edoardottt / depsdev Goto Github PK

Add this

Read the full [`package documentation here`](https://pkg.go.dev/github.com/edoardottt/depsdev/pkg/depsdev)

under the example in subsection Use depsdev as a Go module in the README

• https://docs.deps.dev/api/v3alpha/index.html#getsimilarlynamedpackages

See https://docs.deps.dev/api/v3alpha/#getrequirements.

The PR should add the subcommand (in the cmd folder), the API structs and the methods necessary to interact with the API.

Ping me here if you need additional help :)

In resource-constrained environments we sometimes cannot afford to install full-blown Go + build packages with it: good practice is to have pre-packaged binary releases for each platform.

You can include this in a GitHub action workflow, by leveraging something like the https://github.com/marketplace/actions/go-release-binaries action which automates the process.

For reference:

• https://github.com/marketplace/actions/goreleaser-action
• https://github.com/edoardottt/cariddi/blob/main/.goreleaser.yaml
• https://github.com/edoardottt/cariddi/blob/main/.github/release.yml
• https://github.com/edoardottt/cariddi/blob/main/.github/workflows/release-binary.yml
• https://github.com/edoardottt/cariddi/blob/main/.github/workflows/release-test.yml

See https://docs.deps.dev/api/v3alpha/#getprojectpackageversions.

The PR should add the subcommand (in the cmd folder), the API structs and the methods necessary to interact with the API.

Ping me here if you need additional help :)

• https://docs.deps.dev/api/v3alpha/index.html#purllookup
• https://docs.deps.dev/api/v3alpha/index.html#purllookupbatch

Add graph subcommand like in the google repo.

Add test for standard queries per doc

e.g. https://docs.deps.dev/api/v3/#getpackage

At the moment v3alpha is supported.

Add the choice of using v3 or v3alpha (go package).

• #66
• #67
• #68
• #65
• #64
• #69

Is your feature request related to a problem? Please describe.
The way the main-level functions are organized prevents the reuse of an HTTP client and thus forces the creation of a new TCP connection for every function call.

Here is the list of the functions I talking about:

func GetInfo
func GetVersion
func GetDependencies
func GetProject
func GetAdvisory
func GetQuery

Mainly all the exported functions in this file https://github.com/edoardottt/depsdev/blob/main/pkg/depsdev/api.go

Describe the solution you'd like
These functions should be converted to methods on a struct that encapsulates the Client struct
This way, the HTTP client would be kept between requests, which in turn would allow to re-use the TCP connection.

Additional context
I've run a very simple benchmark to highlight the potential gain of this change.
I've benchmarked the GetInfo and GetVersion API calls.
Here are the results:

goos: darwin
goarch: arm64
pkg: github.com/edoardottt/depsdev/pkg/depsdev
             │ functions.perf │             methods.perf             │
             │     sec/op     │    sec/op     vs base                │
GetInfo-8       143.66m ±  6%   78.47m ± 15%  -45.38% (p=0.000 n=10)
GetVersion-8    119.86m ± 16%   53.91m ±  6%  -55.02% (p=0.000 n=10)
geomean          131.2m         65.04m        -50.43%

The code of the benchmark can be found at https://github.com/zaibon/depsdev/blob/reuse-http-client/pkg/depsdev/api_test.go

• https://docs.deps.dev/api/v3alpha/index.html#getversionbatch
• https://docs.deps.dev/api/v3alpha/index.html#getprojectbatch

Describe the bug
Some project detail in the depsdev database have the wrong type in the ossFuzz object.
Example: https://api.deps.dev/v3alpha/projects/github.com%2Fklauspost%2Fcompress

lineCount and lineCoverCount are strings while they should be integer. This prevents the unmarshaling of this project by this library.

To Reproduce
Steps to reproduce the behavior:

1. use the GetProject with argument "github.com/klauspost/compress"

Expected behavior
Get project details from the API