generated from dxworks/dxworks-template-node-ts
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
801103e
commit 1cbecef
Showing
1 changed file
with
37 additions
and
91 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,129 +1,75 @@ | ||
# Dxworks depinder | ||
# Depinder - Dependency analysis for software projects | ||
|
||
This project was generated using the `dxworks-template-node-ts` repository template. | ||
The repository is found at: https://github.com/dxworks/depinder/tree/systems | ||
|
||
## Installation | ||
Depinder offers comprehensive dependency analysis, identifying direct and transitive depen- dencies to provide a detailed understanding of the software’s dependency graph. It integrates security analysis by leveraging databases such as the GitHub Advisory Database and the Common Vulnerability Scoring System (CVSS) to detect and prioritize vulnerabilities. Additionally, the tool ensures license compliance by identifying and managing the licenses associated with each dependency, thus prevent- ing potential legal issues. | ||
|
||
Use `npm` to install | ||
|
||
```shell | ||
npm i -g @dxworks/depinder | ||
``` | ||
|
||
or, to use it from `dxw cli`: | ||
## Environment Variables | ||
|
||
```shell | ||
dxw plugin i @dxworks/depinder | ||
``` | ||
Depinder relies on GitHub and Libraries.io to get information about packages and known security vulnerabilities. In order to call these downstream services, you need to add two environment variables with the corresponding tokens: | ||
|
||
To check if the installation was successful, run: | ||
|
||
```shell | ||
depinder --version | ||
``` | ||
- `GH_TOKEN` should contain a GitHub token with the read:packages scope. | ||
- `LIBRARIES_IO_API_KEY` should contain the Libraries.io API Key. | ||
|
||
## Configuration | ||
`Depinder` relies on `GitHub` and `Libraries.io` to get information about packages and known security vulnerabilities. In order to call these downstream services, you need to add two environment variables with the corresponding tokens: | ||
- `GH_TOKEN` should contain a `GitHub` token with the `read:packages` scope. | ||
- `LIBRARIES_IO_API_KEY` should contain the `Libraries.io` API Key. | ||
## Run Locally | ||
|
||
## Preprocess data | ||
If you want to run `Depinder` on a project that has not been processed by `Depminer` before, | ||
you need to run the following command to generate the folder structure: | ||
Clone the project | ||
|
||
```shell | ||
dxw depminer construct <path-to-dx-dependencies-folder> <path-to-exported-folder> | ||
```bash | ||
git clone -b systems --single-branch https://github.com/dxworks/depinder | ||
``` | ||
|
||
After doing this, some package managers will require some more post-processing, in order to generate the `dependency tree` or the `lock file`. | ||
Go to the project directory | ||
|
||
### Maven | ||
To generate the `dependency tree` for a maven project, run the following command in each project (or root project in case they contain modules): | ||
|
||
```shell | ||
mvn dependency:tree -DoutputFile=deptree.txt | ||
```bash | ||
cd depinder | ||
``` | ||
This command should create a `deptree.txt` file next to each `pom.xml` file. | ||
This file will be processed by MavenMiner to generate the a `pom.json` file, that corresponds to the expectations that the `Depinder` Java plugin has. | ||
|
||
|
||
### Gradle | ||
To generate the `dependency tree` for a gradle project, run the following command in each project (or root project in case they contain modules): | ||
Install dependencies | ||
|
||
```shell | ||
gradle dependencies --configuration compileClasspath > deptree.txt | ||
```bash | ||
npm install && cd depinder-fe && npm install && cd .. && cd server && npm install && tsc && cd .. && npm install | ||
``` | ||
This command should create a `deptree.txt` file next to each `build.gradle` file. | ||
This file will be processed by GradleMiner to generate the a `gradle.json` file, that corresponds to the expectations that the `Depinder` Java plugin has. | ||
|
||
## Usage | ||
The following commands can be used either as standalone, or with the `dxw` prefix ahead. | ||
|
||
### Cache command | ||
Start everything (Angular frontend, Express backend, Docker container): | ||
|
||
To check if the MongoDB cache is running: | ||
```shell | ||
depinder cache | ||
```bash | ||
npm run start-all | ||
``` | ||
|
||
To initalise the Redis cache: | ||
```shell | ||
depinder cache init | ||
``` | ||
If you would rather run each component separately: | ||
|
||
To start the MongoDB cache: | ||
```shell | ||
depinder cache start | ||
```bash | ||
npm run start-fe | ||
``` | ||
|
||
To stop the MongoDB cache: | ||
```shell | ||
depinder cache stop | ||
```bash | ||
npm run start-be | ||
``` | ||
|
||
To see what is available in the cache, please visit the [Mongo Express Dashboard](http://localhost:8002/). | ||
|
||
### Analyse | ||
To analyse a project, run the following command: | ||
|
||
```shell | ||
depinder analyse <paths-to-analysed-project-folders> ... -r <path-to-results-folder> | ||
```bash | ||
npm run start-docker | ||
``` | ||
This command gets as an argument multiple fully qualified folder paths and will automatically run all plugins that are available for the project's used languages | ||
and export the results in the specified `results` folder. | ||
|
||
### Start everything | ||
```shell | ||
npm run start-all | ||
``` | ||
|
||
### Docker | ||
```shell | ||
npm run start-docker | ||
``` | ||
## Analysing systems | ||
|
||
### Backend | ||
```shell | ||
npm run start-be | ||
``` | ||
For projects using Maven or Gradle, an additional command needs to be run to generate dependency tree files: | ||
|
||
### Frontend | ||
```shell | ||
npm run start-fe | ||
This should be run in the folder of a Maven project: | ||
```bash | ||
mvn dependency:tree -DoutputFile=deptree.txt | ||
``` | ||
Backend needs to be running for the frontend to work as expected. | ||
|
||
This should be run in the folder of a Gradle project: | ||
```bash | ||
gradle dependencies --configuration compileClasspath > deptree.txt | ||
``` | ||
## Acknowledgements | ||
|
||
Packagist api calls were inspired by [packagist-api-client](https://www.npmjs.com/package/packagist-api-client). | ||
Depinder also uses some libraries from `Snyk.io` to parse dependency files. | ||
|
||
## Contributing | ||
|
||
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change. | ||
|
||
Please make sure to update tests as appropriate. | ||
|
||
## License | ||
|
||
[Apache-2.0](https://choosealicense.com/licenses/apache) | ||
[Apache-2.0](https://choosealicense.com/licenses/apache) |