microsoft / microsoft/component-detection
ability to configure that all packages detected in a file our development dependencies
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
In Azure for Operators there are many projects that manage development dependencies separately from runtime dependencies, e.g:
- we have projects of many languages that use Python for functional verification tests. In this case the Python dependencies are in a Poetry.lock file and we'd like to be able to indicate that all dependencies found in that file are development dependencies
- some projects using Gradle have separate lockfiles for runtime and development dependencies
- some projects contain example projects in their tests. These examples contain lockfiles, and we'd like to indicate that these are development dependencies rather.
Is this possible today? if not, do you have suggestions on how we could enhance component-detection to support this?
Contributor guide
Research direction
Start by reviewing how component-detection processes Poetry.lock and Gradle lockfiles, including lockfiles in example projects under tests. Define how configuration should mark selected detected packages as development dependencies, then validate the behavior across the described runtime and development lockfile layouts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, python
- Domain
- devtools
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100