Skip to content

Conversation

@shivasurya
Copy link
Owner

Summary

Complete cleanup of backward compatibility layer in callgraph package. All external consumers now use proper sub-package imports.

Changes

Deleted (26 files)

  • Type aliases: types.go, statement.go, taint_summary.go
  • Wrapper functions: builder.go, patterns.go, registry.go
  • Other aliases: imports.go, callsites.go, cfg.go, attribute_extraction.go, attribute_registry.go, attribute_resolution.go, builtin_registry.go, chaining.go, frameworks.go, orm_patterns.go, python_version_detector.go, return_type.go, statement_extraction.go, stdlib_registry.go, stdlib_registry_loader.go, stdlib_registry_remote.go, taint.go, taint_summary.go, type_inference.go, variable_extraction.go
  • 10 test files testing private functions

Updated external consumers

  • cmd package (6 files): Use registry.BuildModuleRegistry(), builder.BuildCallGraph()
  • dsl package (8 files): Use core.CallGraph, core.CallSite
  • diagnostic package: Use extraction.ParsePythonFile(), cfg.BuildCFG(), taint.AnalyzeIntraProceduralTaint()

Created

  • graph/callgraph/doc.go: Comprehensive package documentation with usage examples
  • graph/callgraph/integration.go: Public API functions (InitializeCallGraph, AnalyzePatterns) for external use

Test updates

  • Updated 10+ test files with correct package imports
  • Removed test files for internal/private functions
  • All remaining tests passing

Impact

  • Breaking change: Removes all backward compatibility
  • Clean architecture: Proper separation of concerns with sub-packages
  • Better documentation: Comprehensive package docs with examples
  • Test coverage maintained: All critical functionality still tested

Test plan

  • All tests passing
  • Build successful
  • Linting clean (0 issues)

🤖 Generated with Claude Code

…h package

Complete cleanup of backward compatibility layer in callgraph package.
All external consumers now use proper sub-package imports.

**Deleted (26 files):**
- Type aliases: types.go, statement.go, taint_summary.go
- Wrapper functions: builder.go, patterns.go, registry.go
- All other alias/wrapper files (imports.go, callsites.go, cfg.go, etc.)
- 10 test files testing private functions

**Updated external consumers:**
- cmd package (6 files): Use registry.BuildModuleRegistry(), builder.BuildCallGraph()
- dsl package (8 files): Use core.CallGraph, core.CallSite
- diagnostic package: Use extraction.ParsePythonFile(), cfg.BuildCFG(), taint.AnalyzeIntraProceduralTaint()

**Created:**
- graph/callgraph/doc.go: Comprehensive package documentation
- graph/callgraph/integration.go: Public API (InitializeCallGraph, AnalyzePatterns)

**Test updates:**
- Updated 10+ test files with correct package imports
- Removed test files for internal/private functions

All tests passing, build successful, linting clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
@shivasurya shivasurya added go Pull requests that update go code refactor labels Nov 16, 2025
@shivasurya shivasurya self-assigned this Nov 16, 2025
@safedep
Copy link

safedep bot commented Nov 16, 2025

SafeDep Report Summary

Green Malicious Packages Badge Green Vulnerable Packages Badge Green Risky License Badge

No dependency changes detected. Nothing to scan.

This report is generated by SafeDep Github App

@codecov
Copy link

codecov bot commented Nov 16, 2025

Codecov Report

❌ Patch coverage is 89.77273% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.70%. Comparing base (d0c9e09) to head (b1577ee).
⚠️ Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
sourcecode-parser/cmd/ci.go 0.00% 3 Missing ⚠️
sourcecode-parser/cmd/query.go 0.00% 3 Missing ⚠️
sourcecode-parser/cmd/scan.go 25.00% 3 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #379      +/-   ##
==========================================
- Coverage   79.71%   78.70%   -1.01%     
==========================================
  Files          89       70      -19     
  Lines        6971     6923      -48     
==========================================
- Hits         5557     5449     -108     
- Misses       1183     1237      +54     
- Partials      231      237       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

shivasurya and others added 2 commits November 16, 2025 07:03
The analyze command was not displaying source and sink code snippets.
Updated AnalyzePatterns() to look up call site locations and read code
snippets from the source files.

Changes:
- Look up source/sink locations from CallSites in the call graph
- Read code snippets from source files using new getCodeSnippet() helper
- Properly convert Line (int) to SourceLine/SinkLine (uint32)

Example output now includes:
   Source: test.vulnerable() calls builtins.input()
           at /tmp/test_project/test.py:2
              2 | user_input = input("Enter: ")

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Added test coverage for callgraph integration functions:
- InitializeCallGraph: Tests initialization with various scenarios
- AnalyzePatterns: Tests security pattern detection and code snippet population
- getCodeSnippet: Tests code snippet extraction from files

Coverage improvements:
- integration.go: 6.66% → 98.0%
- InitializeCallGraph: 88.9%
- AnalyzePatterns: 100.0%
- getCodeSnippet: 100.0%

All tests passing, linting clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
@shivasurya shivasurya merged commit 6bba200 into main Nov 16, 2025
4 of 5 checks passed
@shivasurya shivasurya deleted the refactor/08-cleanup branch November 16, 2025 12:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

go Pull requests that update go code refactor

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants