Skip to main content

provenant/parsers/
conda.rs

1// SPDX-FileCopyrightText: Provenant contributors
2// SPDX-License-Identifier: Apache-2.0
3
4//! Parser for Conda/Anaconda package manifest files.
5//!
6//! Extracts package metadata and dependencies from Conda ecosystem manifest files
7//! supporting both recipe definitions and environment specifications.
8//!
9//! # Supported Formats
10//! - meta.yaml (Conda recipe metadata with Jinja2 templating support)
11//! - conda.yaml/environment.yml (Conda environment dependency specifications)
12//!
13//! # Key Features
14//! - YAML parsing for environment files
15//! - Dependency extraction from dependencies and build_requirements sections
16//! - Channel specification and platform detection
17//! - Version constraint parsing for Conda version specifiers
18//! - Package URL (purl) generation for conda packages
19//! - Limited meta.yaml support (note: Jinja2 templating not fully resolved)
20//!
21//! # Implementation Notes
22//! - Uses YAML parsing via `yaml_serde`
23//! - meta.yaml: Jinja2 templates not evaluated (use rendered YAML if available)
24//! - environment.yml: Full dependency specification support
25//! - Graceful error handling with `warn!()` logs
26//!
27//! # References
28//! - <https://docs.conda.io/projects/conda-build/en/latest/resources/define-metadata.html>
29//! - <https://docs.conda.io/projects/conda/en/latest/user-guide/tasks/manage-environments.html>
30
31use std::collections::HashMap;
32use std::path::Path;
33
34use crate::parser_warn as warn;
35use crate::parsers::utils::{MAX_ITERATION_COUNT, read_file_to_string, truncate_field};
36use regex::Regex;
37use yaml_serde::Value;
38
39use crate::models::{DatasourceId, Dependency, PackageData, PackageType, Sha256Digest};
40
41use super::PackageParser;
42use super::license_normalization::{
43    DeclaredLicenseMatchMetadata, build_declared_license_data_from_pair,
44    normalize_spdx_declared_license,
45};
46
47fn default_package_data(datasource_id: Option<DatasourceId>) -> PackageData {
48    PackageData {
49        package_type: Some(CondaMetaYamlParser::PACKAGE_TYPE),
50        datasource_id,
51        ..Default::default()
52    }
53}
54
55fn is_conda_recipe_yaml_path(path: &Path) -> bool {
56    let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
57        return false;
58    };
59    if name != "recipe.yaml" && name != "recipe.yml" {
60        return false;
61    }
62    path.parent()
63        .and_then(|parent| parent.file_name())
64        .and_then(|name| name.to_str())
65        .is_some_and(|name| name == "recipe")
66}
67
68/// Build a PURL (Package URL) for Conda or PyPI packages
69pub(crate) fn build_purl(
70    package_type: &str,
71    namespace: Option<&str>,
72    name: &str,
73    version: Option<&str>,
74    _qualifiers: Option<&str>,
75    _subpath: Option<&str>,
76    _extras: Option<&str>,
77) -> Option<String> {
78    let purl = match package_type {
79        "conda" => {
80            if let Some(ns) = namespace {
81                match version {
82                    Some(v) => format!("pkg:conda/{}/{}@{}", ns, name, v),
83                    None => format!("pkg:conda/{}/{}", ns, name),
84                }
85            } else {
86                match version {
87                    Some(v) => format!("pkg:conda/{}@{}", name, v),
88                    None => format!("pkg:conda/{}", name),
89                }
90            }
91        }
92        "pypi" => match version {
93            Some(v) => format!("pkg:pypi/{}@{}", name, v),
94            None => format!("pkg:pypi/{}", name),
95        },
96        _ => format!("pkg:{}/{}", package_type, name),
97    };
98    Some(purl)
99}
100
101fn build_conda_package_purl(name: Option<&str>, version: Option<&str>) -> Option<String> {
102    let name = name?;
103    build_purl("conda", None, name, version, None, None, None)
104}
105
106fn yaml_value_to_string(value: &Value) -> Option<String> {
107    match value {
108        Value::String(s) => Some(truncate_field(s.clone())),
109        Value::Number(n) => Some(truncate_field(n.to_string())),
110        Value::Bool(b) => Some(truncate_field(b.to_string())),
111        _ => None,
112    }
113}
114
115fn extract_jinja_statement(trimmed_line: &str) -> Option<&str> {
116    if !trimmed_line.starts_with("{%") {
117        return None;
118    }
119
120    let end = trimmed_line.find("%}")?;
121    Some(trimmed_line[2..end].trim())
122}
123
124fn extract_conda_requirement_name(req: &str) -> Option<String> {
125    let req = req.trim();
126    if req.is_empty() {
127        return None;
128    }
129
130    let req_without_ns = req.rsplit_once("::").map(|(_, rest)| rest).unwrap_or(req);
131
132    let name = req_without_ns
133        .split_whitespace()
134        .next()
135        .unwrap_or(req_without_ns)
136        .split(['=', '<', '>', '!', '~'])
137        .next()
138        .unwrap_or(req_without_ns)
139        .trim();
140
141    if name.is_empty() {
142        None
143    } else {
144        Some(truncate_field(name.to_string()))
145    }
146}
147
148/// Conda recipe manifest (meta.yaml) parser.
