External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
66 Commits 45 Branches 66 Tags
c47cb30de0565d988a9393ee5b6fcab4fce49d3e
Commit Graph
66 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sahil BansalandGitHub c47cb30de0 Add pmg E2E Tests (#73) 
* add pmg e2e tests

* pin sha version

* pin python sha version

* add pmg to path

* fix pnpm init

* fix pnpm init

* rm poerty verification

* fix poetry verification

* comment poetry verification

* fix poetry error

* add poetry verification back

* fix poetry error

* add yarn e2e

* fix yarn installation

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
 2025-12-01 12:13:24 +05:30
Sahil BansalandGitHub 34750d71d3 update report url (#74) 2025-11-11 21:19:53 +05:30
Shrvan SudhakaraandGitHub 03bd697ae0 Add support for yarn package manager (#72) 
* Add support for yarn package manager

- Added yarn command handler in cmd/npm/yarn.go
- Added DefaultYarnPackageManagerConfig() in packagemanager/npm.go
- Added yarn dev flag support (--dev/-D) in ParseCommand()
- Added yarn analytics tracking in internal/analytics/event.go
- Registered yarn command in main.go
- Added yarn to alias setup in internal/alias/alias.go
- Added comprehensive test suite in packagemanager/yarn_test.go
- All tests passing (12 yarn tests + existing tests)

Resolves #30

Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com>

* docs: update README with yarn package manager support

Updated documentation to reflect yarn support addition:
- Changed yarn status from '🚧 Planned' to '✅ Active' in package managers table
- Added 'pmg yarn add <package>' command example
- Added 'yarn add <package-name>' to command list
- Added 'yarn install # Uses yarn.lock' to lockfile examples

This documentation update corresponds to the yarn implementation in the previous commit.

Related to #30

Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com>

* fix: address review feedback for yarn support

- Add support for bare 'yarn' command as manifest install
- Validate yarn install does not accept package names
- Add YarnExtractor for yarn.lock file support

Changes:
- packagemanager/npm.go: Added bare yarn command handling and validation
- packagemanager/yarn_test.go: Added test for bare yarn command
- extractor/ecosystems.go: Added Yarn PackageManagerName and extractor
- extractor/npm.go: Added YarnExtractor implementation
- go.mod, go.sum: Updated dependencies

Addresses review feedback from @Sahilb315
- Bare yarn command now triggers manifest install per docs
- yarn install <package> is now properly rejected
- yarn.lock extraction support added

Related to #30

Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com>

* chore: tidy go.mod and go.sum to remove unused dependencies

Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com>

* fix: add yarn.lock extractor mapping

- Add yarn.lock case in getExtractorForFile switch
- Import yarnlock extractor from osv-scalibr
- Enables lockfile parsing for manifest-based installations

Tested both package-based and manifest-based installations successfully.

Addresses review feedback from @Sahilb315

Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com>

* test: add validation test for yarn install with package name

- Add test case to verify 'yarn install <package>' is rejected
- Ensures invalid syntax returns no install targets
- Confirms IsManifestInstall is false for invalid commands

Addresses review feedback from @Sahilb315

Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com>

---------

Signed-off-by: shrvansudhakara <shrvansudhakara@gmail.com>
 2025-11-05 13:49:19 +05:30
Sahil BansalandGitHub 12aaba8a05 add poetry command (#67) 
* add poetry command

* add poetry.lock extractor & define cmd parser for poetry

* feat: support Poetry caret/tilde version syntax

* add wildcard constraint support & test cases

* readme update

* chore: small fixes
v0.1.0 		2025-08-29 00:21:09 +05:30
Sahil BansalandGitHub 78bc6afa67 fix command parsing for unknown flags (#70) 
* fix command parsing for unknown flags

* fix test case

* add dev flag support for npm cmds
 2025-08-28 21:17:59 +05:30
Sahil BansalandGitHub 099dc45958 update docs (#71) 2025-08-28 20:53:24 +05:30
Kunal SinghandGitHub cd8fb52c47 feat: new pmg banner (#68) 
* feat: new pmg banner

* commit lenght check
v0.0.10 		2025-08-21 23:01:30 +05:30
Abhisek DattaandGitHub 2493fb4dc6 chore: Better user friendly error messages (#64) 2025-08-21 18:26:05 +05:30
Sahil BansalandGitHub cd306884e3 add trufflehog secret scan CI (#63) 2025-08-13 15:49:12 +05:30
Sahil BansalandGitHub fd7d83704f feat/#28 uv support (#62) 
* follow proper consistent naming in pypi packagemanager

