analyzer.rb

# frozen_string_literal: true

require "bibliothecary"

module Git
  module Pkgs
    class Analyzer
      attr_reader :repository

      # Common manifest file patterns for quick pre-filtering
      # This avoids calling Bibliothecary.identify_manifests for commits that clearly don't touch manifests
      QUICK_MANIFEST_PATTERNS = %w[
        Gemfile Gemfile.lock gems.rb gems.locked *.gemspec
        package.json package-lock.json yarn.lock npm-shrinkwrap.json pnpm-lock.yaml bun.lock npm-ls.json
        setup.py req*.txt req*.pip requirements/*.txt requirements/*.pip requirements*.in requirements.frozen
        Pipfile Pipfile.lock pyproject.toml poetry.lock uv.lock pylock.toml pdm.lock
        pip-resolved-dependencies.txt pip-dependency-graph.json
        pom.xml ivy.xml build.gradle build.gradle.kts gradle-dependencies-q.txt gradle.lockfile verification-metadata.xml
        maven-resolved-dependencies.txt sbt-update-full.txt maven-dependency-tree.txt maven-dependency-tree.dot
        Cargo.toml Cargo.lock
        go.mod go.sum glide.yaml glide.lock Godeps Godeps/Godeps.json
        vendor/manifest vendor/vendor.json Gopkg.toml Gopkg.lock go-resolved-dependencies.json
        composer.json composer.lock
        Podfile Podfile.lock *.podspec *.podspec.json
        packages.config packages.lock.json Project.json Project.lock.json
        *.nuspec paket.lock *.csproj project.assets.json *.deps.json
        bower.json bentofile.yaml
        META.json META.yml cpanfile cpanfile.snapshot Makefile.PL Build.PL
        environment.yml environment.yaml
        cog.yaml versions.json MLmodel DESCRIPTION renv.lock
        pubspec.yaml pubspec.lock
        dub.json dub.sdl
        REQUIRE Project.toml Manifest.toml
        shard.yml shard.lock
        elm-package.json elm_dependencies.json elm-stuff/exact-dependencies.json
        haxelib.json stack.yaml stack.yaml.lock
        action.yml action.yaml .github/workflows/*.yml .github/workflows/*.yaml
        Dockerfile docker-compose*.yml docker-compose*.yaml
        dvc.yaml vcpkg.json _generated-vcpkg-list.json
        Brewfile Brewfile.lock.json
        Modelfile
        deno.json deno.jsonc deno.lock
        conanfile.py conanfile.txt conan.lock
        *.rockspec
        *.nimble
        *.cabal *cabal.config stack.yaml.lock cabal.project.freeze
        Cartfile Cartfile.private Cartfile.resolved
        project.clj
        Package.swift Package.resolved
        mix.exs mix.lock gleam.toml manifest.toml rebar.lock
        flake.nix flake.lock nix/sources.json npins/sources.json
      ].freeze

      QUICK_MANIFEST_REGEX = Regexp.union(
        QUICK_MANIFEST_PATTERNS.map do |pattern|
          if pattern.include?('*')
            Regexp.new(Regexp.escape(pattern).gsub('\\*', '.*'))
          else
            /(?:^|\/)#{Regexp.escape(pattern)}$/
          end
        end
      ).freeze

      def initialize(repository)
        @repository = repository
        @blob_cache = {}
        @manifest_path_cache = {}
        Config.configure_bibliothecary
      end

      def generate_purl(ecosystem, name)
        Ecosystems.generate_purl(ecosystem, name)
      end

      # Quick check if any paths might be manifests (fast regex check)
      def might_have_manifests?(paths)
        paths.any? { |p| p.match?(QUICK_MANIFEST_REGEX) }
      end

      # Cached version of Bibliothecary.identify_manifests
      def identify_manifests_cached(paths)
        uncached = paths.reject { |p| @manifest_path_cache.key?(p) }

        if uncached.any?
          # Call Bibliothecary only for uncached paths
          manifests = Bibliothecary.identify_manifests(uncached)
          manifest_set = manifests.to_set

          uncached.each do |path|
            @manifest_path_cache[path] = manifest_set.include?(path)
          end
        end

        paths.select { |p| @manifest_path_cache[p] }
      end

      # Quick check if a commit touches any manifest files
      def has_manifest_changes?(rugged_commit)
        return false if repository.merge_commit?(rugged_commit)

        blob_paths = repository.blob_paths(rugged_commit)
        all_paths = blob_paths.map { |p| p[:path] }

        return false unless might_have_manifests?(all_paths)

        identify_manifests_cached(all_paths).any?
      end

      def analyze_commit(rugged_commit, previous_snapshot = {})
        return nil if repository.merge_commit?(rugged_commit)

        blob_paths = repository.blob_paths(rugged_commit)

        added_paths = blob_paths.select { |p| p[:status] == :added }.map { |p| p[:path] }
        modified_paths = blob_paths.select { |p| p[:status] == :modified }.map { |p| p[:path] }
        removed_paths = blob_paths.select { |p| p[:status] == :deleted }.map { |p| p[:path] }

        all_paths = added_paths + modified_paths + removed_paths
        return nil unless might_have_manifests?(all_paths)

        added_manifests = identify_manifests_cached(added_paths)
        modified_manifests = identify_manifests_cached(modified_paths)
        removed_manifests = identify_manifests_cached(removed_paths)

        return nil if added_manifests.empty? && modified_manifests.empty? && removed_manifests.empty?