149///
150/// Extracts package metadata and dependencies from Conda recipe files, which
151/// define how to build a Conda package. Handles Jinja2 templating used in
152/// recipe files for variable substitution.
153pub struct CondaMetaYamlParser;
154
155impl PackageParser for CondaMetaYamlParser {
156    const PACKAGE_TYPE: PackageType = PackageType::Conda;
157
158    fn is_match(path: &Path) -> bool {
159        // Match */meta.yaml following Python reference logic
160        path.file_name()
161            .is_some_and(|name| name == "meta.yaml" || name == "meta.yml")
162            || is_conda_recipe_yaml_path(path)
163    }
164
165    fn extract_packages(path: &Path) -> Vec<PackageData> {
166        let contents = match read_file_to_string(path, None) {
167            Ok(c) => c,
168            Err(e) => {
169                warn!("Failed to read {}: {}", path.display(), e);
170                return vec![default_package_data(Some(DatasourceId::CondaMetaYaml))];
171            }
172        };
173
174        if is_conda_recipe_yaml_path(path) {
175            let yaml: Value = match yaml_serde::from_str(&contents) {
176                Ok(y) => y,
177                Err(e) => {
178                    warn!("Failed to parse YAML in {}: {}", path.display(), e);
179                    return vec![default_package_data(Some(DatasourceId::CondaMetaYaml))];
180                }
181            };
182
183            if !looks_like_conda_recipe_yaml(&yaml) {
184                return Vec::new();
185            }
186
187            return vec![parse_conda_recipe_yaml(&yaml)];
188        }
189
190        // Extract Jinja2 variables and apply crude substitution
191        let variables = extract_jinja2_variables(&contents);
192        let processed_yaml = apply_jinja2_substitutions(&contents, &variables);
193
194        // Parse YAML after Jinja2 processing
195        let yaml: Value = match yaml_serde::from_str(&processed_yaml) {
196            Ok(y) => y,
197            Err(e) => {
198                warn!("Failed to parse YAML in {}: {}", path.display(), e);
199                return vec![default_package_data(Some(DatasourceId::CondaMetaYaml))];
200            }
201        };
202
203        let package_element = yaml.get("package").and_then(|v| v.as_mapping());
204        let name = package_element
205            .and_then(|p| p.get("name"))
206            .and_then(yaml_value_to_string);
207
208        let version = package_element
209            .and_then(|p| p.get("version"))
210            .and_then(yaml_value_to_string);
211
212        let source = yaml.get("source").and_then(|v| v.as_mapping());
213        let download_url = source
214            .and_then(|s| s.get("url"))
215            .and_then(|v| v.as_str())
216            .map(|s| truncate_field(s.to_string()));
217
218        let sha256 = source
219            .and_then(|s| s.get("sha256"))
220            .and_then(|v| v.as_str())
221            .and_then(|s| Sha256Digest::from_hex(s).ok());
222
223        let about = yaml.get("about").and_then(|v| v.as_mapping());
224        let homepage_url = about
225            .and_then(|a| a.get("home"))
226            .and_then(|v| v.as_str())
227            .map(|s| truncate_field(s.to_string()));
228
229        let extracted_license_statement = about
230            .and_then(|a| a.get("license"))
231            .and_then(|v| v.as_str())
232            .map(|s| truncate_field(s.to_string()));
233        let (declared_license_expression, declared_license_expression_spdx, license_detections) =
234            normalize_conda_declared_license(extracted_license_statement.as_deref());
235
236        let description = about
237            .and_then(|a| a.get("summary"))
238            .and_then(|v| v.as_str())
239            .map(|s| truncate_field(s.to_string()));
240
241        let vcs_url = about
242            .and_then(|a| a.get("dev_url"))
243            .and_then(|v| v.as_str())
244            .map(|s| truncate_field(s.to_string()));
245        let license_file = about
246            .and_then(|a| a.get("license_file"))
247            .and_then(|v| v.as_str())
248            .map(str::trim)
249            .filter(|value| !value.is_empty())
250            .map(|s| truncate_field(s.to_string()));
251
252        // Extract dependencies from requirements sections
253        let mut dependencies = Vec::new();
254        let mut extra_data: HashMap<String, serde_json::Value> = HashMap::new();
255
256        if let Some(requirements) = yaml.get("requirements").and_then(|v| v.as_mapping()) {
257            for (scope_key, reqs_value) in requirements {
258                let scope = scope_key.as_str().unwrap_or("unknown");
259                if let Some(reqs) = reqs_value.as_sequence() {
260                    for req in reqs.iter().take(MAX_ITERATION_COUNT) {
261                        if let Some(req_str) = req.as_str()
262                            && let Some(dep) = parse_conda_requirement(req_str, scope)
263                        {
