Skip to content

Conversation

@cognitivegears
Copy link

This combined pull request includes several significant changes to the project, focusing on enhancing logging, improving argument parsing, and updating package analysis heuristics. This also implements additional defensive coding and a few bug fixes. The most important changes are summarized below:

Logging and Configuration Improvements:

  • Added logging functionality to Combobulator, along with command line arguments for a log file and logging level. This also supports the silent mode (called quiet mode) from Issue add --silent option to cli #12

Fix syntax errors and defensive coding:

  • Added defensive coding to address PR failed when try launch scan  #21
  • Fix multiline string formatting in combobulator.py
  • Better error handling in returns from API calls
  • Added pydoc and general code formatting enhancements
  • Fixed failure to add devDependencies on NPM package
  • Safety checks on dict usage from API results to gracefully handle unexpected API responses
  • Added short sleep on API calls to avoid throttling. Note, this can in some cases slow down execution a bit, but is "nicer" on the public APIs

Added source scanning for PyPi:

Package upgrades:

  • Upgraded commons-io:commons-io
  • Upgraded requests - multiple high priority vulnerabilities remediated

Added new functionality:

  • Added JSON output option to resolve Add JSON for output options #6
  • Added new exit codes and an option to exit with an error code when heuristic warnings present, to better enable integration with CI/CD
  • Added recursive scan option to scan sub-packages within a repository
  • Added new fields onto CSV (and JSON) for boolean condition checks on heuristic failures to avoid need to parse program output to determine failures

Argument Parsing and decoupling Enhancements:

  • Refactored argument parsing into a new src/args.py file, introducing new arguments for logging configuration, recursive scanning, and error handling.
  • Updated README.md to reflect the new argument options and supported package types.
  • Created new constants.py to avoid hardcoded and duplicate strings

Package Analysis Enhancements:

  • Improved heuristics in src/analysis/heuristics.py by adding detailed docstrings, refactoring function names for clarity, and incorporating additional risk checks.

Configuration Updates:

  • Updated .pylintrc to include an init-hook for setting the Python path. This allows for running PyLint against the project.
  • Added Python-specific settings to .vscode/settings.json for better development environment configuration.

And more:

  • See diff for full change set

dependabot bot and others added 30 commits November 19, 2024 20:04
Bumps commons-io:commons-io from 2.10.0 to 2.14.0.

---
updated-dependencies:
- dependency-name: commons-io:commons-io
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [requests](https://github.com/psf/requests) from 2.12.1 to 2.32.2.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.12.1...v2.32.2)

---
updated-dependencies:
- dependency-name: requests
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
…ons-io-commons-io-2.14.0

Bump commons-io:commons-io from 2.10.0 to 2.14.0 in /tests
- Add .pylintrc for pylint configuration
- Update gql package version in requirements.txt
- Add .vscode/settings.json for Python path configuration
- Fix typo in public_checkers.py
- Enhance constants with documentation and improve formatting
- Refactor npm, pypi, and maven registry scanning functions for clarity
- Improve logging and error handling in registry modules
- Update heuristics tests for consistency and clarity
…ded more defensive coding checks for unexpected responses
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add JSON for output options

1 participant