sonatype-nexus-community / oysteR

Create purls from the filtered sands of your dependencies, powered by OSS Index
https://sonatype-nexus-community.github.io/oysteR/
Apache License 2.0
40 stars 9 forks source link

Functionality to audit conda environment files #50

Closed JosiahParry closed 3 years ago

JosiahParry commented 3 years ago

This pull request proposes a new function to audit Conda environment yaml files. This function supports environment.yml files that contain both pip and conda dependencies. If there are other types of package source dependencies that can be incorporated in an environment.yml I will have missed them. Unlike audit_renv_lock() and audit_req_txt(), this function permits the user to provide their own file name. This is because there is greater variability in the naming conventions of conda environment files (e.g. https://github.com/vithursant/deep-learning-conda-envs).

This pull request makes the following changes:

cc @bhamail / @DarthHater / @brittanybelle / @adrianpowell / @csgillespie

csgillespie commented 3 years ago

Thanks @JosiahParry A few things

and finally, thanks!

Oh and congratulations on using the superior assignment operator = vs <-

JosiahParry commented 3 years ago

Just for your sake I ran a find and replace all for the assignment arrow 😉 This is my way of not working today 😝 I'll go ahead and make the changes.

Will also try and make expect_secure_renv/req/env functions as well. I'd like to have an up and running example of automated checks with testthat soon. I think it'll be exceptionally useful for those security conscious orgs (even if it'll always return 0 for R 😬 )

DarthHater commented 3 years ago

Wild! @JosiahParry , if it interests you, we originally designed this project: https://github.com/sonatype-nexus-community/jake to work with Conda, we took a slightly different approach. If you like writing Python, you are always welcome over there, too!