Skip to content

Commit d6cc464

Browse files
ruromeroclaude
andcommitted
fix: add uv to root-level ignore and use explicit paths
Add root-level `ignore: [{dependency-name: "*"}]` for the uv ecosystem, missed in PR #431. Remove redundant per-directory entries for ecosystems covered by root-level ignore-all. Replace glob patterns with explicit directory listings for maven test fixtures, since `/**` globs don't reliably match nested subdirectories for security updates. Add test fixture guidance to CONVENTIONS.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent e8921c8 commit d6cc464

2 files changed

Lines changed: 129 additions & 58 deletions

File tree

.github/dependabot.yml

Lines changed: 29 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -34,91 +34,62 @@ updates:
3434
labels: []
3535
ignore:
3636
- dependency-name: "*"
37-
- package-ecosystem: "gomod"
37+
- package-ecosystem: "uv"
3838
directory: "/"
3939
schedule:
4040
interval: "monthly"
4141
open-pull-requests-limit: 0
4242
labels: []
4343
ignore:
4444
- dependency-name: "*"
45-
- package-ecosystem: "gradle"
45+
- package-ecosystem: "gomod"
4646
directory: "/"
4747
schedule:
4848
interval: "monthly"
4949
open-pull-requests-limit: 0
5050
labels: []
5151
ignore:
5252
- dependency-name: "*"
53-
- package-ecosystem: "cargo"
53+
- package-ecosystem: "gradle"
5454
directory: "/"
5555
schedule:
5656
interval: "monthly"
5757
open-pull-requests-limit: 0
5858
labels: []
5959
ignore:
6060
- dependency-name: "*"
61-
62-
# ── Test fixture manifests (suppress all updates including security) ─
63-
# These directories contain intentionally pinned dependencies used as
64-
# test fixtures. They must NOT be updated by dependabot.
65-
- package-ecosystem: "maven"
66-
directories:
67-
- "/src/test/resources/tst_manifests/maven/**"
68-
- "/src/test/resources/tst_manifests/it/maven/**"
69-
schedule:
70-
interval: "monthly"
71-
labels: []
72-
ignore:
73-
- dependency-name: "*"
74-
- package-ecosystem: "npm"
75-
directories:
76-
- "/src/test/resources/tst_manifests/npm/**"
77-
- "/src/test/resources/tst_manifests/pnpm/**"
78-
- "/src/test/resources/tst_manifests/yarn-berry/**"
79-
- "/src/test/resources/tst_manifests/yarn-classic/**"
80-
- "/src/test/resources/tst_manifests/it/npm/**"
81-
- "/src/test/resources/tst_manifests/it/pnpm/**"
82-
- "/src/test/resources/tst_manifests/it/yarn/**"
83-
schedule:
84-
interval: "monthly"
85-
labels: []
86-
ignore:
87-
- dependency-name: "*"
88-
- package-ecosystem: "pip"
89-
directories:
90-
- "/src/test/resources/tst_manifests/pip/**"
91-
- "/src/test/resources/tst_manifests/it/pypi/**"
92-
- "/src/test/resources/msc/python"
93-
schedule:
94-
interval: "monthly"
95-
labels: []
96-
ignore:
97-
- dependency-name: "*"
98-
- package-ecosystem: "gomod"
99-
directories:
100-
- "/src/test/resources/tst_manifests/golang/**"
101-
- "/src/test/resources/tst_manifests/it/golang/**"
102-
- "/src/test/resources/msc/golang/**"
103-
schedule:
104-
interval: "monthly"
105-
labels: []
106-
ignore:
107-
- dependency-name: "*"
108-
- package-ecosystem: "gradle"
109-
directories:
110-
- "/src/test/resources/tst_manifests/gradle-groovy/**"
111-
- "/src/test/resources/tst_manifests/gradle-kotlin/**"
112-
- "/src/test/resources/tst_manifests/it/gradle-groovy/**"
113-
- "/src/test/resources/tst_manifests/it/gradle-kotlin/**"
61+
- package-ecosystem: "cargo"
62+
directory: "/"
11463
schedule:
11564
interval: "monthly"
65+
open-pull-requests-limit: 0
11666
labels: []
11767
ignore:
11868
- dependency-name: "*"
119-
- package-ecosystem: "cargo"
69+
70+
# ── Test fixture manifests (maven only) ──────────────────────────────
71+
# Maven is the production ecosystem so it cannot use a root-level
72+
# ignore-all. Glob patterns (/**) don't reliably match nested
73+
# subdirectories for security updates, so every directory containing
74+
# a pom.xml is listed explicitly. Update this list when adding new
75+
# test fixtures.
76+
- package-ecosystem: "maven"
12077
directories:
121-
- "/src/test/resources/tst_manifests/cargo/**"
78+
- "/src/test/resources/tst_manifests/it/maven"
79+
- "/src/test/resources/tst_manifests/maven/deps_no_trivial_with_ignore"
80+
- "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_artifact"
81+
- "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_dependency"
82+
- "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_group"
83+
- "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_version"
84+
- "/src/test/resources/tst_manifests/maven/deps_with_ignore_on_wrong"
85+
- "/src/test/resources/tst_manifests/maven/deps_with_no_ignore"
86+
- "/src/test/resources/tst_manifests/maven/empty"
87+
- "/src/test/resources/tst_manifests/maven/license/pom_with_empty_license"
88+
- "/src/test/resources/tst_manifests/maven/license/pom_with_license"
89+
- "/src/test/resources/tst_manifests/maven/license/pom_with_multiple_licenses"
90+
- "/src/test/resources/tst_manifests/maven/license/pom_without_license"
91+
- "/src/test/resources/tst_manifests/maven/pom_deps_with_no_ignore_common_paths"
92+
- "/src/test/resources/tst_manifests/maven/pom_deps_with_no_ignore_provided_scope"
12293
schedule:
12394
interval: "monthly"
12495
labels: []

CONVENTIONS.md

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# Coding Conventions
2+
3+
<!-- This file documents project-specific coding standards for exhort-java-api. -->
4+
5+
## Language and Framework
6+
7+
- **Primary Language**: Java 17
8+
- **Build Tool**: Maven 3.8+
9+
- **Module System**: Java 9+ modules (`module-info.java`)
10+
- **Key Libraries**: Jackson 2.20.0 (JSON), CycloneDX 11.0.1 (SBOM), Jakarta Mail/Annotation APIs
11+
- **Async Model**: `CompletableFuture` throughout the API
12+
13+
## Code Style
14+
15+
- **Formatter**: Spotless Maven Plugin with Google Java Format (GOOGLE style, `reflowLongStrings` enabled)
16+
- **Indentation**: 2 spaces for Java, XML, YAML; 2 spaces for JSON
17+
- **Line length**: 100 characters (120 for XML/FXML)
18+
- **Line endings**: LF
19+
- **Charset**: UTF-8
20+
- **License header**: Apache 2.0, automatically injected by Spotless
21+
- **EditorConfig**: `.editorconfig` enforces formatting rules
22+
- **Code coverage**: 81% unit test threshold (JaCoCo), 50 mutation threshold (PIT)
23+
24+
## Naming Conventions
25+
26+
- **Packages**: `io.github.guacsec.trustifyda.*`
27+
- **Classes**: PascalCase
28+
- Providers: `*Provider` (e.g., `JavaMavenProvider`, `PythonPipProvider`)
29+
- Factories: `*Factory` (e.g., `JavaScriptProviderFactory`, `SbomFactory`)
30+
- Abstract bases: `Base*Provider` (e.g., `BaseJavaProvider`)
31+
- Utility classes: `final` with private constructor
32+
- **Interfaces**: Simple names without `I` prefix (`Api`, `Provider`, `Sbom`)
33+
- Inner static classes for related types: `Api.MediaType`, `Provider.Content`
34+
- **Methods**: camelCase (`provideStack()`, `provideComponent()`, `getCustomPathOrElse()`)
35+
- **Constants**: UPPER_SNAKE_CASE (`TRUSTIFY_DA_BACKEND_URL`, `CYCLONEDX_MEDIA_TYPE`)
36+
- **Enums**: PascalCase class, UPPER_CASE values (`MAVEN`, `NPM`, `GRADLE`)
37+
- **Test classes**: Snake_case pattern (`Operations_Test`, `Java_Maven_Provider_Test`)
38+
39+
## File Organization
40+
41+
```
42+
src/main/java/io/github/guacsec/trustifyda/
43+
├── Api.java # Main interface
44+
├── Provider.java # Abstract provider contract
45+
├── cli/ # CLI implementation
46+
├── exception/ # Custom exceptions
47+
├── image/ # Image analysis
48+
├── impl/ # ExhortApi implementation, RequestManager
49+
├── logging/ # LoggersFactory
50+
├── providers/ # 18+ ecosystem provider implementations
51+
├── sbom/ # SBOM handling (Sbom, SbomFactory, CycloneDXSbom)
52+
├── tools/ # Utilities (Ecosystem, Operations)
53+
├── utils/ # Environment, IgnorePatternDetector
54+
└── vcs/ # Version control utilities
55+
```
56+
57+
- Test resources: `src/test/resources/tst_manifests/`
58+
- Integration tests: `src/it/` (Maven Invoker Plugin)
59+
60+
## Error Handling
61+
62+
