gomodguard

README

gomodguard

Allow and block list linter for direct Go module dependencies. This is useful for organizations where they want to standardize on the modules used and be able to recommend alternative modules.

Description

Allowed and blocked modules are defined in a .gomodguard.yaml or ~/.gomodguard.yaml file.

Modules can be allowed by module or domain name. When allowed modules are specified any modules not in the allowed configuration are blocked.

If no allowed modules or domains are specified then all modules are allowed except for blocked ones.

The linter looks for blocked modules in go.mod and searches for imported packages where the imported packages module is blocked. Indirect modules are not considered.

Alternative modules can be optionally recommended in the blocked modules list.

If the linted module imports a blocked module but the linted module is in the recommended modules list the blocked module is ignored. Usually, this means the linted module wraps that blocked module for use by other modules, therefore the import of the blocked module should not be blocked.

Results are printed to stdout.

Logging statements are printed to stderr.

Results can be exported to different report formats. Which can be imported into CI tools. See the help section for more information.

Configuration

allowed:
  modules:                                                      # List of allowed modules
    - gopkg.in/yaml.v2
    - github.com/go-xmlfmt/xmlfmt
    - github.com/phayes/checkstyle
    - github.com/mitchellh/go-homedir
  domains:                                                      # List of allowed module domains
    - golang.org

blocked:
  modules:                                                      # List of blocked modules
    - github.com/uudashr/go-module:                             # Blocked module
        recommendations:                                        # Recommended modules that should be used instead (Optional)
          - golang.org/x/mod                           
        reason: "`mod` is the official go.mod parser library."  # Reason why the recommended module should be used (Optional)

Usage

╰─ ./gomodguard -h
Usage: gomodguard <file> [files...]
Also supports package syntax but will use it in relative path, i.e. ./pkg/...
Flags:
  -f string
        Report results to the specified file. A report type must also be specified
  -file string

  -h    Show this help text
  -help

  -n    Don't lint test files
  -no-test

  -r string
        Report results to one of the following formats: checkstyle. A report file destination must also be specified
  -report string

Example

╰─ ./gomodguard -r checkstyle -f gomodguard-checkstyle.xml ./...

info: allowed modules, [gopkg.in/yaml.v2 github.com/go-xmlfmt/xmlfmt github.com/phayes/checkstyle github.com/mitchellh/go-homedir]
info: allowed module domains, [golang.org]
info: blocked modules, [github.com/uudashr/go-module]
info: found `2` blocked modules in the go.mod file, [github.com/gofrs/uuid github.com/uudashr/go-module]
blocked_example.go:6: import of package `github.com/gofrs/uuid` is blocked because the module is not in the allowed modules list.
blocked_example.go:7: import of package `github.com/uudashr/go-module` is blocked because the module is in the blocked modules list. `golang.org/x/mod` is a recommended module. `mod` is the official go.mod parser library.

Resulting checkstyle file

╰─ cat gomodguard-checkstyle.xml

<?xml version="1.0" encoding="UTF-8"?>
<checkstyle version="1.0.0">
  <file name="blocked_example.go">
    <error line="6" column="1" severity="error" message="import of package `github.com/gofrs/uuid` is blocked because the module is not in the allowed modules list." source="gomodguard">
    </error>
    <error line="7" column="1" severity="error" message="import of package `github.com/uudashr/go-module` is blocked because the module is in the blocked modules list. `golang.org/x/mod` is a recommended module. `mod` is the official go.mod parser library." source="gomodguard">
    </error>
  </file>
</checkstyle>

