Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SwiftPM: Support remoteSourceControl dependencies which specify the branch (not version) #8167

Closed
fviernau opened this issue Jan 24, 2024 · 4 comments
Closed

SwiftPM: Support remoteSourceControl dependencies which specify the branch (not version) #8167

fviernau opened this issue Jan 24, 2024 · 4 comments
Assignees
@fviernau
Labels
analyzer About the analyzer tool enhancement Issues that are considered to be enhancements

Comments

@fviernau
Copy link
Member

If one analyzes a Package.swift file such as [2], the analyzer result will contain a Package entry
for that dependency with Identifier.version="unspecified".

Ort's SwiftPM integration runs [1] which always does a dependency resolution which involves
figuring out the resolved revision. The execution of [1] either uses an existing lockfile, or creates
a lockfile in case of its absence.

Change the implementation to always use the "resolved revision" from the lockfile.

[1] swift package show-dependencies --format json
[2]

let package = Package(
    ...
    dependencies: [
        .package(url: "git@github.com:my-org/my-project.git", branch: "my-feature"),
    ]
   ...
)
@fviernau fviernau self-assigned this Jan 24, 2024
@fviernau fviernau added enhancement Issues that are considered to be enhancements analyzer About the analyzer tool labels Jan 24, 2024
@fviernau fviernau mentioned this issue Jan 24, 2024
Closed
@sschuberth
Copy link
Member

@fviernau, could you please edit your post and provide the missing link for [2]?

@fviernau
Copy link
Member Author

@fviernau, could you please edit your post and provide the missing link for [2]?

[2] is not a link put the sniplet I copied.

@sschuberth
Copy link
Member

[2] is not a link put the sniplet I copied.

Ah, thanks. It looked like an empty line to me.

@fviernau fviernau mentioned this issue Jan 24, 2024
Merged
@fviernau
Copy link
Member Author

In my view an implementation of this would involve refactoring things quite a bit.
I believe it's best to implementing [1] first could help avoiding the need for another refactoring.

[1] #8194

This was referenced Feb 1, 2024
Merged
Merged
Merged
fviernau added a commit that referenced this issue Feb 7, 2024
@fviernau
feat(SwiftPm): Gracefully handle dependencies specified by branch name
aaa1314 
If a `Package.swift` file  specifies a dependency with a branch name,
such as [1], the result of its analysis based on running [2] yields
"unspecified" as version string for that particular dependency.

A specialty of this package manger, similar to `GoMod` is that creating
the dependency tree via [2] includes resolving the revisions for all
dependencies. From investigating various project setups, it seems that
the lockfile entries for `remoteSourceControl` dependencies (see
property `PinV2.kind`) always have a revision / SHA1. So, for
`remoteSourceControl` (which is the only kind currently handled) the
lockfile entry contains all information needed while the entries from
[2] lack the version / revision.

Fix both, the version strings as well as the `vcsInfo.revision`, by
creating the result from the lockfile entries and only use the entries
from [2] as a fallback.

[1] `.package(url: "git@github.com:my-org/my-project.git", branch: "my-feature")`
[2] `swift package show-dependencies`

Fixes #8167.

Signed-off-by: Frank Viernau <frank_viernau@epam.com>
fviernau added a commit that referenced this issue Feb 7, 2024
@fviernau
feat(swiftpm): Gracefully handle dependencies specified by branch name
bdcd4f6 
If a `Package.swift` file  specifies a dependency with a branch name,
such as [1], the result of its analysis based on running [2] yields
"unspecified" as version string for that particular dependency.

A specialty of this package manger, similar to `GoMod` is that creating
the dependency tree via [2] includes resolving the revisions for all
dependencies. From investigating various project setups, it seems that
the lockfile entries for `remoteSourceControl` dependencies (see
property `PinV2.kind`) always have a revision / SHA1. So, for
`remoteSourceControl` (which is the only kind currently handled) the
lockfile entry contains all information needed while the entries from
[2] lack the version / revision.

Fix both, the version strings as well as the `vcsInfo.revision`, by
creating the result from the lockfile entries and only use the entries
from [2] as a fallback.

Fixes #8167.

[1] `.package(url: "git@github.com:my-org/my-project.git", branch: "my-feature")`
[2] `swift package show-dependencies`

Signed-off-by: Frank Viernau <frank_viernau@epam.com>
fviernau added a commit that referenced this issue Feb 7, 2024
@fviernau
feat(swiftpm): Gracefully handle dependencies specified by branch name
3f17f8d 
If a `Package.swift` file  specifies a dependency with a branch name,
such as [1], the result of its analysis based on running [2] yields
"unspecified" as version string for that particular dependency.

A speciality of this package manger, similar to `GoMod`, is that
creating the dependency tree (via [2]) includes resolving the revisions
for all dependencies. From investigating various project setups, it
seems that the lockfile entries for `remoteSourceControl` dependencies
(see property `PinV2.kind`) always have a revision / SHA1. So, for
`remoteSourceControl`, which is the only kind currently handled, the
lockfile entry contains all information needed while the entries from
[2] lack the version / revision.

Fix both, the version string issues as well as the `vcsInfo.revision`
ones, by creating the result from the lockfile entries and only use the
entries from [2] as a fallback.

Fixes #8167.

[1] `.package(url: "git@github.com:my-org/my-project.git", branch: "my-feature")`
[2] `swift package show-dependencies`

Signed-off-by: Frank Viernau <frank_viernau@epam.com>
fviernau added a commit that referenced this issue Feb 7, 2024
@fviernau
feat(swiftpm): Gracefully handle dependencies specified by branch name
f4c95b1 
If a `Package.swift` file  specifies a dependency with a branch name,
such as [1], the result of its analysis based on running [2] yields
"unspecified" as version string for that particular dependency.

