capnspacehook / dep-inspector

Tool to check Go dependencies for unwanted behavior or correctness issues

dep-inspector

dep-inspector's Issues

Option to detect changes to go.mod from last git commit

Preform analysis on all added/updated deps that from the last commit by parsing go.mod before and after.

This should be added as a -commit flag which will take the commit to compare against, defaulting to the previous commit.

Print embed data

• size diff of embedded files
• use https://pkg.go.dev/github.com/h2non/filetype#Match to determine type of file
• only need first 262 bytes of file

Ability to merge user specified golangci-lint config with default

`gopkg.in` isn't resolved correctly

The vcs package is unsupported, probably need to linkname the code Go uses

Undo changes to go.mod and go.sum

Before making changes copy both files to temporary files and then restore them after analysis is complete.

Integrate capslock

Not the best word, but basically add ability to watch packages or functions and when callsites are changed or added dep-inspector will notify you of them to review.

Support comparing multiple dependencies at once

Required to support detecting differences in go.mod between commits. HTML output will need to be updated to handle this.

Also should add flag -u to use go get -u instead of go get

Create Github Action to post dependency analysis as PR comments

Should use core dep-inspector code but as a separate binary. Should be triggered on pushes to a PR. The HTML output should be uploaded to Github Pages and the link along with a summary of the total capability and issue deltas of all changed deps should be posted in a comment on the PR. A hash of the HTML output should be added as a HTML comment in the PR comment. If the action is triggered again in a PR after it has already been ran it will only update the existing comment if the HTML output differs by comparing hashes.

Staticcheck improvements

• Copy dep dir and rewrite //nolint:staticcheck comments to //lint:ignore https://staticcheck.io/docs/configuration/#ignoring-problems
• Create config file and let users specify staticcheck checks to ignore per dep

Run tests of deps with the race detector enabled

Assuming deps can pass their own tests with or without the race detector enabled is not a given.