mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
* feat(uvx): add uvx (uv tool run) package executor Adds support for `uvx`, implemented as a PyPI Executor alongside pipx. uvx is an alias for `uv tool run`: it installs a tool into an ephemeral environment and runs it, so it has no install/list subcommand and the first positional argument (or --from) is the package to audit. Parsing highlights: - --from overrides the positional command as the package to audit - --with packages are audited as additional environment dependencies - name@version shorthand (ruff@0.3.0, ruff@latest) is normalized - flag parsing stops at the tool name so the tool's own flags are not misread as uvx options; uvx's value/boolean flags are registered so none greedily consume the package positional - VCS/URL/local-path specs are skipped for registry auditing Wires up command registration, analytics, shell alias/shim, cloud audit mapping, a dedicated `uvx` sandbox profile (UV_*/PIP_* env, uv cache and tool dirs), config policy, docs, unit tests and an E2E workflow step. Closes #326 https://claude.ai/code/session_011hyLxq7oWJX5Dp4tCEfG19 * chore(uvx): align docs and base profile with uvx support Incorporates the low-risk, non-parser improvements from the community PR #345 (author non-responsive) into our implementation: - list uvx (and the previously-missing pipx) as PyPI managers in the pypi-restrictive base profile package_managers and its README, so the base profile applies directly when selected via --sandbox-profile - document uvx in docs/github-action.md and docs/proxy-mode.md - add version / IsExplicitVersion assertions to the uvx parser tests Our pflag-based parser is kept as-is: unlike #345 it audits --with packages and handles all uvx short flags (e.g. -w), both of which the community PR misses. * fix(uvx): skip interpreter requests; use require in tests Addresses review feedback on PR #357: - uvx interpreter requests (`uvx python`, `uvx python@3.12`, `uvx pypy`, ...) launch an isolated interpreter rather than installing a PyPI tool. Treating the positional as a package made the guard flow resolve/analyze pkg:pypi/python (and python==3.12), which could wrongly block or fail a valid invocation. Skip these for the positional; --with packages on the same command are still audited. - Use require.NoError / require.Len for fatal assertions in the uvx tests, matching the repo's testing convention, so a failure stops the subtest before a nil dereference instead of panicking. * docs(uvx): document fail-open and --with-requirements trade-offs Record the two deliberate parsing decisions raised in review as in-code trade-off comments (no behavior change): - unknown flags are tolerated (fail open), consistent with the other executors; the residual gap only affects non-proxy guard mode since the default proxy flow intercepts every registry download. - --with-requirements / --with-editable values are consumed but not expanded into audit targets; expanding them needs manifest-extractor and guard changes, tracked as follow-up. Proxy mode still covers them. * docs(uvx): drop --with-requirements limitation note Per maintainer review: guard mode is being deprecated and auditing the contents of an existing requirements file is a scanner's responsibility, not PMG's. Remove the "known limitation / follow-up" note; the flags stay registered only so their values are not mistaken for the tool positional. --------- Co-authored-by: Claude <noreply@anthropic.com>
62 lines
1.9 KiB
Go
62 lines
1.9 KiB
Go
package executors
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/safedep/pmg/config"
|
|
"github.com/safedep/pmg/internal/analytics"
|
|
"github.com/safedep/pmg/internal/flows"
|
|
"github.com/safedep/pmg/internal/ui"
|
|
"github.com/safedep/pmg/packagemanager"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
func NewUvxCommand() *cobra.Command {
|
|
return &cobra.Command{
|
|
Use: "uvx [package] [args]",
|
|
Short: "Guard uvx package executor",
|
|
DisableFlagParsing: true,
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
err := executeUvxFlow(cmd.Context(), args)
|
|
if err != nil {
|
|
ui.ExitFromCommandError(err)
|
|
}
|
|
|
|
return nil
|
|
},
|
|
}
|
|
}
|
|
|
|
func executeUvxFlow(ctx context.Context, args []string) error {
|
|
analytics.TrackCommandUvx()
|
|
|
|
packageExecutor, err := packagemanager.NewPypiPackageExecutor(packagemanager.DefaultUvxPackageExecutorConfig())
|
|
if err != nil {
|
|
return fmt.Errorf("failed to create uvx package executor proxy: %w", err)
|
|
}
|
|
|
|
config := config.Get()
|
|
parsedCommand, err := packageExecutor.ParseCommand(args)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to parse command: %w", err)
|
|
}
|
|
|
|
packageResolverConfig := packagemanager.NewDefaultPypiDependencyResolverConfig()
|
|
packageResolverConfig.IncludeTransitiveDependencies = config.Config.Transitive
|
|
packageResolverConfig.TransitiveDepth = config.Config.TransitiveDepth
|
|
packageResolverConfig.IncludeDevDependencies = config.Config.IncludeDevDependencies
|
|
packageResolverConfig.PackageInstallTargets = parsedCommand.InstallTargets
|
|
|
|
packageResolver, err := packagemanager.NewPypiDependencyResolver(packageResolverConfig)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to create dependency resolver: %w", err)
|
|
}
|
|
|
|
if !config.IsProxyModeEnabled() {
|
|
return flows.Common(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)
|
|
}
|
|
|
|
return flows.ProxyFlow(packageExecutor, packageResolver).Run(ctx, args, parsedCommand)
|
|
}
|