A speciality of this package manger, similar to `GoMod`, is that
creating the dependency tree (via [2]) includes resolving the revisions
for all dependencies. From investigating various project setups, it
seems that the lockfile entries for `remoteSourceControl` dependencies
(see property `PinV2.kind`) always have a revision / SHA1. So, for
`remoteSourceControl`, which is the only kind currently handled, the
lockfile entry contains all information needed while the entries from
[2] lack the version / revision.

Fix both, the version string issues as well as the `vcsInfo.revision`
ones, by creating the result from the lockfile entries and only use the
entries from [2] as a fallback.

Fixes #8167.

[1] `.package(url: "git@github.com:my-org/my-project.git", branch: "my-feature")`
[2] `swift package show-dependencies`

Signed-off-by: Frank Viernau <frank_viernau@epam.com>
fviernau added a commit that referenced this issue Feb 7, 2024
@fviernau
feat(swiftpm): Gracefully handle dependencies specified by branch name
f3c0788 
If a `Package.swift` file  specifies a dependency with a branch name,
such as [1], the result of its analysis based on running [2] yields
"unspecified" as version string for that particular dependency.

A speciality of this package manger, similar to `GoMod`, is that
creating the dependency tree (via [2]) includes resolving the revisions
for all dependencies. From investigating various project setups, it
seems that the lockfile entries for `remoteSourceControl` dependencies
(see property `PinV2.kind`) always have a revision / SHA1. So, for
`remoteSourceControl`, which is the only kind currently handled, the
lockfile entry contains all information needed while the entries from
[2] lack the version / revision.

Fix both, the version string issues as well as the `vcsInfo.revision`
ones, by creating the result from the lockfile entries and only use the
entries from [2] as a fallback.

Fixes #8167.

[1] `.package(url: "git@github.com:my-org/my-project.git", branch: "my-feature")`
[2] `swift package show-dependencies`

Signed-off-by: Frank Viernau <frank_viernau@epam.com>
fviernau added a commit that referenced this issue Feb 7, 2024
@fviernau
feat(swiftpm): Gracefully handle dependencies specified by branch name
39e8b7f 
If a `Package.swift` file  specifies a dependency with a branch name,
such as [1], the result of its analysis based on running [2] yields
"unspecified" as version string for that particular dependency.

A speciality of this package manger, similar to `GoMod`, is that
creating the dependency tree (via [2]) includes resolving the revisions
for all dependencies. From investigating various project setups, it
seems that the lockfile entries for `remoteSourceControl` dependencies
(see property `PinV2.kind`) always have a revision / SHA1. So, for
`remoteSourceControl`, which is the only kind currently handled, the
lockfile entry contains all information needed while the entries from
[2] lack the version / revision.

Fix both, the version string issues as well as the `vcsInfo.revision`
ones, by creating the result from the lockfile entries and only use the
entries from [2] as a fallback.

Fixes #8167.

[1] `.package(url: "git@github.com:my-org/my-project.git", branch: "my-feature")`
[2] `swift package show-dependencies`

Signed-off-by: Frank Viernau <frank_viernau@epam.com>
fviernau added a commit that referenced this issue Feb 7, 2024
@fviernau
feat(swiftpm): Gracefully handle dependencies specified by branch name
84a3d1b 
If a `Package.swift` file specifies a dependency with a branch name,
such as [^1], the result of its analysis based on running [^2] yields
"unspecified" as version string for that particular dependency.

A speciality of this package manger, similar to `GoMod`, is that
creating the dependency tree (via [^2]) includes resolving the
revisions for all dependencies. From investigating various project
setups, it seems that the lockfile entries for `remoteSourceControl`
dependencies (see property `PinV2.kind`) always have a revision / SHA1.
So, for `remoteSourceControl`, which is the only kind currently
handled, the lockfile entry contains all information needed while the
entries from [^2] lack the version / revision.

Fix both, the version string issues as well as the `vcsInfo.revision`
ones, by creating the result from the lockfile entries and only use the
entries from [^2] as a fallback.

Fixes #8167.

[^1]: `.package(url: "git@github.com:my-org/my-project.git", branch: "my-feature")`
[^2]: `swift package show-dependencies`

Signed-off-by: Frank Viernau <frank_viernau@epam.com>
fviernau added a commit that referenced this issue Feb 7, 2024
@fviernau
feat(swiftpm): Gracefully handle dependencies specified by branch name
4e8ca76 
If a `Package.swift` file specifies a dependency with a branch name,
such as [^1], the result of its analysis based on running [^2] yields
"unspecified" as version string for that particular dependency.

A speciality of this package manger, similar to `GoMod`, is that
creating the dependency tree (via [^2]) includes resolving the
revisions for all dependencies. From investigating various project
setups, it seems that the lockfile entries for `remoteSourceControl`
dependencies (see property `PinV2.kind`) always have a revision / SHA1.
So, for `remoteSourceControl`, which is the only kind currently
handled, the lockfile entry contains all information needed while the
entries from [^2] lack the version / revision.

Fix both, the version string issues as well as the `vcsInfo.revision`
ones, by creating the result from the lockfile entries and only use the
entries from [^2] as a fallback.

Fixes #8167.

[^1]: `.package(url: "git@github.com:my-org/my-project.git", branch: "my-feature")`
[^2]: `swift package show-dependencies`

Signed-off-by: Frank Viernau <frank_viernau@epam.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@fviernau fviernau

Labels
analyzer About the analyzer tool enhancement Issues that are considered to be enhancements
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

SwiftPM: Support dependency entries with a branch name oss-review-toolkit/ort
2 participants
@sschuberth @fviernau