if err := p.buildTool.Update(ctx, cfg); err != nil {
+		return err
+	}
+
+	if cfg.ShowDiff && snapshots != nil {
+		for path, original := range snapshots {
+			newContent, _ := os.ReadFile(path) //nolint:gosec // path built from cfg.RootDir + known manifest filenames
+			if diff := cmp.Diff(string(original), string(newContent)); diff != "" {
+				log.Infof("Diff for %s:\n%s", path, diff)
+			}
+		}
+	}
+
+	return nil
 }
 
 // Validate checks if the updates were applied successfully.

pkg/languages/rust/rust.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/chainguard-dev/clog"
 	"github.com/chainguard-dev/omnibump/pkg/languages"
+	"github.com/google/go-cmp/cmp"
 )
 
 var (
@@ -106,12 +107,24 @@ func (r *Rust) Update(ctx context.Context, cfg *languages.UpdateConfig) error {
 		return nil
 	}
 
+	var originalContent []byte
+	if cfg.ShowDiff {
+		originalContent, _ = os.ReadFile(cargoLockPath) //nolint:gosec // cargoLockPath built from cfg.RootDir + constant filename
+	}
+
 	// Perform the update
 	err = DoUpdate(ctx, packages, cargoPackages, updateCfg)
 	if err != nil {
 		return fmt.Errorf("failed to update Cargo packages: %w", err)
 	}
 
+	if cfg.ShowDiff && originalContent != nil {
+		newContent, _ := os.ReadFile(cargoLockPath) //nolint:gosec // cargoLockPath built from cfg.RootDir + constant filename
+		if diff := cmp.Diff(string(originalContent), string(newContent)); diff != "" {
+			log.Infof("Diff for %s:\n%s", cargoLockPath, diff)
+		}
+	}
+
 	log.Infof("Successfully updated Cargo packages")
 	return nil
 }