Extract licenses from composer.json

[soimkim]

• New Features
  • Added support for recognizing composer.json as a manifest file.
  • Added license extraction from composer.json, including string, array, and SPDX expression formats.
  • Duplicate licenses are removed, while missing or invalid license data is handled gracefully.

[coderabbitai]

📝 Walkthrough

Walkthrough

Composer manifests are now recognized, parsed for license declarations, routed through manifest extraction, and covered by tests for strings, arrays, SPDX expressions, dispatching, case variations, and missing fields.

Changes

Composer manifest support

Layer / File(s)	Summary
Composer detection and extraction src/fosslight_source/_scan_item.py, src/fosslight_source/run_manifest_extractor.py	composer.json is recognized as a manifest, and its string or nested license values are normalized, SPDX-split, deduplicated, and returned through get_manifest_licenses.
Composer extraction validation tests/test_manifest_composer.py	Tests cover manifest detection, license formats, SPDX expressions, dispatcher routing, and missing license fields.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ManifestDispatcher
  participant ComposerExtractor
  participant ComposerJson
  ManifestDispatcher->>ComposerExtractor: Dispatch composer.json
  ComposerExtractor->>ComposerJson: Parse license field
  ComposerJson-->>ComposerExtractor: License values
  ComposerExtractor-->>ManifestDispatcher: Return deduplicated licenses

Loading

Possibly related PRs

• fosslight/fosslight_source_scanner#270: Extends the same manifest recognition and license-dispatch paths for pyproject.toml.

Suggested reviewers: justinwonjaepark

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding license extraction support for composer.json.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch php

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/fosslight_source/run_manifest_extractor.py (1)

83-88: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Narrow the new exception boundaries.

Catching Exception converts unexpected programming errors into [], while the dispatcher adds another broad fallback. Catch only expected file/JSON failures at the appropriate boundary, or let unexpected errors remain visible for diagnosis.

Also applies to: 363-368

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/fosslight_source/run_manifest_extractor.py` around lines 83 - 88, In the
manifest-reading flow around the composer.json loader, replace the broad
Exception handler with catches limited to expected file access and JSON parsing
errors, preserving the existing log-and-empty-list behavior for those failures.
Do not suppress unexpected programming errors; apply the same narrowed exception
boundary to the corresponding handler noted in the comment.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/fosslight_source/run_manifest_extractor.py`:
- Around line 83-88: In the manifest-reading flow around the composer.json
loader, replace the broad Exception handler with catches limited to expected
file access and JSON parsing errors, preserving the existing log-and-empty-list
behavior for those failures. Do not suppress unexpected programming errors;
apply the same narrowed exception boundary to the corresponding handler noted in
the comment.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 29e82bde-c8ba-4cfc-a24a-47d353f76648

📥 Commits

Reviewing files that changed from the base of the PR and between 8c68179 and 1eacc49.

📒 Files selected for processing (3)

• src/fosslight_source/_scan_item.py
• src/fosslight_source/run_manifest_extractor.py
• tests/test_manifest_composer.py