Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow rules for indirect / transitive dependencies #68

Open
AlekSi opened this issue Oct 6, 2023 · 3 comments
Open

Allow rules for indirect / transitive dependencies #68

AlekSi opened this issue Oct 6, 2023 · 3 comments
Labels
enhancement New feature or request help wanted Extra attention is needed

Comments

@AlekSi
Copy link
Contributor

AlekSi commented Oct 6, 2023

It would be nice to have a way to allow/deny indirect/transitive imports.

For example, let's say a have a package a imported by package b. Then I have package c that imports package b. And I have a rule that denies c to import a. Currently, the linter passes. I think there should be an option to fail in that case.

@dixonwille
Copy link
Member

I am not sure on the best way to do that for this linter without significantly slowing this down. It looks at source files and reads the import statements from the AST. Though https://github.com/ryancurrah/gomodguard states it only works on direct dependencies as well. But given the go.sum file, it may be a better feature over there?

Open to suggestions though.

@dixonwille
Copy link
Member

Of course that is only at the module level.

@AlekSi
Copy link
Contributor Author

AlekSi commented Oct 9, 2023

One (maybe stupid) option is to run go list -json ./... and parse the output, including Deps field. It also may be done only if at least one rule opted-in for the transitive check.

Another option is to use https://pkg.go.dev/golang.org/x/tools/go/packages

@dixonwille dixonwille added enhancement New feature or request help wanted Extra attention is needed labels Oct 31, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request help wanted Extra attention is needed
Projects
None yet
Development

No branches or pull requests

2 participants