feat: added cocoapods lockfile to the list of supported lockfiles #330
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Backwards compatibility summary: |
bkettle
reviewed
Dec 16, 2024
Comment on lines
511
to
+512
| | SwiftPM <json name="swiftpm"> | ||
| | Cocoapods <json name="cocoapods"> |
There was a problem hiding this comment.
Your understanding is that SwiftPM and Cocoapods are entirely separate package namespaces, right? I did a bit of searching just now and that seems to be the case, but it also seems like they might both use git URLs as the primary identifier. I just want to ensure that this isn't an npm/yarn or pip/poetry situation
There was a problem hiding this comment.
AFAIK npm/yarn and pip/poetry are cases in which two package managers use the same central repository. So, for example, a package with the same name/version in pip is guaranteed to be the exact same as the package with the same name/version in poetry.
While Cocoapods and SwiftPM have some coincidental overlap (e.g. they're used for iOS/macOS/tvOS development, their packages can live in github), but they are completely separate ecosystems with different registries. Cocoapods has a centralized repo at cocoapods.org and supports both obj-c and swift packages, while SwiftPM seems to be distributed with packages hosted anywhere and supports swift-only. There's no guarantee that a package in one will exist in the other, and it's entirely possible for two packages to exist in the PMs with the same name/version but be completely different.
bkettle
approved these changes
Dec 16, 2024
salolivares
approved these changes
Dec 16, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Added necessary interface changes to support 1) a new ecosystem, cocoapods, 2) new lockfile + manifest types for cocoapods, and 3) a new parser type for (you guessed it) cocoapods.
make setup && maketo update the generated code after editing a.atdfile (TODO: have a CI check)For example, the Semgrep backend need to still be able to consume data
generated by Semgrep 1.50.0.
See https://atd.readthedocs.io/en/latest/atdgen-tutorial.html#smooth-protocol-upgrades
Note that the types related to the semgrep-core JSON output or the
semgrep-core RPC do not need to be backward compatible!