Correctly identify dependency versions chosen by Go

src/process.ts

@@ -1,16 +1,16 @@
-import path from 'path'
+import { PackageURL } from 'packageurl-js'
 
 import * as exec from '@actions/exec'
 import * as core from '@actions/core'
-import {
-  Manifest,
-  BuildTarget,
-  PackageCache
-} from '@github/dependency-submission-toolkit'
+import { PackageCache } from '@github/dependency-submission-toolkit'
 
 import { parseGoModGraph, parseGoList } from './parse'
 
-export async function processGoGraph (goModDir: string): Promise<PackageCache> {
+export async function processGoGraph (
+  goModDir: string,
+  directDependencies: Array<PackageURL>,
+  indirectDependencies: Array<PackageURL>
+): Promise<PackageCache> {
   console.log(`Running 'go mod graph' in ${goModDir}`)
   const goModGraph = await exec.getExecOutput('go', ['mod', 'graph'], {
     cwd: goModDir
@@ -21,35 +21,89 @@ export async function processGoGraph (goModDir: string): Promise<PackageCache> {
     throw new Error("Failed to execute 'go mod graph'")
   }
 
+  /* add all direct and indirect packages to a new PackageCache */
   const cache = new PackageCache()
+  directDependencies.forEach((pkg) => {
+    cache.package(pkg)
+  })
+  indirectDependencies.forEach((pkg) => {
+    cache.package(pkg)
+  })
+
   const packageAssocList = parseGoModGraph(goModGraph.stdout)
   packageAssocList.forEach(([parentPkg, childPkg]) => {
-    cache.package(parentPkg).dependsOn(cache.package(childPkg))
+    /* Look up the parent package in the cache. go mod graph will return
+     * multiple versions of packages with the same namespace and name. We
+     * select only package versions used in the Go build target. */
+    const targetPackage = cache.lookupPackage(parentPkg)
+    if (!targetPackage) return
+
+    /* Build a matcher to select on the namespace+name of the child package in
+     * the cache. The child package version specified by go mod graph is not
+     * the one guaranteed to be selected when building Go build targets. */
+    const matcher: { name: string; namespace?: string } = {
+      name: childPkg.name
+    }
+    if (childPkg.namespace) matcher.namespace = childPkg.namespace
+
+    /* There should only ever be a single package with a namespace+name in the
+     * build target list. Go does not support multiple versions of the same
+     * package */
+    const matches = cache.packagesMatching(matcher)
+    if (matches.length !== 1) {
+      throw new Error(
+        'assertion failed: expected one package in cache with namespace+name. ' +
+          'Found: ' +
+          JSON.stringify(matches)
+      )
+    }
+    // create the dependency relationship
+    targetPackage.dependsOn(matches[0])
   })
 
   return cache
 }
 
-// For a specific Go _build target_, this template lists all dependencies used
-// to build the build target It does not provide association between the
+// For a specific Go _build target_, these templates list dependencies used to
+// in the build target. It does not provide association between the
 // dependencies (i.e. which dependencies depend on which)
 // eslint-disable-next-line quotes
 // eslint-disable-next-line no-useless-escape
-const GO_LIST_DEP_TEMPLATE =
-  '{{define "M"}}{{.Path}}@{{.Version}}{{end}}{{with .Module}}{{if not .Main}}{{if .Replace}}{{template "M" .Replace}}{{else}}{{template "M" .}}{{end}}{{end}}{{end}}'
+const GO_DIRECT_DEPS_TEMPLATE =
+  '{{define "M"}}{{if not .Indirect}}{{.Path}}@{{.Version}}{{end}}{{end}}{{with .Module}}{{if not .Main}}{{if .Replace}}{{template "M" .Replace}}{{else}}{{template "M" .}}{{end}}{{end}}{{end}}'
+// eslint-disable-next-line quotes
+// eslint-disable-next-line no-useless-escape
+const GO_INDIRECT_DEPS_TEMPLATE =
+  '{{define "M"}}{{if .Indirect}}{{.Path}}@{{.Version}}{{end}}{{end}}{{with .Module}}{{if not .Main}}{{if .Replace}}{{template "M" .Replace}}{{else}}{{template "M" .}}{{end}}{{end}}{{end}}'
 
-export async function processGoBuildTarget (
+export async function processGoDirectDependencies (
+  goModDir: string,
+  goBuildTarget: string
+): Promise<Array<PackageURL>> {
+  console.log(
+    `go direct package detection in ${goModDir} on build target ${goBuildTarget}`
+  )
+  return processGoList(goModDir, goBuildTarget, GO_DIRECT_DEPS_TEMPLATE)
+}
+
+export async function processGoIndirectDependencies (
+  goModDir: string,
+  goBuildTarget: string
+): Promise<Array<PackageURL>> {
+  console.log(
+    `go indirect package detection in ${goModDir} on build target ${goBuildTarget}`
+  )
+  return processGoList(goModDir, goBuildTarget, GO_INDIRECT_DEPS_TEMPLATE)
+}
+
+async function processGoList (
   goModDir: string,
   goBuildTarget: string,
-  cache: PackageCache
-): Promise<Manifest> {
-  console.log(
-    `Running go package detection in ${goModDir} on build target ${goBuildTarget}`
-  )
-
+  goListTemplate: string
+): Promise<Array<PackageURL>> {
   const goList = await exec.getExecOutput(
     'go',
-    ['list', '-deps', '-f', GO_LIST_DEP_TEMPLATE, goBuildTarget],
+    ['list', '-deps', '-f', goListTemplate, goBuildTarget],
     { cwd: goModDir }
   )
   if (goList.exitCode !== 0) {
@@ -58,14 +112,5 @@ export async function processGoBuildTarget (
     throw new Error("Failed to execute 'go list'")
   }
 
-  const dependencies = parseGoList(goList.stdout)
-  const manifest = new BuildTarget(
-    goBuildTarget,
-    path.join(goModDir, goBuildTarget)
-  )
-  dependencies.forEach((dep) => {
-    manifest.addBuildDependency(cache.package(dep))
-  })
-
-  return manifest
+  return parseGoList(goList.stdout)
 }