[SCI] add GetArtifact to ComposerLockExtractor for build file analysis#185
Conversation
…alysis - Implement GetArtifact() on ComposerLockExtractor to satisfy ArtifactExtractor interface - Read co-located composer.json to extract the project name field - Return artifact with empty name when composer.json is missing or has no name field - Add compile-time interface check for ArtifactExtractor - Add 3 tests: happy path, missing composer.json, missing name field Rationale: PHP Composer projects need build file analysis support so that datadog-sbom-generator can identify project artifacts from composer.lock files. This follows the same pattern established by the Go extractor (PR #179), reading the manifest file (composer.json) to extract the project identity. This commit made by [/dd:git:commit:atomic](https://github.com/DataDog/claude-marketplace/tree/main/dd/commands/git/commit/atomic.md)
- Add FileTypeComposerJSON to SimpleProcessor init() registration - Enables BFS-based transitive dependency resolution for composer.json build files Rationale: With ComposerLockExtractor now implementing ArtifactExtractor, composer.json files appear as file-type SBOM components. Registering a SimpleProcessor allows GetBuildFileTrees to resolve their relationships using the same BFS pattern used by Go, Python, Maven, and other ecosystems. This commit made by [/dd:git:commit:atomic](https://github.com/DataDog/claude-marketplace/tree/main/dd/commands/git/commit/atomic.md)
|
🎯 Code Coverage (details) 🔗 Commit SHA: 2f29298 | Docs | Datadog PR Page | Give us feedback! |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6c8121d7a8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| func (e ComposerLockExtractor) GetArtifact(f extractor.DepFile, ctx extractor.ScanContext) (*models.ScannedArtifact, error) { | ||
| artifact := &models.ScannedArtifact{ | ||
| ArtifactDetail: models.ArtifactDetail{ | ||
| Filename: f.Path(), |
There was a problem hiding this comment.
When composer.json exists, this still records the artifact under composer.lock. addFileDependencies keys file components and dependency edges by artifact.Filename, while GetBuildFileTrees groups Composer build files by the composer.json basename and Composer package occurrences point at composer.json after matching. In those scans the new artifact ID/property and any internal Composer dependency edges are attached to composer.lock, so the registered Composer processor cannot populate the intended composer.json build-file tree; set Filename to the resolved composerJSONPath once that file is found.
Useful? React with 👍 / 👎.
Extract optional composer.json reading into a helper function that returns a string instead of an error, avoiding the nilerr lint violation where a non-nil error was checked but nil was returned. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Set Filename to the composer.json path (not composer.lock) so the build file tree system correctly groups Composer components by the manifest. Return nil when composer.json is absent — no artifact to report.
|
Fixed (2f29298). Set |
anderruiz
changed the title
2 participants
Summary
Adds PHP Composer build file analysis support, following the same pattern established in #179 for Go modules.
GetArtifact()onComposerLockExtractor, readingcomposer.jsonfrom the same directory to extract the project name ("name"field)SimpleProcessorforFileTypeComposerJSONso PHP projects appear in build file treesTest plan
composer.lock+composer.jsonwithnamefield → correctScannedArtifactreturnedcomposer.json→ nil artifact returned gracefullycomposer.jsonpresent but nonamefield → nil artifact returned gracefullygo test ./...) — 30+ packages, zero regressions🤖 Generated with Claude Code