Skip to content

fix: Hardcoded config#11

Merged
math280h merged 1 commit intomainfrom
fix/hardcoded-configs
Mar 2, 2026
Merged

fix: Hardcoded config#11
math280h merged 1 commit intomainfrom
fix/hardcoded-configs

Conversation

@math280h
Copy link
Owner

@math280h math280h commented Mar 2, 2026

No description provided.

@math280h math280h self-assigned this Mar 2, 2026
Copilot AI review requested due to automatic review settings March 2, 2026 01:35
@math280h math280h merged commit 441d382 into main Mar 2, 2026
5 of 6 checks passed
@math280h math280h deleted the fix/hardcoded-configs branch March 2, 2026 01:35
@github-actions
Copy link

github-actions bot commented Mar 2, 2026

Coverage

Coverage Report

Metric Value
Total lines 5877
Covered lines 4994
Missed lines 883
Coverage 84.98%
Tests passed 168
Tests failed 0
Tests ignored 0
Coverage command exit 0
Per-file coverage (top 40 by missed lines)
File Stmts Miss Cover Missing
/home/runner/work/safe-pkgs/safe-pkgs/src/service.rs 354 149 57.91% 40, 41, 42, 43, 44, 45, 89, 90, ...
/home/runner/work/safe-pkgs/safe-pkgs/src/custom_rules.rs 194 119 38.66% 41, 70, 71, 80, 81, 82, 83, 96, ...
/home/runner/work/safe-pkgs/safe-pkgs/src/config/custom_rules.rs 155 67 56.77% 132, 159, 165, 172, 175, 194, 195, 197, ...
/home/runner/work/safe-pkgs/safe-pkgs/crates/checks/staleness/src/lib.rs 210 55 73.81% 63, 64, 65, 66, 67, 68, 69, 70, ...
/home/runner/work/safe-pkgs/safe-pkgs/src/policy_snapshot.rs 209 48 77.03% 120, 146, 147, 148, 149, 150, 151, 152, ...
/home/runner/work/safe-pkgs/safe-pkgs/src/main.rs 84 41 51.19% 43, 104, 105, 107, 108, 109, 110, 111, ...
/home/runner/work/safe-pkgs/safe-pkgs/crates/core/src/lib.rs 348 38 89.08% 82, 83, 84, 100, 101, 102, 118, 119, ...
/home/runner/work/safe-pkgs/safe-pkgs/crates/registry/cargo/src/lockfile.rs 432 33 92.36% 27, 28, 29, 44, 45, 46, 63, 72, ...
/home/runner/work/safe-pkgs/safe-pkgs/src/mcp/server.rs 128 32 75.00% 128, 129, 130, 152, 153, 155, 156, 157, ...
/home/runner/work/safe-pkgs/safe-pkgs/src/checks.rs 431 31 92.81% 184, 198, 199, 200, 201, 202, 203, 204, ...
/home/runner/work/safe-pkgs/safe-pkgs/src/cache.rs 123 22 82.11% 25, 26, 27, 28, 29, 30, 31, 32, ...
/home/runner/work/safe-pkgs/safe-pkgs/crates/registry/pypi/src/lockfile.rs 378 22 94.18% 26, 27, 28, 43, 44, 45, 62, 63, ...
/home/runner/work/safe-pkgs/safe-pkgs/src/config/mod.rs 171 20 88.30% 196, 197, 198, 209, 295, 296, 297, 298, ...
/home/runner/work/safe-pkgs/safe-pkgs/src/bin/safe-pkgs-mcp.rs 37 16 56.76% 12, 13, 14, 15, 16, 18, 21, 22, ...
/home/runner/work/safe-pkgs/safe-pkgs/crates/registry/npm/src/registry.rs 262 15 94.27% 65, 93, 94, 95, 96, 113, 114, 115, ...
/home/runner/work/safe-pkgs/safe-pkgs/crates/registry/npm/src/lockfile.rs 395 14 96.46% 27, 28, 29, 44, 45, 46, 66, 94, ...
/home/runner/work/safe-pkgs/safe-pkgs/crates/registry/pypi/src/registry.rs 216 13 93.98% 49, 50, 51, 56, 57, 58, 117, 118, ...
/home/runner/work/safe-pkgs/safe-pkgs/crates/checks/typosquat/src/lib.rs 116 13 88.79% 64, 75, 78, 79, 87, 112, 154, 155, ...
/home/runner/work/safe-pkgs/safe-pkgs/src/registries/mod.rs 149 9 93.96% 49, 50, 51, 124, 144, 153, 154, 155, ...
/home/runner/work/safe-pkgs/safe-pkgs/crates/osv/src/lib.rs 147 9 93.88% 12, 13, 14, 15, 16, 17, 18, 19, ...
/home/runner/work/safe-pkgs/safe-pkgs/crates/registry/cargo/src/registry.rs 192 8 95.83% 38, 39, 40, 45, 46, 47, 211, 213
/home/runner/work/safe-pkgs/safe-pkgs/crates/checks/existence/src/lib.rs 48 3 93.75% 36, 37, 38
/home/runner/work/safe-pkgs/safe-pkgs/crates/checks/advisory/src/lib.rs 116 3 97.41% 68, 129, 142
/home/runner/work/safe-pkgs/safe-pkgs/src/audit_log.rs 58 2 96.55% 70, 124
/home/runner/work/safe-pkgs/safe-pkgs/src/support_map.rs 142 1 99.30% 58
/home/runner/work/safe-pkgs/safe-pkgs/crates/http/src/lib.rs 162 1 99.38% 138
/home/runner/work/safe-pkgs/safe-pkgs/crates/registry/pypi/src/lib.rs 14 0 100.00% -
/home/runner/work/safe-pkgs/safe-pkgs/crates/registry/npm/src/lib.rs 14 0 100.00% -
/home/runner/work/safe-pkgs/safe-pkgs/crates/registry/cargo/src/lib.rs 14 0 100.00% -
/home/runner/work/safe-pkgs/safe-pkgs/crates/checks/version-age/src/lib.rs 66 0 100.00% -
/home/runner/work/safe-pkgs/safe-pkgs/crates/checks/popularity/src/lib.rs 81 0 100.00% -
/home/runner/work/safe-pkgs/safe-pkgs/crates/checks/install-script/src/lib.rs 55 0 100.00% -

