mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
55 lines
3.2 KiB
Markdown
55 lines
3.2 KiB
Markdown
# Code Review Checklist: Package Extractor
|
|
|
|
## 🔍 Code Structure & Organization
|
|
- [ ] Are the responsibilities clearly separated between configuration and extraction logic?
|
|
- [ ] Could the extractor struct be made more testable by extracting interfaces?
|
|
- [ ] Is the naming consistent throughout the file (e.g., `ExtractorConfig` vs `extractor`)?
|
|
- [ ] Should the global variables (`NpmExtractors`, `PyPiExtractors`) be constants or part of a configuration?
|
|
|
|
## 🛡️ Error Handling & Robustness
|
|
- [ ] What happens if `e.Config.context` is nil? Should there be validation?
|
|
- [ ] Are all potential error cases from the OSV-Scalibr library handled appropriately?
|
|
- [ ] Could the error message in `ExtractManifestFiles()` be more descriptive?
|
|
- [ ] What if `scanResult.Inventory.Packages` is nil or empty?
|
|
|
|
## 📊 Data Validation & Edge Cases
|
|
- [ ] Should `ExtractorConfig` validate that `ExtractorsName` and `ExtractorType` are compatible?
|
|
- [ ] What happens if `ScanDir` doesn't exist or isn't readable?
|
|
- [ ] Are there any assumptions about package name/version formats that could break?
|
|
- [ ] Should there be limits on the number of packages processed?
|
|
|
|
## 🚀 Performance & Resource Management
|
|
- [ ] Is the scanner being reused efficiently, or should it be cached/pooled?
|
|
- [ ] Could memory usage be optimized when processing large package lists?
|
|
- [ ] Are there any potential goroutine leaks in the scanning process?
|
|
- [ ] Should there be timeout handling for long-running scans?
|
|
|
|
## 🧪 Testing & Maintainability
|
|
- [ ] How would you unit test the `ExtractManifestFiles()` method?
|
|
- [ ] Are the dependencies (OSV-Scalibr) easily mockable for testing?
|
|
- [ ] Could the configuration creation be simplified or made more fluent?
|
|
- [ ] Is the code following Go conventions for package structure?
|
|
|
|
## 🔧 API Design Questions
|
|
- [ ] Should `DefaultExtractorConfig()` return a pointer or a value?
|
|
- [ ] Is the `NewExtractor` constructor providing enough validation?
|
|
- [ ] Could the extractor support multiple ecosystems in a single scan?
|
|
- [ ] Should there be a way to filter or transform packages during extraction?
|
|
|
|
## 💭 Think About These Scenarios
|
|
- [ ] What if a manifest file is corrupted or has unexpected format?
|
|
- [ ] How would this code behave with very large codebases (1000+ dependencies)?
|
|
- [ ] What happens if the scan is interrupted or cancelled via context?
|
|
- [ ] Should there be logging or progress reporting for long scans?
|
|
|
|
## 🎯 Next Steps to Explore
|
|
1. **Research Question**: Look up Go best practices for factory patterns - is `NewExtractor` following them?
|
|
2. **Deep Dive**: Investigate the OSV-Scalibr documentation - what other configuration options might be useful?
|
|
3. **Design Pattern**: Consider the Single Responsibility Principle - is this struct doing too much?
|
|
4. **Error Handling**: Research Go error wrapping patterns - could `fmt.Errorf` be improved?
|
|
|
|
## 🤔 Questions for Self-Reflection
|
|
- How would you explain what this code does to someone unfamiliar with package management?
|
|
- If you had to add support for a new package manager, how much code would you need to change?
|
|
- What's the most fragile part of this implementation, and why?
|
|
- How confident would you feel deploying this code to production? |