Designing a compliance check that does not cry wolf in CI

说明与用途

依赖扫描器经常忽略无法解析的版本，导致报告不完整。将 re.match 替换为 re.search，添加全面测试，并使用不同的退出码和文件变更过滤器改进 pre‑commit 钩子，可解决此问题并提升 CI 的可靠性。

问题

Compliance scanners often silently drop unparseable version strings, producing plausible but incomplete reports that lead to disabled checks and ignored security issues.

结果

The updated scanner reliably reports all supported dependency versions, reduces false negatives, and prevents unnecessary disabling of CI checks.

工作流

• 1. Identify the parsing bug by testing against real ecosystem inputs.
• 2. Replace re.match with re.search to find the first numeric component.
• 3. Add comprehensive parameterized tests covering all real-world version strings.
• 4. Log the number of dependencies processed and the number successfully parsed to surface silent drops.
• 5. Implement three exit codes: 0 (clean), 1 (issues found), 2 (no manifests).
• 6. Configure CI to treat exit code 2 as non‑fatal or as a policy decision.
• 7. Use pre‑commit hooks with file‑change filters to avoid blocking commits in repos without relevant files.

证据

The first version of that helper used this: re.match(r'^(d+)(?:.(d+))?')… The match fails… The component is dropped – silently, with no warning, no error and no log line.

来源

The fix is one word: m = re.search(r'(d+)(?:.(d+))?')… Note lts/gallium still yields nothing, correctly.

来源