* follow proper consistent naming in pypi packagemanager - 2

* feat: add specialized command parsers to handle pip and uv command formats

* add uv support & modify extractor to be more robust

* add uv alias

* refactor var name & add error handling

* update readme & add support for `uv pip sync` cmd
v0.0.9 		2025-08-06 21:10:51 +05:30
Sahil BansalandGitHub 2cbb24b3b1 docs/improve readme and alias text (#60) 
* fix readme TOC links

* add note for removing aliases

* give a clear msg for removing aliases
 2025-07-30 16:42:02 +05:30
Sahil BansalandGitHub 6d39fc0dde fix publish npm test installations (#59) 2025-07-29 21:54:58 +05:30
Sahil BansalandGitHub a1b1c3a0c2 add bun alias in setup cmd (#58) v0.0.8 2025-07-29 18:38:34 +05:30
Sahil BansalandGitHub e184e914a3 fix: improve error wrapping & preserving the error (#57) 2025-07-28 18:03:29 +05:30
Sahil BansalandGitHub c486834c2e feat/#55 bun support (#56) 
* add support for bun package manager

* update readme
 2025-07-28 17:23:32 +05:30
Sahil BansalandGitHub 49b2371cc3 fix: invalid cross-device link (#54) 
* fix: invalid cross-device link

* version flag fix in workflow

* remove version from package.json
v0.0.7 		2025-07-04 20:56:31 +05:30
Sahil BansalGitHubCopilotOmkar Phansopkar
 		74248cd74a Publish pmg to npm (#50) 
* feat: pmg publish to npm

* feat: add github action for publishing to npm

* Update publish/npm/install.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update .github/workflows/publish-npm.yml

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* refactor: define constants

* refactor: improve npm package reliability with removing dynamic handlers and better error handling and validation

* fix: publish-npm workflow

* Update publish/npm/test.js

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* refactor(npm-workflow): use a more portable loop construct

* refactor: remove version field from package.json

* feat: use os.tmpdir() with mkdtempSync for cleaner temp directory handling

* fix: add redirect limit and cleanup to prevent infinite redirects and resource leaks

* remove test.js for npm publisher pack

* chore: test cmd cleanup

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
v0.0.6 		2025-07-04 12:42:37 +05:30
Sahil BansalandGitHub ca752edf79 feat: add suppport for bypassing the blocking behavior of malicious packages (#53) 
* feat: add suppport for bypassing the blocking behavior of malicious packages

* feat: add InsecureInstallation config to bypass malware scanning with tests

* ui: introduce ShowWarning interaction method

* guard test fix
 2025-07-02 19:09:27 +05:30
Sahil BansalGitHubCopilot
 		0e17378d3e feat: add posthog analytics support (#52) 
* feat: add posthog analytics events

* Update internal/analytics/analytics.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-06-30 09:47:14 +05:30
Sahil BansalandGitHub 0a62473e9a Docs/add instructions for setup cmds (#45) 
* docs: add instructions for installing & removing aliases

* refactor: fix cmd name

* add diff sections for usage

* add section in index
 2025-06-24 18:17:06 +05:30
Sahil BansalandGitHub d363167981 feat: add setup & remove cmd for better UX (#43) 
* feat: add setup & remove cmd for better UX

* refactor(alias): improve separation of concerns and fix shell sourcing

* chore: remove extra/unused folder

* refactor: introduce separate files for shells

* fix: use temp files for safe shell config modification
v0.0.5 		2025-06-24 12:46:21 +05:30
Sahil BansalandGitHub 3f85282935 fix: pip args & manifest files handling (#41) 
* fix: pip args & manifest files handling

* chore: add pflag dependency

* chore: word fixes

* fix: multiple refs for suspicious packages

* refactor: introduce block config

* fix: makefile for windows build

* test: add test cases for manifest based installation

* refactor: Makefile

* refactor: remove .exe for windows build
 2025-06-24 12:44:12 +05:30
Sahil BansalandGitHub b64f158654 fix: resolve dependencies for manifest file scans (#40) 
* fix: resolve dependencies for manifest file scans

* fix: resolve dependencies for manifest file scans

* fix: resolve dependencies for manifest file scans - 2

* revert back to traditional for loop

* fix(manifest-scan): resolve deps only for requirements.txt
 2025-06-16 15:18:45 +05:30
Sahil BansalandGitHub 8f8ca7fd5c docs: update limitation for pypi registry scanning only (#39) 2025-06-12 21:08:41 +05:30
Sahil BansalGitHubCopilot
 		5e9f2af972 Support for scanning manifest files (#36) 
* feat: add extractor logic for manifest files

* feat: add manifest-based package installation detection

* feat: add osv-scanner for extracting lockfiles

* refactor: add comment for cmd parse

* refactor: add Ecosystem() method to PackageManager interface

* refactor: implement package-manager-specific extractors & replace osv-scanner with scalibr

* Update extractor/extractor.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-06-12 18:58:58 +05:30
Sahil BansalandGitHub 302e17fe48 docs: Update supported package managers for pip (#37) 
* docs: update supported package managers for pip

* Update README.md

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
 2025-06-10 18:46:32 +05:30
Sahil BansalGitHubOmkar Phansopkar
 		53783c6604 feat: Add support for pip Package Manager (#33) 
* feat/init-pip-cmd

* feat: Add PyPi resolver

* test: Add tests for pypi and pypi_resolver

* refactor: unify package dependency resolution and improve PyPI version handling using registry adapter

* chore: remove unused file

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* feat: add Python dependency parsing with extras support

* refactor(deps): Improve PyPI dependency resolution and add custom resolver support

* chore: remove extra file

* fix: improve dependency resolution and package deduplication

* chore: remove extra print statement

* chore: typo fix

* feat: support PyPi package extras

* test: add test for pypi dependency parse function

* fix: remove overwritten of parsedCmd

* chore: remove extra print statement

* chore: typo fix

* feat: support PyPi package extras

* test: add test for pypi dependency parse function

* fix: remove overwritten of parsedCmd

* refactor: enhance code readability & remove extra code

* chore: remove extra code

* Update cmd/npm/npm.go

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update cmd/npm/pnpm.go

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update cmd/pypi/pip.go

Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Omkar Phansopkar <omkarphansopkar@gmail.com>
 2025-06-09 17:37:08 +05:30
Abhisek DattaGitHubSahil Bansal
 		4031219375 fix: Show error messages on fatal failures #32 (#34) 
* fix: Show error messages on fatal failures #32

* test: Add E2E test

* test: fix E2E scripts

* test: fix E2E scripts

* fix: Race condition in concurrent analyzer

* fix: update formatting to ensure docs URL is clickable

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* fix: E2E test

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
v0.0.4 		2025-05-17 21:54:47 +05:30
Abhisek DattaandGitHub b85f77cfbc feat: Add support for active scanning in paranoid mode (#31) 
* feat: Add support for active scanning in paranoid mode

* docs: Fix README
 2025-05-16 19:38:06 +05:30
Hanshal MehtaandGitHub 81d4875b8d feat: add version command (#26) v0.0.3 2025-05-16 09:41:48 +05:30
Kunal SinghandGitHub d8d7bda8ca docs: add brew installation setup in readme (#25) 
* docs: add brew installation setup in readme

Signed-off-by: Kunal Singh <kunalsin9h@gmail.com>

* updated TOC

Signed-off-by: Kunal Singh <kunalsin9h@gmail.com>

* removed also for 1st install option

Signed-off-by: Kunal Singh <kunalsin9h@gmail.com>

---------

Signed-off-by: Kunal Singh <kunalsin9h@gmail.com>
 2025-05-15 22:24:02 +05:30
Abhisek DattaandGitHub 7c9681ef00 Multiple Misc Updates (#23) 
* docs: Update README

* docs: Add badges
 2025-05-15 21:34:41 +05:30
Sudhanshu DasguptaandGitHub 6c7e3b875a Add new intro image (#24) 
* add new into image

Signed-off-by: Sudhanshu Dasgupta <dasguptashivam23@gmail.com>

* replace image

Signed-off-by: Sudhanshu Dasgupta <dasguptashivam23@gmail.com>

---------

Signed-off-by: Sudhanshu Dasgupta <dasguptashivam23@gmail.com>
 2025-05-15 20:16:03 +05:30
Abhisek DattaandGitHub 5022d64ce4 chore: Improve UX (#22) v0.0.2 2025-05-15 18:03:46 +05:30
Abhisek DattaandGitHub cfde1d7632 ci: Add CodeQL and OpenSSF Scorecard action (#21) v0.0.1 2025-05-15 16:59:13 +05:30
Abhisek DattaandGitHub e86b6ef056 feat: Refactor PMG to Maintain Separation of Concerns and Clean Architecture (#19) 
* feat: Add separate package manager and resolver

