Open AlekSi opened 11 months ago
I am not sure on the best way to do that for this linter without significantly slowing this down. It looks at source files and reads the import statements from the AST. Though https://github.com/ryancurrah/gomodguard states it only works on direct dependencies as well. But given the go.sum file, it may be a better feature over there?
Open to suggestions though.
Of course that is only at the module level.
One (maybe stupid) option is to run go list -json ./...
and parse the output, including Deps
field. It also may be done only if at least one rule opted-in for the transitive check.
Another option is to use https://pkg.go.dev/golang.org/x/tools/go/packages
It would be nice to have a way to allow/deny indirect/transitive imports.
For example, let's say a have a package
a
imported by packageb
. Then I have packagec
that imports packageb
. And I have a rule that deniesc
to importa
. Currently, the linter passes. I think there should be an option to fail in that case.