microsoft / microsoft/component-detection

ability to configure that all packages detected in a file our development dependencies

Open
#198 1 comment 0 reactions 0 assignees View on GitHub
status:requirements type:feature
Dominant language
C#
Stars
553
Forks
135
Avg merge
20h 58m
Merged PRs (30d)
6

Description

In Azure for Operators there are many projects that manage development dependencies separately from runtime dependencies, e.g:

- we have projects of many languages that use Python for functional verification tests. In this case the Python dependencies are in a Poetry.lock file and we'd like to be able to indicate that all dependencies found in that file are development dependencies
- some projects using Gradle have separate lockfiles for runtime and development dependencies
- some projects contain example projects in their tests. These examples contain lockfiles, and we'd like to indicate that these are development dependencies rather.

Is this possible today? if not, do you have suggestions on how we could enhance component-detection to support this?

Contributor guide

Open the contributing guide

Research direction

Start by reviewing how component-detection processes Poetry.lock and Gradle lockfiles, including lockfiles in example projects under tests. Define how configuration should mark selected detected packages as development dependencies, then validate the behavior across the described runtime and development lockfile layouts.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, python
Domain
devtools
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.