264                            // Filter out pip/python from dependencies, add to extra_data
265                            if extract_conda_requirement_name(req_str)
266                                .is_some_and(|n| n == "pip" || n == "python")
267                            {
268                                if let Some(arr) = extra_data
269                                    .entry(scope.to_string())
270                                    .or_insert_with(|| serde_json::Value::Array(vec![]))
271                                    .as_array_mut()
272                                {
273                                    arr.push(serde_json::Value::String(truncate_field(
274                                        req_str.to_string(),
275                                    )))
276                                }
277                            } else {
278                                dependencies.push(dep);
279                            }
280                        }
281                    }
282                }
283            }
284        }
285
286        let mut pkg = default_package_data(Some(DatasourceId::CondaMetaYaml));
287        pkg.package_type = Some(Self::PACKAGE_TYPE);
288        pkg.datasource_id = Some(DatasourceId::CondaMetaYaml);
289        pkg.name = name;
290        pkg.version = version;
291        pkg.purl = build_conda_package_purl(pkg.name.as_deref(), pkg.version.as_deref());
292        pkg.download_url = download_url;
293        pkg.homepage_url = homepage_url;
294        pkg.declared_license_expression = declared_license_expression.map(truncate_field);
295        pkg.declared_license_expression_spdx = declared_license_expression_spdx.map(truncate_field);
296        pkg.license_detections = license_detections;
297        pkg.extracted_license_statement = extracted_license_statement.map(truncate_field);
298        pkg.description = description;
299        pkg.vcs_url = vcs_url;
300        pkg.sha256 = sha256;
301        pkg.dependencies = dependencies;
302        if let Some(license_file) = license_file {
303            extra_data.insert(
304                "license_file".to_string(),
305                serde_json::Value::String(license_file),
306            );
307        }
308        if !extra_data.is_empty() {
309            pkg.extra_data = Some(extra_data);
310        }
311        vec![pkg]
312    }
313}
314
315fn looks_like_conda_recipe_yaml(yaml: &Value) -> bool {
316    yaml.get("schema_version")
317        .and_then(|value| value.as_u64())
318        .is_some_and(|value| value == 1)
319        && (yaml
320            .get("package")
321            .and_then(|value| value.as_mapping())
322            .is_some()
323            || yaml
324                .get("recipe")
325                .and_then(|value| value.as_mapping())
326                .is_some())
327}
328
329fn parse_conda_recipe_yaml(yaml: &Value) -> PackageData {
330    let context = extract_recipe_yaml_context(yaml);
331    let package = yaml
332        .get("package")
333        .or_else(|| yaml.get("recipe"))
334        .and_then(|value| value.as_mapping());
335    let source = yaml.get("source").and_then(|value| value.as_mapping());
336    let about = yaml.get("about").and_then(|value| value.as_mapping());
337
338    let name = package
339        .and_then(|pkg| pkg.get("name"))
340        .and_then(|value| recipe_yaml_value_to_string(value, &context));
341    let version = package
342        .and_then(|pkg| pkg.get("version"))
343        .and_then(|value| recipe_yaml_value_to_string(value, &context));
344
345    let download_url = source
346        .and_then(|src| src.get("url"))
347        .and_then(|value| recipe_yaml_value_to_string(value, &context));
348    let sha256 = source
349        .and_then(|src| src.get("sha256"))
350        .and_then(|value| recipe_yaml_value_to_string(value, &context))
351        .and_then(|value| Sha256Digest::from_hex(&value).ok());
352
353    let extracted_license_statement = about
354        .and_then(|section| section.get("license"))
355        .and_then(|value| recipe_yaml_value_to_string(value, &context));
356    let (declared_license_expression, declared_license_expression_spdx, license_detections) =
357        normalize_conda_declared_license(extracted_license_statement.as_deref());
358
359    let description = about
360        .and_then(|section| section.get("summary"))
361        .and_then(|value| recipe_yaml_value_to_string(value, &context));
362    let homepage_url = about
363        .and_then(|section| section.get("homepage").or_else(|| section.get("home")))
364        .and_then(|value| recipe_yaml_value_to_string(value, &context));
365    let vcs_url = about
366        .and_then(|section| {
367            section
368                .get("repository")
369                .or_else(|| section.get("dev_url"))
370                .or_else(|| section.get("repository_url"))
371        })
372        .and_then(|value| recipe_yaml_value_to_string(value, &context));
373    let documentation_url = about
374        .and_then(|section| section.get("documentation"))
375        .and_then(|value| recipe_yaml_value_to_string(value, &context));
376    let license_file = about
377        .and_then(|section| section.get("license_file"))
378        .and_then(|value| recipe_yaml_value_to_string(value, &context));
379
380    let mut dependencies = Vec::new();
381    let mut extra_data: HashMap<String, serde_json::Value> = HashMap::new();
382    if let Some(requirements) = yaml
383        .get("requirements")
384        .and_then(|value| value.as_mapping())
385    {
386        for (scope_key, reqs_value) in requirements {
387            let Some(scope) = scope_key.as_str() else {
388                continue;
389            };
390            let recipe_requirements = extract_recipe_yaml_requirement_strings(reqs_value, &context);
391            if recipe_requirements.is_empty() {
392                continue;
393            }
394
395            for req in &recipe_requirements {
396                if extract_conda_requirement_name(req)
397                    .is_some_and(|name| name == "pip" || name == "python")
398                {
399                    if let Some(arr) = extra_data
400                        .entry(scope.to_string())
401                        .or_insert_with(|| serde_json::Value::Array(vec![]))
402                        .as_array_mut()
403                    {
404                        arr.push(serde_json::Value::String(truncate_field(req.clone())));
405                    }
406                    continue;
407                }
408
409                if let Some(dep) = parse_conda_requirement(req, scope) {
410                    dependencies.push(dep);
411                }
412            }
413        }
414    }
415
416    if let Some(documentation_url) = documentation_url {
417        extra_data.insert(
418            "documentation".to_string(),
419            serde_json::Value::String(documentation_url),
420        );
421    }
422    if let Some(license_file) = license_file {
423        extra_data.insert(
424            "license_file".to_string(),
425            serde_json::Value::String(license_file),
426        );
427    }
428    extra_data.insert("schema_version".to_string(), serde_json::json!(1));
429
430    let mut pkg = default_package_data(Some(DatasourceId::CondaMetaYaml));
431    pkg.package_type = Some(CondaMetaYamlParser::PACKAGE_TYPE);
432    pkg.datasource_id = Some(DatasourceId::CondaMetaYaml);
433    pkg.name = name;
434    pkg.version = version;
435    pkg.purl = build_conda_package_purl(pkg.name.as_deref(), pkg.version.as_deref());
436    pkg.download_url = download_url;
437    pkg.homepage_url = homepage_url;
438    pkg.declared_license_expression = declared_license_expression.map(truncate_field);
439    pkg.declared_license_expression_spdx = declared_license_expression_spdx.map(truncate_field);
440    pkg.license_detections = license_detections;
441    pkg.extracted_license_statement = extracted_license_statement.map(truncate_field);
442    pkg.description = description;
443    pkg.vcs_url = vcs_url;
444    pkg.sha256 = sha256;
445    pkg.dependencies = dependencies;
446    pkg.extra_data = Some(extra_data);
447    pkg
448}
449
450fn extract_recipe_yaml_context(yaml: &Value) -> HashMap<String, String> {
451    let mut context = HashMap::new();
452    let Some(context_mapping) = yaml.get("context").and_then(|value| value.as_mapping()) else {
453        return context;
454    };
455
456    for (key, value) in context_mapping {
457        let Some(key) = key.as_str() else {
458            continue;
459        };
460        if let Some(value) = yaml_value_to_string(value) {
461            context.insert(truncate_field(key.to_string()), truncate_field(value));
462        }
463    }
464
465    context
466}
467
468fn recipe_yaml_value_to_string(value: &Value, context: &HashMap<String, String>) -> Option<String> {
469    let value = yaml_value_to_string(value)?;
470    Some(resolve_recipe_yaml_expressions(&value, context))
471}
472
473fn resolve_recipe_yaml_expressions(value: &str, context: &HashMap<String, String>) -> String {
474    let Some(re) = Regex::new(r#"\$\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}"#).ok() else {
475        return truncate_field(value.to_string());
476    };
477
478    let resolved = re.replace_all(value, |caps: &regex::Captures| {
479        context
480            .get(&caps[1])
481            .cloned()
482            .unwrap_or_else(|| caps[0].to_string())
483    });
484    truncate_field(resolved.into_owned())
485}
486
487fn extract_recipe_yaml_requirement_strings(
488    value: &Value,
489    context: &HashMap<String, String>,
490) -> Vec<String> {
491    let mut requirements = Vec::new();
492    collect_recipe_yaml_requirement_strings(value, context, &mut requirements);
493    requirements
494}
495
496fn collect_recipe_yaml_requirement_strings(
497    value: &Value,
498    context: &HashMap<String, String>,
499    requirements: &mut Vec<String>,
500) {
501    if let Some(req) = value.as_str() {
502        let resolved = resolve_recipe_yaml_expressions(req, context);
503        if should_keep_recipe_yaml_requirement(&resolved) {
504            requirements.push(resolved);
505        }
506        return;
507    }
508
509    if let Some(items) = value.as_sequence() {
510        for item in items.iter().take(MAX_ITERATION_COUNT) {
511            collect_recipe_yaml_requirement_strings(item, context, requirements);
512        }
513        return;
514    }
515
516    if let Some(mapping) = value.as_mapping() {
517        if let Some(then_value) = mapping.get("then") {
518            collect_recipe_yaml_requirement_strings(then_value, context, requirements);
519        }
520        if let Some(else_value) = mapping.get("else") {
521            collect_recipe_yaml_requirement_strings(else_value, context, requirements);
522        }
523    }
524}
525
526fn should_keep_recipe_yaml_requirement(req: &str) -> bool {
527    let trimmed = req.trim();
528    if trimmed.is_empty() {
529        return false;
530    }
531
532    !(trimmed.contains("${{")
533        || trimmed.contains("compiler('")
534        || trimmed.contains("compiler(\"")
535        || trimmed.contains("pin_subpackage(")
536        || trimmed.contains("pin_compatible(")
537        || trimmed.contains("stdlib('")
538        || trimmed.contains("stdlib(\""))
539}
540
541fn normalize_conda_declared_license(
542    statement: Option<&str>,
543) -> (
544    Option<String>,
545    Option<String>,
546    Vec<crate::models::LicenseDetection>,
547) {
548    match statement.map(str::trim).filter(|value| !value.is_empty()) {
549        Some("Apache Software") => build_declared_license_data_from_pair(
550            "apache-2.0",
551            "Apache-2.0",
552            DeclaredLicenseMatchMetadata::single_line("Apache Software"),
553        ),
554        Some("BSD-3-Clause") => build_declared_license_data_from_pair(
555            "bsd-new",
556            "BSD-3-Clause",
557            DeclaredLicenseMatchMetadata::single_line("BSD-3-Clause"),
558        ),
559        other => normalize_spdx_declared_license(other),
560    }
561}
562
563/// Conda environment file (environment.yml, conda.yaml) parser.
564///
565/// Extracts dependencies from Conda environment files used to define reproducible
566/// environments. Supports both Conda and pip dependencies, with channel specifications.
567pub struct CondaEnvironmentYmlParser;
568
569impl PackageParser for CondaEnvironmentYmlParser {
570    const PACKAGE_TYPE: PackageType = PackageType::Conda;
571
572    fn is_match(path: &Path) -> bool {
573        // Python reference: path_patterns = ('*conda*.yaml', '*env*.yaml', '*environment*.yaml')
574        if let Some(name) = path.file_name().and_then(|n| n.to_str()) {
575            let lower = name.to_lowercase();
576            (lower.contains("conda") || lower.contains("env") || lower.contains("environment"))
577                && (lower.ends_with(".yaml") || lower.ends_with(".yml"))
578        } else {
579            false
580        }
581    }
582
583    fn extract_packages(path: &Path) -> Vec<PackageData> {
584        let contents = match read_file_to_string(path, None) {
585            Ok(c) => c,
586            Err(e) => {
587                warn!("Failed to read {}: {}", path.display(), e);
588                return vec![default_package_data(Some(DatasourceId::CondaYaml))];
589            }
590        };
591
592        let yaml: Value = match yaml_serde::from_str(&contents) {
593            Ok(y) => y,
594            Err(e) => {
595                warn!("Failed to parse YAML in {}: {}", path.display(), e);
596                return vec![default_package_data(Some(DatasourceId::CondaYaml))];
597            }
598        };
599
600        if !looks_like_conda_environment_yaml(&yaml) {
601            return Vec::new();
602        }
603
604        let name = yaml
605            .get("name")
606            .and_then(|v| v.as_str())
607            .map(|s| truncate_field(s.to_string()));
608
609        let dependencies = extract_environment_dependencies(&yaml);
610
611        let mut extra_data = HashMap::new();
612        if let Some(channels) = yaml.get("channels").and_then(|v| v.as_sequence()) {
613            let channels_vec: Vec<String> = channels
614                .iter()
615                .filter_map(|c| c.as_str().map(|s| truncate_field(s.to_string())))
616                .collect();
617            if !channels_vec.is_empty() {
618                extra_data.insert("channels".to_string(), serde_json::json!(channels_vec));
619            }
620        }
621
622        // Environment files are private (not published packages)
623        let mut pkg = default_package_data(Some(DatasourceId::CondaYaml));
624        pkg.package_type = Some(Self::PACKAGE_TYPE);
625        pkg.datasource_id = Some(DatasourceId::CondaYaml);
626        pkg.name = name;
627        pkg.purl = build_conda_package_purl(pkg.name.as_deref(), pkg.version.as_deref());
628        pkg.primary_language = Some(truncate_field("Python".to_string()));
629        pkg.dependencies = dependencies;
