use yamerl instead

Author: bwireman

gleam.toml

@@ -1,6 +1,5 @@
 name = "go_over"
 version = "0.1.0"
-target = "javascript"
 licences = ["MIT"]
 repository = { type = "github", user = "bwireman", repo = "go-over" }
 description = "Auditor for erlang and elixir dependencies in gleam projects"
@@ -23,6 +22,8 @@ simplifile = ">= 1.7.0 and < 2.0.0"
 filepath = ">= 1.0.0 and < 2.0.0"
 tom = ">= 1.0.0 and < 2.0.0"
 stoiridh_version = ">= 0.1.0 and < 1.0.0"
+yamerl = ">= 0.10.0 and < 1.0.0"
+gleam_erlang = ">= 0.25.0 and < 1.0.0"
 
 [dev-dependencies]
 gleeunit = ">= 1.0.0 and < 2.0.0"

manifest.toml

@@ -3,19 +3,23 @@
 
 packages = [
   { name = "filepath", version = "1.0.0", build_tools = ["gleam"], requirements = ["gleam_stdlib"], otp_app = "filepath", source = "hex", outer_checksum = "EFB6FF65C98B2A16378ABC3EE2B14124168C0CE5201553DE652E2644DCFDB594" },
+  { name = "gleam_erlang", version = "0.25.0", build_tools = ["gleam"], requirements = ["gleam_stdlib"], otp_app = "gleam_erlang", source = "hex", outer_checksum = "054D571A7092D2A9727B3E5D183B7507DAB0DA41556EC9133606F09C15497373" },
   { name = "gleam_stdlib", version = "0.37.0", build_tools = ["gleam"], requirements = [], otp_app = "gleam_stdlib", source = "hex", outer_checksum = "5398BD6C2ABA17338F676F42F404B9B7BABE1C8DC7380031ACB05BBE1BCF3742" },
   { name = "gleeunit", version = "1.1.2", build_tools = ["gleam"], requirements = ["gleam_stdlib"], otp_app = "gleeunit", source = "hex", outer_checksum = "72CDC3D3F719478F26C4E2C5FED3E657AC81EC14A47D2D2DEBB8693CA3220C3B" },
   { name = "shellout", version = "1.6.0", build_tools = ["gleam"], requirements = ["gleam_stdlib"], otp_app = "shellout", source = "hex", outer_checksum = "E2FCD18957F0E9F67E1F497FC9FF57393392F8A9BAEAEA4779541DE7A68DD7E0" },
   { name = "simplifile", version = "1.7.0", build_tools = ["gleam"], requirements = ["filepath", "gleam_stdlib"], otp_app = "simplifile", source = "hex", outer_checksum = "1D5DFA3A2F9319EC85825F6ED88B8E449F381B0D55A62F5E61424E748E7DDEB0" },
   { name = "stoiridh_version", version = "0.1.0", build_tools = ["gleam"], requirements = ["gleam_stdlib"], otp_app = "stoiridh_version", source = "hex", outer_checksum = "298ABEA44DF37764A34C2E9190A84BF2770BC59DD9397C6DC7708040E5A0142B" },
   { name = "tom", version = "1.0.0", build_tools = ["gleam"], requirements = ["gleam_stdlib"], otp_app = "tom", source = "hex", outer_checksum = "A5364613E3DBF77F38EFF81DA9F99324086D029EC2B2D44348762FBE38602311" },
+  { name = "yamerl", version = "0.10.0", build_tools = ["rebar3"], requirements = [], otp_app = "yamerl", source = "hex", outer_checksum = "346ADB2963F1051DC837A2364E4ACF6EB7D80097C0F53CBDC3046EC8EC4B4E6E" },
 ]
 
 [requirements]
 filepath = { version = ">= 1.0.0 and < 2.0.0" }
+gleam_erlang = { version = ">= 0.25.0 and < 1.0.0"}
 gleam_stdlib = { version = ">= 0.34.0 and < 2.0.0" }
 gleeunit = { version = ">= 1.0.0 and < 2.0.0" }
 shellout = { version = ">= 1.6.0 and < 2.0.0" }
 simplifile = { version = ">= 1.7.0 and < 2.0.0" }
 stoiridh_version = { version = ">= 0.1.0 and < 1.0.0" }
 tom = { version = ">= 1.0.0 and < 2.0.0" }
+yamerl = { version = ">= 0.10.0 and < 1.0.0" }

package.json

@@ -29,7 +29,6 @@ function publish {
     git push origin "$VER"
     echo "Publishing to Hex" "$VER"
     HEX_API_KEY=$(cat key._) gleam publish
-    yarn publish
     echo "🚀"
 }
 

scripts/publish.sh

@@ -3,32 +3,14 @@ import gleam/list
 import gleam/option
 import gleam/string
 import go_over/comparisons
+import go_over/yaml
 import shellout
 import simplifile
 import stoiridh/version.{type Version}
 import tom
 
-type YamlADV
-
-@external(javascript, "./../yaml.mjs", "readADV")
-fn parse(path: String) -> YamlADV
-
-@external(javascript, "./../yaml.mjs", "name")
-fn name(y: YamlADV) -> String
-
-@external(javascript, "./../yaml.mjs", "first_patched_versions")
-fn first_patched_versions(y: YamlADV) -> List(String)
-
-@external(javascript, "./../yaml.mjs", "vulnerable_version_ranges")
-fn vulnerable_version_ranges(y: YamlADV) -> List(String)
-
 pub type ADV {
-  ADV(
-    name: String,
-    first_patched_versions: List(String),
-    vulnerable_version_ranges: List(String),
-    file: String,
-  )
+  ADV(name: String, vulnerable_version_ranges: List(String), file: String)
 }
 
 fn path() -> String {
@@ -61,14 +43,8 @@ fn read_manifest(path: String) {
 }
 
 fn read_adv(path: String) {
-  let assert Ok(contents) = simplifile.read(path)
-  let parsed = parse(contents)
-  ADV(
-    name(parsed),
-    first_patched_versions(parsed),
-    vulnerable_version_ranges(parsed),
-    path,
-  )
+  let #(name, vulnerable_version_ranges) = yaml.parse(path)
+  ADV(name, vulnerable_version_ranges, path)
 }
 
 fn read_all_adv() {

scripts/update.sh

@@ -0,0 +1,12 @@
+import gleam/erlang
+import gleam/erlang/atom
+
+pub fn start() {
+  erlang.ensure_all_started(atom.create_from_string("yamerl"))
+}
+
+@external(erlang, "yamll", "parse")
+pub fn parse(path: String) -> #(String, List(String))
+
+
+

src/go_over/advisories.gleam

@@ -0,0 +1,12 @@
+-module(yamll).
+
+-export([
+    parse/1
+]).
+
+
+parse(Path) -> 
+    [Content] = yamerl:decode_file(Path),
+    Name = lists:keyfind("package", 1, Content),
+    Vulnerable_version_ranges = lists:keyfind("vulnerable_version_ranges", 1, Content),
+    {Name, Vulnerable_version_ranges}.