* fix: Npm dependency resolver

* feat: Add analyzer for malysis query

* feat: Add package manager guard as the orchestrator

* feat: Add PMG to orchestrate installation

* Add concurrent scan execution

* Introduce package manager interaction abstraction

* feat: Add UI port for guard

* Remove refactored source files

* Update README

* fix: CI script for multi-arch build

* ci: goreleaser CI fix

* fix: npm command parser to extract package names

* feat: Introduce global config primitive

* fix: Close results channel for clean goroutine exit

* ci: Add container image releaser

* test: Improve test for npm resolver

* refactor: Analyzer to generalise

* Improve UI with additional info

* fix: Goreleaser config

* fix: npm resolver bug

* fix: Fail when command exec workflow fails

* fix: Bug with transitive dependency resolution

* fix: Synchronize common data update in dependency resolver

* chore: Improve log handling

* docs: Update README

* fix: UI text wrapping

* fix: UI handling bugs

* feat: Use concurrent dependency resolver
 2025-05-15 16:50:59 +05:30
Sahil BansalGitHubCopilot
 		8b46964c7a fix(npm): handle multiple packages and flag parsing correctly (#17) 
* fix(npm): handle multiple packages and flag parsing correctly

- Fixes issue where only the first package was scanned; now all packages in install command are parsed and processed.
- Correctly separates flags (e.g., --save-dev) from package names to avoid treating them as packages.
- Applies same fixes to both npm and pnpm flows.
- Updated wrapper to scan all packages before installing, maintaining original CLI behavior.

* refactor: fixed the registry type

* feat: continue installing other packages if one is denied

* Update pkg/wrapper/npm_base.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* fix(wrapper): exit gracefully for user-rejected packages

* fix: remove env validation

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-05-12 09:23:08 +05:30
Sahil BansalandGitHub f7855e99a2 docs: add CONTRIBUTORS and MAINTAINERS files, update README (#18) 
* docs: README update

* docs: introduce CONTRIBUTING.md

* docs: introduce MAINTAINERS.txt
 2025-05-11 22:42:27 +05:30
Sahil BansalandGitHub 86f8bd42b7 replace AnalysePackage with QueryPackageAnalysis API & use community API (#15) 2025-05-11 22:41:34 +05:30
Sahil BansalGitHubCopilot
 		6a28fb16a1 refactor: improve progress bar logic and update display (#14) 
* fix: Revise progress tracking mechanism

* chore: remove unused getDependencies func

* chore: removed unused property & add fetcher check

* Update pkg/wrapper/npm_base.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* refactor: make SetProgressTracker common for all fetchers

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-05-06 16:35:59 +05:30
Sahil BansalGitHubCopilot
 		df754ccc82 Add colorful outputs & remove md text (#13) 
* fix: parsePackageInfo to handle pkg names with special character

* Enhance pmg outputs by adding colors and removing markdown notions

* Update pkg/wrapper/npm_base.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* Update npm_base.go

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>

* test: add tests for removeMarkdown

* chore: remove duplicate code

* refactor: convert TerminalColors to global var and split markdown utils

---------

Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-05-05 23:32:34 +05:30
Sahil BansalandGitHub 88f39b56ff fix: parsePackageInfo to handle pkg names with special character (#11) 
* fix: parsePackageInfo to handle pkg names with special character

* test: add tests for CleanVersion and ParsePackageInfo util functions
 2025-05-04 18:50:13 +05:30
Sahil BansalandGitHub 5a6b842360 add goreleaser & goreleaser workflow (#8) 2025-05-02 12:37:27 +05:30
Sahil BansalandGitHub 1aa4b06f41 Pnpm suppport (#6) 
* fix: resolves issues #3 and #4

* feat: add pnpm support & introduce pkg manager wrap for npm
 2025-04-30 14:26:38 +05:30
Abhisek DattaandGitHub ec010c7d6b Merge pull request #1 from safedep/feat/npm-support 
project initialisation & added npm cmd support
 2025-04-29 09:06:05 +05:30
Sahilb315 4f13dfbb40 chore: clean unused deps 2025-04-29 01:52:35 +05:30
Sahilb315 d4a31b14c0 ci: add vet ci 2025-04-29 01:41:50 +05:30
Sahilb315 8b31fd458b feat: add progress bar and add debug & silent flags 2025-04-29 01:33:27 +05:30
Sahil BansalGitHubCopilot
 		5ea85fa1f3 Update pkg/common/utils/utils.go 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sahil Bansal <bansalsahil315@gmail.com>
 2025-04-28 20:48:07 +05:30
Sahilb315 6ae594a896 readme installation update 2025-04-28 20:02:20 +05:30