dennisdoomen / packageguard / 35223164688

82%

main: 82%

push

github

Add a packageguard explain command showing dependency paths and verdict rationale (#256)

* Track which rule and configuration file decided each package's allow/deny verdict

Allow/deny checks only ever returned a bare true/false, so nothing in the
codebase could say which specific rule made that decision, or which of
several hierarchical configuration files introduced it. That information is
needed to explain a policy verdict to a user instead of just stating it.

Give the allow and deny lists an evaluation path that returns the matched
rule's reason text alongside the same pass/fail outcome the existing
boolean checks already produce, and have those checks delegate to it so
behavior is unchanged. Package rules now carry the configuration file they
were parsed from, and license/feed rules are looked up in a per-value map
populated the same way, so the reason can also name the file it came from
when the rule was loaded from a discovered configuration file, keeping the
first file that introduced a given license or feed value in the event of
duplicates across layers. Building that per-rule provenance requires
merging each configuration file's rules into the effective policy one file
at a time, rather than collapsing all raw settings together before
converting them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Resolve NuGet dependency chains from the restored lock file

Nothing captured which direct dependencies pull a given transitive package
into a project, or what version range each requester along the way asked
for. That's the one piece of data most needed when a violation lands on a
package nobody directly referenced, and the restored lock file already
contains it.

Walk the lock file's project-to-package graph, breadth-first, from each
direct dependency down to a target package, keeping the version range
requested at each hop so the resolved version can be explained alongside
the path. A multi-targeted project repeats the same direct... (continued)

2128 of 2888 branches covered (73.68%)

Branch coverage included in aggregate %.

323 of 527 new or added lines in 15 files covered. (61.29%)

6730 of 7958 relevant lines covered (84.57%)

1734.69 hits per line