        changes = []
        new_snapshot = previous_snapshot.dup

        # Process added manifest files
        added_manifests.each do |manifest_path|
          result = parse_manifest_at_commit(rugged_commit, manifest_path)
          next unless result && result[:dependencies]

          result[:dependencies].each do |dep|
            changes << {
              manifest_path: manifest_path,
              ecosystem: result[:platform],
              kind: result[:kind],
              name: dep[:name],
              purl: generate_purl(result[:platform], dep[:name]),
              change_type: "added",
              requirement: dep[:requirement],
              dependency_type: dep[:type],
              integrity: dep[:integrity]
            }

            key = [manifest_path, dep[:name]]
            new_snapshot[key] = {
              ecosystem: result[:platform],
              kind: result[:kind],
              purl: generate_purl(result[:platform], dep[:name]),
              requirement: dep[:requirement],
              dependency_type: dep[:type],
              integrity: dep[:integrity]
            }
          end
        end

        # Process modified manifest files
        modified_manifests.each do |manifest_path|
          before_result = parse_manifest_before_commit(rugged_commit, manifest_path)
          after_result = parse_manifest_at_commit(rugged_commit, manifest_path)

          next unless after_result

          before_deps = (before_result&.dig(:dependencies) || []).map { |d| [d[:name], d] }.to_h
          after_deps = (after_result[:dependencies] || []).map { |d| [d[:name], d] }.to_h

          added_names = after_deps.keys - before_deps.keys
          removed_names = before_deps.keys - after_deps.keys
          common_names = after_deps.keys & before_deps.keys

          added_names.each do |name|
            dep = after_deps[name]
            changes << {
              manifest_path: manifest_path,
              ecosystem: after_result[:platform],
              kind: after_result[:kind],
              name: name,
              purl: generate_purl(after_result[:platform], name),
              change_type: "added",
              requirement: dep[:requirement],
              dependency_type: dep[:type],
              integrity: dep[:integrity]
            }

            key = [manifest_path, name]
            new_snapshot[key] = {
              ecosystem: after_result[:platform],
              kind: after_result[:kind],
              purl: generate_purl(after_result[:platform], name),
              requirement: dep[:requirement],
              dependency_type: dep[:type],
              integrity: dep[:integrity]
            }
          end

          removed_names.each do |name|
            dep = before_deps[name]
            changes << {
              manifest_path: manifest_path,
              ecosystem: before_result[:platform],
              kind: before_result[:kind],
              name: name,
              purl: generate_purl(before_result[:platform], name),
              change_type: "removed",
              requirement: dep[:requirement],
              dependency_type: dep[:type],
              integrity: dep[:integrity]
            }

            key = [manifest_path, name]
            new_snapshot.delete(key)
          end

          common_names.each do |name|
            before_dep = before_deps[name]
            after_dep = after_deps[name]

            if before_dep[:requirement] != after_dep[:requirement] || before_dep[:type] != after_dep[:type]
              changes << {
                manifest_path: manifest_path,
                ecosystem: after_result[:platform],
                kind: after_result[:kind],
                name: name,
                purl: generate_purl(after_result[:platform], name),
                change_type: "modified",
                requirement: after_dep[:requirement],
                previous_requirement: before_dep[:requirement],
                dependency_type: after_dep[:type],
                integrity: after_dep[:integrity]
              }

              key = [manifest_path, name]
              new_snapshot[key] = {
                ecosystem: after_result[:platform],
                kind: after_result[:kind],
                purl: generate_purl(after_result[:platform], name),
                requirement: after_dep[:requirement],
                dependency_type: after_dep[:type],
                integrity: after_dep[:integrity]
              }
            end
          end
        end

        # Process removed manifest files
        removed_manifests.each do |manifest_path|
          result = parse_manifest_before_commit(rugged_commit, manifest_path)
          next unless result && result[:dependencies]

          result[:dependencies].each do |dep|
            changes << {
              manifest_path: manifest_path,
              ecosystem: result[:platform],
              kind: result[:kind],
              name: dep[:name],
              purl: generate_purl(result[:platform], dep[:name]),
              change_type: "removed",
              requirement: dep[:requirement],
              dependency_type: dep[:type],
              integrity: dep[:integrity]
            }

            key = [manifest_path, dep[:name]]
            new_snapshot.delete(key)
          end
        end

        {
          changes: changes,
          snapshot: new_snapshot
        }
      end