630        pkg.is_private = true;
631        if !extra_data.is_empty() {
632            pkg.extra_data = Some(extra_data);
633        }
634        vec![pkg]
635    }
636}
637
638fn looks_like_conda_environment_yaml(yaml: &Value) -> bool {
639    let has_dependencies = yaml
640        .get("dependencies")
641        .and_then(|value| value.as_sequence())
642        .is_some_and(|items| !items.is_empty());
643    let has_channels = yaml
644        .get("channels")
645        .and_then(|value| value.as_sequence())
646        .is_some_and(|items| !items.is_empty());
647    let has_prefix = yaml
648        .get("prefix")
649        .and_then(|value| value.as_str())
650        .is_some_and(|value| !value.trim().is_empty());
651
652    has_dependencies || has_channels || has_prefix
653}
654
655/// Extract Jinja2-style variables from a Conda meta.yaml
656///
657/// Example:
658/// ```ignore
659/// {% set version = "0.45.0" %}
660/// {% set sha256 = "abc123..." %}
661/// ```
662pub fn extract_jinja2_variables(content: &str) -> HashMap<String, String> {
663    let mut variables = HashMap::new();
664
665    for line in content.lines().take(MAX_ITERATION_COUNT) {
666        let trimmed = line.trim();
667        if let Some(inner) = extract_jinja_statement(trimmed)
668            && let Some(inner) = inner.strip_prefix("set").map(str::trim)
669            && let Some((key, value)) = inner.split_once('=')
670        {
671            let key = key.trim();
672            let value = value.trim().trim_matches('"').trim_matches('\'');
673            variables.insert(
674                truncate_field(key.to_string()),
675                truncate_field(value.to_string()),
676            );
677        }
678    }
679
680    variables
681}
682
683/// Apply Jinja2 variable substitutions to YAML content
684///
685/// Supports:
686/// - `{{ variable }}` - Simple substitution
687/// - `{{ variable|lower }}` - Lowercase filter
688pub fn apply_jinja2_substitutions(content: &str, variables: &HashMap<String, String>) -> String {
689    let mut result = Vec::new();
690
691    for line in content.lines() {
692        let trimmed = line.trim();
693
694        if extract_jinja_statement(trimmed).is_some() {
695            continue;
696        }
697
698        let mut processed_line = line.to_string();
699
700        // Apply variable substitutions
701        if line.contains("{{") && line.contains("}}") {
702            for (var_name, var_value) in variables {
703                // Handle |lower filter
704                let pattern_lower = format!("{{{{ {}|lower }}}}", var_name);
705                if processed_line.contains(&pattern_lower) {
706                    processed_line =
707                        processed_line.replace(&pattern_lower, &var_value.to_lowercase());
708                }
709
710                // Handle normal substitution
711                let pattern_normal = format!("{{{{ {} }}}}", var_name);
712                processed_line = processed_line.replace(&pattern_normal, var_value);
713            }
714        }
715
716        // Skip lines with unresolved Jinja2 templates (complex expressions we can't handle)
717        if processed_line.contains("{{") {
718            continue;
719        }
720
721        result.push(processed_line);
722    }
723
724    quote_plain_numeric_version_scalars(&result.join("\n"))
725}
726
727fn quote_plain_numeric_version_scalars(content: &str) -> String {
728    let Some(version_re) =
729        Regex::new(r#"^(\s*(?:-\s*)?version:\s*)([0-9]+(?:\.[0-9]+)+)(\s*)$"#).ok()
730    else {
731        return content.to_string();
732    };
733
734    content
735        .lines()
736        .map(|line| {
737            version_re
738                .replace(line, |caps: &regex::Captures| {
739                    format!(r#"{}"{}"{}"#, &caps[1], &caps[2], &caps[3])
740                })
741                .into_owned()
742        })
743        .collect::<Vec<_>>()
744        .join("\n")
745}
746
747/// Parse a Conda requirement string into a Dependency
748///
749/// Format examples:
750/// - `mccortex ==1.0` - Pinned version with space before operator
751/// - `python >=3.6` - Version constraint
752/// - `conda-forge::numpy=1.15.4` - Namespace and pinned version (no space)
753/// - `bwa` - No version specified
754pub fn parse_conda_requirement(req: &str, scope: &str) -> Option<Dependency> {
755    let req = req.trim();
756
757    // Handle namespace prefix (conda-forge::package)
758    let (namespace, channel_url, req_without_ns) = parse_conda_channel_prefix(req);
759
760    // Split on first space to separate name from version constraint
761    let (name_part, version_constraint) =
762        if let Some((name, constraint)) = req_without_ns.split_once(' ') {
763            (name.trim(), Some(constraint.trim()))
764        } else {
765            (req_without_ns, None)
766        };
767
768    // Check for pinned version with `=` (no space): package=1.0
769    let (name, version, is_pinned, extracted_requirement) = if name_part.contains('=') {