- Runtime exceptions preferred over checked (e.g., `PackageNotInstalledException extends RuntimeException`)
63+
- `CompletableFuture` for async operations with completion exception handling
64+
- `IOException` allowed for file operations (checked exception)
65+
- Environment validation at initialization time
66+
- Logging via `LoggersFactory.getLogger()` (Java Logging API)
67+
68+
## Testing Conventions
69+
70+
- **Frameworks**: JUnit Jupiter 5, Mockito 5.17.0, AssertJ 3.27.3
71+
- **Extensions**: JUnit Pioneer (`@SetSystemProperty`, `@ClearSystemProperty`)
72+
- **Assertions**: AssertJ fluent API (`assertThat()`, `assertThatRuntimeException()`)
73+
- **Mocking**: Mockito (`@Mock`, `@InjectMocks`, `mockStatic()`, BDDMockito)
74+
- **Test structure**: `@Nested` classes, `@ParameterizedTest @MethodSource`
75+
- **Test naming**: Snake_case classes, descriptive methods (`when_running_process_for_existing_command_should_not_throw_exception`)
76+
- **Test runner**: junit-platform-maven-plugin
77+
78+
## Commit Messages
79+
80+
- Follow Conventional Commits: `type(scope): description`
81+
- DCO sign-off required
82+
- Pull request titles must follow Conventional Commits format
83+
84+
## Test Fixtures
85+
86+
- **Dependabot suppression**: Test fixture directories contain intentionally pinned (sometimes vulnerable) dependencies. When adding a new test fixture directory with a manifest file, review `.github/dependabot.yml` to ensure the new path is covered. Non-maven ecosystems are suppressed via root-level `ignore: [{dependency-name: "*"}]` entries. Maven fixtures use per-directory entries with `/**` globs since maven is the production ecosystem; add the parent directory if a new maven fixture tree is introduced.
87+
88+
## Test Fixtures
89+
90+
- **Dependabot suppression**: Test fixture directories contain intentionally pinned (sometimes vulnerable) dependencies. When adding a new test fixture directory with a manifest file, review `.github/dependabot.yml` to ensure the new path is covered. Non-maven ecosystems are suppressed via root-level `ignore: [{dependency-name: "*"}]` entries. Maven fixtures use explicit per-directory entries since maven is the production ecosystem; add the directory path if a new maven fixture is introduced.
91+
92+
## Dependencies
93+
94+
- All versions in `<properties>` section: `{artifact-name}.version` pattern
95+
- Compile scope: Jackson, Jakarta, CycloneDX, TOML parsers
96+
- Test scope: JUnit, Mockito, AssertJ, JUnit Pioneer
97+
- Maven Shade Plugin for CLI JAR with all dependencies
98+
- Distribution to Maven Central (flatten plugin, OSSRH mode)
99+
- GitHub Maven repository for `trustify-da-api-model`
100+
- Enforcer plugin: dependency convergence, no circular dependencies

0 commit comments

Comments
 (0)