Install

go get -u github.com/ryancurrah/gomodguard/cmd/gomodguard

Develop

git clone https://github.com/ryancurrah/gomodguard.git && cd gomodguard

go build -o gomodguard cmd/gomodguard/main.go

License

MIT

Documentation

Index

• type Allowed
  • func (a *Allowed) IsAllowedModule(module string) bool
  • func (a *Allowed) IsAllowedModuleDomain(module string) bool
• type Blocked
• type BlockedModule
• type BlockedModules
  • func (b BlockedModules) Get() []string
  • func (b BlockedModules) IsBlockedModule(module string) bool
  • func (b BlockedModules) IsBlockedPackage(pkg string) bool
  • func (b BlockedModules) RecommendedModules(pkg string) *Recommendations
• type Configuration
• type Processor
  • func NewProcessor(config Configuration, logger *log.Logger) (*Processor, error)
  • func (p *Processor) ProcessFiles(filenames []string) []Result
• type Recommendations
  • func (r *Recommendations) HasRecommendations() bool
  • func (r *Recommendations) IsRecommended(pkg string) bool
  • func (r *Recommendations) String() string
• type Result
  • func (r *Result) String() string

Types

type Allowed

type Allowed struct {
	Modules []string `yaml:"modules"`
	Domains []string `yaml:"domains"`
}

Allowed is a list of modules and module domains that are allowed to be used.

func (*Allowed) IsAllowedModule

func (a *Allowed) IsAllowedModule(module string) bool

IsAllowedModule returns true if the given module name is in the allowed modules list.

func (*Allowed) IsAllowedModuleDomain

func (a *Allowed) IsAllowedModuleDomain(module string) bool

IsAllowedModuleDomain returns true if the given modules domain is in the allowed module domains list.

type Blocked

type Blocked struct {
	Modules BlockedModules `yaml:"modules"`
}

Blocked is a list of modules that are blocked and not to be used.

type BlockedModule

type BlockedModule map[string]Recommendations

BlockedModule is a blocked module name and optionally a list of recommended modules and a reason message.

type BlockedModules

type BlockedModules []BlockedModule

BlockedModules a list of blocked modules.

func (BlockedModules) Get

func (b BlockedModules) Get() []string

Get returns the modules that are blocked.

func (BlockedModules) IsBlockedModule

func (b BlockedModules) IsBlockedModule(module string) bool

IsBlockedModule returns true if the given module name is in the blocked modules list.

func (BlockedModules) IsBlockedPackage

func (b BlockedModules) IsBlockedPackage(pkg string) bool

IsBlockedPackage returns true if the package name is in the blocked modules list.

func (BlockedModules) RecommendedModules

func (b BlockedModules) RecommendedModules(pkg string) *Recommendations

RecommendedModules will return a list of recommended modules for the package provided. If there is no recommendation nil will be returned.

type Configuration

type Configuration struct {
	Allowed Allowed `yaml:"allowed"`
	Blocked Blocked `yaml:"blocked"`
}

Configuration of gomodguard allow and block lists.

type Processor

type Processor struct {
	// contains filtered or unexported fields
}

Processor processes Go files.

func NewProcessor

func NewProcessor(config Configuration, logger *log.Logger) (*Processor, error)

NewProcessor will create a Processor to lint blocked packages.

func (*Processor) ProcessFiles

func (p *Processor) ProcessFiles(filenames []string) []Result

ProcessFiles takes a string slice with file names (full paths) and lints them.

type Recommendations

type Recommendations struct {
	Recommendations []string `yaml:"recommendations"`
	Reason          string   `yaml:"reason"`
}

Recommendations are alternative modules to use and a reason why.

func (*Recommendations) HasRecommendations

func (r *Recommendations) HasRecommendations() bool

HasRecommendations returns true if the blocked package has recommended modules.

func (*Recommendations) IsRecommended

func (r *Recommendations) IsRecommended(pkg string) bool

IsRecommended returns true if the package provided is in the Recommendations list

func (*Recommendations) String

func (r *Recommendations) String() string

String returns the recommended modules and reason message.

type Result

type Result struct {
	FileName   string
	LineNumber int
	Position   token.Position
	Reason     string
}

Result represents the result of one error.

func (*Result) String

func (r *Result) String() string

String returns the filename, line number and reason of a Result.