770        let parts: Vec<&str> = name_part.splitn(2, '=').collect();
771        let n = parts[0].trim();
772        let v = if parts.len() > 1 {
773            let parsed = parts[1].trim();
774            if parsed.is_empty() {
775                None
776            } else {
777                Some(truncate_field(parsed.to_string()))
778            }
779        } else {
780            None
781        };
782        let req = v
783            .as_ref()
784            .map(|ver| format!("={}", ver))
785            .unwrap_or_default();
786        (n, v, true, Some(truncate_field(req)))
787    } else if let Some(constraint) = version_constraint {
788        let version_opt = if constraint.starts_with("==") {
789            Some(truncate_field(
790                constraint.trim_start_matches("==").trim().to_string(),
791            ))
792        } else {
793            None
794        };
795        (
796            name_part.trim(),
797            version_opt,
798            false,
799            Some(truncate_field(constraint.to_string())),
800        )
801    } else {
802        (name_part.trim(), None, false, Some(String::new()))
803    };
804
805    // Build PURL
806    let purl = build_purl(
807        "conda",
808        namespace,
809        name,
810        version.as_deref(),
811        None,
812        None,
813        None,
814    );
815
816    // Determine is_runtime and is_optional based on scope
817    let (is_runtime, is_optional) = match scope {
818        "run" => (true, false),
819        _ => (false, true), // build, host, test are all optional
820    };
821
822    let mut extra_data = HashMap::new();
823    if let Some(namespace) = namespace {
824        extra_data.insert(
825            "channel".to_string(),
826            serde_json::json!(truncate_field(namespace.to_string())),
827        );
828    }
829    if let Some(channel_url) = channel_url {
830        extra_data.insert(
831            "channel_url".to_string(),
832            serde_json::json!(truncate_field(channel_url.to_string())),
833        );
834    }
835
836    Some(Dependency {
837        purl,
838        extracted_requirement,
839        scope: Some(truncate_field(scope.to_string())),
840        is_runtime: Some(is_runtime),
841        is_optional: Some(is_optional),
842        is_pinned: Some(is_pinned),
843        is_direct: Some(true),
844        resolved_package: None,
845        extra_data: (!extra_data.is_empty()).then_some(extra_data),
846    })
847}
848
849fn extract_environment_dependencies(yaml: &Value) -> Vec<Dependency> {
850    let dependencies = match yaml.get("dependencies").and_then(|v| v.as_sequence()) {
851        Some(d) => d,
852        None => return Vec::new(),
853    };
854
855    let mut deps = Vec::new();
856    for dep_value in dependencies.iter().take(MAX_ITERATION_COUNT) {
857        if let Some(dep_str) = dep_value.as_str() {
858            if let Some(dep) = parse_environment_string_dependency(dep_str) {
859                deps.push(dep);
860            }
861        } else if let Some(pip_deps) = dep_value.get("pip").and_then(|v| v.as_sequence()) {
862            deps.extend(extract_pip_dependencies(pip_deps));
863        }
864    }
865    deps
866}
867
868fn parse_environment_string_dependency(dep_str: &str) -> Option<Dependency> {
869    let (namespace, channel_url, dep_without_ns) = parse_conda_channel_prefix(dep_str);
870    create_conda_dependency(namespace, channel_url, dep_without_ns, "dependencies")
871}
872
873fn parse_conda_exact_requirement(req_no_space: &str) -> (Option<String>, Option<String>) {
874    let exact = req_no_space
875        .strip_prefix("==")
876        .or_else(|| req_no_space.strip_prefix('='));
877
878    let Some(exact) = exact else {
879        return (None, None);
880    };
881
882    if exact.is_empty() {
883        return (None, None);
884    }
885
886    match exact.split_once('=') {
887        Some((version, build_string)) if !version.is_empty() => (
888            Some(truncate_field(version.to_string())),
889            (!build_string.is_empty()).then(|| truncate_field(build_string.to_string())),
890        ),
891        _ => (Some(truncate_field(exact.to_string())), None),
892    }
893}
894
895fn parse_conda_channel_prefix(dep_str: &str) -> (Option<&str>, Option<&str>, &str) {
896    if let Some((ns, rest)) = dep_str.rsplit_once("::") {
897        if ns.contains('/') || ns.contains(':') {
898            (None, Some(ns), rest)
899        } else {
900            (Some(ns), None, rest)
901        }
902    } else {
903        (None, None, dep_str)
904    }
905}
906
907fn create_conda_dependency(
908    namespace: Option<&str>,
909    channel_url: Option<&str>,
910    dep_without_ns: &str,
911    scope: &str,
912) -> Option<Dependency> {
913    let dep = dep_without_ns.trim();
914    let name_re = match Regex::new(r"^([A-Za-z0-9_.\-]+)") {
915        Ok(re) => re,
916        Err(_) => return None,
917    };
918
919    let caps = name_re.captures(dep)?;
920    let name_match = caps.get(1)?;
921    let name = name_match.as_str().trim();
922    let rest = dep[name_match.end()..].trim();
923
924    let (version, build_string, is_pinned, extracted_requirement) = if rest.is_empty() {
925        (None, None, false, Some(String::new()))
926    } else {
927        let req_no_space = rest.replace(' ', "");
928        let is_exact = req_no_space.starts_with("=") || req_no_space.starts_with("==");
929        let (parsed_version, parsed_build_string) = if is_exact {
930            parse_conda_exact_requirement(&req_no_space)
931        } else {
932            (None, None)
933        };
934
935        (
936            parsed_version,
937            parsed_build_string,
938            is_exact,
939            Some(truncate_field(rest.to_string())),
940        )
941    };
942
943    if name == "pip" || name == "python" {
944        return None;
945    }
946
947    let purl = build_purl(
948        "conda",
949        namespace,
950        name,
951        version.as_deref(),
952        None,
953        None,
954        None,
955    );
956    let mut extra_data = HashMap::new();
957    if let Some(namespace) = namespace {
958        extra_data.insert(
959            "channel".to_string(),
960            serde_json::json!(truncate_field(namespace.to_string())),
961        );
962    }
963    if let Some(channel_url) = channel_url {
964        extra_data.insert(
965            "channel_url".to_string(),
966            serde_json::json!(truncate_field(channel_url.to_string())),
967        );
968    }
969    if let Some(build_string) = build_string {
970        extra_data.insert("build_string".to_string(), serde_json::json!(build_string));
971    }
972
973    Some(Dependency {
974        purl,
975        extracted_requirement,
976        scope: Some(truncate_field(scope.to_string())),
977        is_runtime: Some(true),
978        is_optional: Some(false),
979        is_pinned: Some(is_pinned),
980        is_direct: Some(true),
981        resolved_package: None,
982        extra_data: (!extra_data.is_empty()).then_some(extra_data),
983    })
984}
985
986fn extract_pip_dependencies(pip_deps: &[Value]) -> Vec<Dependency> {
987    pip_deps
988        .iter()
989        .take(MAX_ITERATION_COUNT)
990        .filter_map(|pip_dep| {
991            if let Some(pip_req_str) = pip_dep.as_str()
992                && let Ok(parsed_req) = pip_req_str.parse::<pep508_rs::Requirement>()
993            {
994                create_pip_dependency(parsed_req, "dependencies", Some(pip_req_str))
995            } else {
996                None
997            }
998        })
999        .collect()
1000}
1001
1002fn create_pip_dependency(
1003    parsed_req: pep508_rs::Requirement,
1004    scope: &str,
1005    raw_requirement: Option<&str>,
1006) -> Option<Dependency> {
1007    let name = truncate_field(parsed_req.name.to_string());
1008
1009    if name == "pip" || name == "python" {
1010        return None;
1011    }
1012
1013    let specs = parsed_req.version_or_url.as_ref().map(|v| match v {
1014        pep508_rs::VersionOrUrl::VersionSpecifier(spec) => truncate_field(spec.to_string()),
1015        pep508_rs::VersionOrUrl::Url(url) => truncate_field(url.to_string()),
1016    });
1017
1018    let extracted_requirement = if let Some(raw) = raw_requirement {
1019        let raw = raw.trim();
1020        let suffix = raw.strip_prefix(&name).unwrap_or(raw).trim().to_string();
1021        Some(truncate_field(suffix))
1022    } else {
1023        Some(truncate_field(specs.clone().unwrap_or_default()))
1024    };
1025
1026    let version = specs.as_ref().and_then(|spec_str| {
1027        if spec_str.starts_with("==") {
1028            Some(truncate_field(
1029                spec_str.trim_start_matches("==").to_string(),
1030            ))
1031        } else {
1032            None
1033        }
1034    });
1035
1036    let is_pinned = specs.as_ref().map(|s| s.contains("==")).unwrap_or(false);
1037    let purl = build_purl("pypi", None, &name, version.as_deref(), None, None, None);
1038
1039    Some(Dependency {
1040        purl,
1041        extracted_requirement,
1042        scope: Some(truncate_field(scope.to_string())),
1043        is_runtime: Some(true),
1044        is_optional: Some(false),
1045        is_pinned: Some(is_pinned),
1046        is_direct: Some(true),
1047        resolved_package: None,
1048        extra_data: None,
1049    })
1050}
1051
1052crate::register_parser!(
1053    "Conda package manifest and environment file",
1054    &[
1055        "**/meta.yaml",
1056        "**/meta.yml",
1057        "**/recipe/recipe.yaml",
1058        "**/recipe/recipe.yml",
1059        "**/environment.yml",
1060        "**/environment.yaml",
1061        "**/env.yaml",
1062        "**/env.yml",
1063        "**/conda.yaml",
1064        "**/conda.yml",
1065        "**/*conda*.yaml",
1066        "**/*conda*.yml",
1067        "**/*env*.yaml",
1068        "**/*env*.yml",
1069        "**/*environment*.yaml",
1070        "**/*environment*.yml"
1071    ],
1072    "conda",
1073    "Python",
1074    Some("https://docs.conda.io/"),
1075);