      # Cache stats for debugging
      def cache_stats
        blob_hits = @blob_cache.values.count { |v| v[:hits] > 0 }
        blob_total = @blob_cache.size
        manifest_paths = @manifest_path_cache.size
        {
          cached_blobs: blob_total,
          blobs_with_hits: blob_hits,
          cached_paths: manifest_paths
        }
      end

      def parse_manifest_at_commit(rugged_commit, manifest_path)
        blob_oid = repository.blob_oid_at_commit(rugged_commit, manifest_path)
        return nil unless blob_oid

        parse_manifest_by_oid(blob_oid, manifest_path)
      end

      def parse_manifest_before_commit(rugged_commit, manifest_path)
        return nil if rugged_commit.parents.empty?

        blob_oid = repository.blob_oid_at_commit(rugged_commit.parents[0], manifest_path)
        return nil unless blob_oid

        parse_manifest_by_oid(blob_oid, manifest_path)
      end

      def parse_manifest_by_oid(blob_oid, manifest_path)
        cache_key = [blob_oid, manifest_path]

        if @blob_cache.key?(cache_key)
          @blob_cache[cache_key][:hits] += 1
          return @blob_cache[cache_key][:result]
        end

        content = repository.blob_content(blob_oid)
        return nil unless content

        result = Bibliothecary.analyse_file(manifest_path, content).first
        result = nil if result && Config.filter_ecosystem?(result[:platform])
        @blob_cache[cache_key] = { result: result, hits: 0 }
        result
      end

      # Parse all manifest files at a given commit (stateless)
      def dependencies_at_commit(rugged_commit)
        deps = []
        manifest_paths = find_manifest_paths_in_tree(rugged_commit.tree)

        manifest_paths.each do |path|
          result = parse_manifest_at_commit(rugged_commit, path)
          next unless result && result[:dependencies]

          result[:dependencies].each do |dep|
            deps << {
              manifest_path: path,
              manifest_kind: result[:kind],
              name: dep[:name],
              ecosystem: result[:platform],
              kind: result[:kind],
              purl: generate_purl(result[:platform], dep[:name]),
              requirement: dep[:requirement],
              dependency_type: dep[:type],
              integrity: dep[:integrity]
            }
          end
        end

        deps
      end

      # Compute changes between two commits (stateless)
      def diff_commits(from_commit, to_commit)
        from_deps = dependencies_at_commit(from_commit).group_by { |d| [d[:manifest_path], d[:name]] }
        to_deps = dependencies_at_commit(to_commit).group_by { |d| [d[:manifest_path], d[:name]] }

        added = []
        modified = []
        removed = []

        # Find added and modified
        to_deps.each do |key, to_list|
          to_dep = to_list.first
          if from_deps[key]
            from_dep = from_deps[key].first
            if from_dep[:requirement] != to_dep[:requirement]
              modified << to_dep.merge(previous_requirement: from_dep[:requirement])
            end
          else
            added << to_dep
          end
        end

        # Find removed
        from_deps.each do |key, from_list|
          removed << from_list.first unless to_deps[key]
        end

        { added: added, modified: modified, removed: removed }
      end

      def find_manifest_paths_in_tree(tree, prefix = "")
        paths = []

        tree.each do |entry|
          full_path = prefix.empty? ? entry[:name] : "#{prefix}/#{entry[:name]}"

          if entry[:type] == :tree
            subtree = repository.lookup(entry[:oid])
            paths.concat(find_manifest_paths_in_tree(subtree, full_path))
          elsif entry[:type] == :blob && full_path.match?(QUICK_MANIFEST_REGEX)
            paths << full_path
          end
        end

        identify_manifests_cached(paths)
      end

      def lookup(oid)
        repository.lookup(oid)
      end

      # Pair manifest dependencies with their corresponding lockfile versions.
      # Groups by directory + ecosystem + name, preferring lockfile over manifest.
      # Can be called as instance method or class method.
      def pair_manifests_with_lockfiles(deps)
        self.class.pair_manifests_with_lockfiles(deps)
      end

      def self.pair_manifests_with_lockfiles(deps)
        # Group by (directory, ecosystem, name)
        groups = {}
        deps.each do |dep|
          dir = File.dirname(dep[:manifest_path])
          dir = "" if dir == "."
          key = [dir, dep[:ecosystem], dep[:name]]
          groups[key] ||= []
          groups[key] << dep
        end

        # For each group, pick the best entry (lockfile preferred)
        groups.values.map do |group_deps|
          lockfile_dep = group_deps.find { |d| d[:manifest_kind] == "lockfile" }
          manifest_dep = group_deps.find { |d| d[:manifest_kind] == "manifest" }

          # Prefer lockfile version, fall back to manifest
          lockfile_dep || manifest_dep || group_deps.first
        end.compact
      end

      # Filter to only lockfile dependencies
      def self.lockfile_dependencies(deps)
        deps.select { |d| d[:manifest_kind] == "lockfile" }
      end
    end
  end
end