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR removes hardcoded/default registry configuration and central registry-check compatibility logic, shifting “unsupported checks” to be declared by each registry via RegistryDefinition, and updates MCP/CLI surfaces to reflect supported registries dynamically.

Changes:

  • Add excluded_checks to safe_pkgs_core::RegistryDefinition and move registry check-support policy into each registry crate’s registry_definition().
  • Remove the binary-level app_registry_check_support() and update registry catalog support computation to use excluded_checks.
  • Update MCP JSON schema metadata and CLI defaults to derive supported/default registries from the registered definitions (instead of hardcoded "npm").

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
src/registries/mod.rs Uses excluded_checks for support matrix; removes hardcoded fallback defaults in favor of “must be registered” behavior.
src/mcp/server.rs Builds dynamic schema enum/default/description from registry catalog; updates server instructions to derive lockfile keywords dynamically.
src/main.rs CLI --registry default now uses default_lockfile_registry_key(); removes centralized check-support policy and updates tests accordingly.
crates/registry/pypi/src/lib.rs Declares excluded_checks for PyPI.
crates/registry/npm/src/lib.rs Declares empty excluded_checks for npm.
crates/registry/cargo/src/lib.rs Declares excluded_checks for Cargo.
crates/core/src/lib.rs Adds excluded_checks field to RegistryDefinition.
crates/checks/README.md Updates wiring documentation to reflect excluded_checks ownership.
CONTRIBUTING.md Updates contributor guidance to declare unsupported checks in the registry crate.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +30 to +34
serde_json::json!(format!(
"Package registry. Supported: {}. Defaults to \"{}\".",
crate::registries::supported_package_registry_keys().join("\", \""),
crate::registries::default_package_registry_key(),
)),
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The generated description string is missing the opening quote around the first registry key because it uses join("\", \"") without adding a leading ". This currently renders like Supported: npm", "cargo"... instead of Supported: "npm", "cargo".... Consider joining with ", " and wrapping the whole list, or mapping keys to already-quoted strings before joining.

Copilot uses AI. Check for mistakes.
Comment on lines +51 to +55
serde_json::json!(format!(
"Registry for parsing and checks. Supported: {}. Defaults to \"{}\".",
crate::registries::supported_lockfile_registry_keys().join("\", \""),
crate::registries::default_lockfile_registry_key(),
)),
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same quoting issue as package_registry_schema: supported_lockfile_registry_keys().join("\", \"") produces a list missing the opening quote for the first element, so the description renders oddly. Build the list as properly quoted items (or avoid embedding quotes in the separator).

Copilot uses AI. Check for mistakes.
Comment on lines +66 to +73
let registry_files = crate::registries::supported_lockfile_registry_keys()
.into_iter()
.filter_map(|key| {
crate::registries::supported_lockfile_files_for_registry(key)
.map(|files| format!("{key}: {}", files.join("/")))
})
.collect::<Vec<_>>()
.join(", ");
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lockfile_path_schema calls supported_lockfile_files_for_registry once per registry key; that helper rebuilds the registry catalog on each call (register_default_catalog()), which is unnecessary work during schema generation. Consider fetching the catalog once (or adding a cached map of registry->supported_files in registries) and reusing it here.

Copilot uses AI. Check for mistakes.
Comment on lines +194 to +200
let lockfile_keywords = crate::registries::supported_lockfile_registry_keys()
.into_iter()
.filter_map(|key| crate::registries::supported_lockfile_files_for_registry(key))
.flatten()
.map(|f| format!("`{f}`"))
.collect::<Vec<_>>()
.join(", ");
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

get_info builds lockfile_keywords by repeatedly calling supported_lockfile_files_for_registry, which reconstructs the registry catalog each time. Since get_info can be invoked multiple times by clients, consider caching these supported file keywords (or computing them once from a single catalog instance) to avoid repeated catalog builds.

Copilot uses AI. Check for mistakes.
Comment on lines 162 to 176
pub fn default_package_registry_key() -> &'static str {
registry_definitions()
.first()
.map(|def| def.key)
.unwrap_or("npm")
.expect("at least one registry must be registered")
}

/// Returns the default lockfile registry key.
pub fn default_lockfile_registry_key() -> &'static str {
registry_definitions()
.iter()
.find(|def| def.create_lockfile_parser.is_some())
.map(|def| def.key)
.unwrap_or("npm")
.expect("at least one lockfile-capable registry must be registered")
}
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

default_package_registry_key/default_lockfile_registry_key now expect(...) instead of providing a fallback. This will panic if app_registry_definitions() is ever empty (or if no lockfile-capable registries are registered), including during CLI default evaluation and MCP schema generation. Prefer returning Option<&'static str>/Result<_,_> and surfacing a user-facing error, or keep a non-panicking fallback consistent with the schema enum.

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants