Add Lua rockspec package handler for LuaRocks dependencies by SLASH217 · Pull Request #4743 · aboutcode-org/scancode-toolkit

SLASH217 · 2026-02-13T16:29:35Z

Add Lua rockspec package handler for LuaRocks dependencies

Fixes #3526

Changes

Added RockspecHandler class for .rockspec file detection
Implemented RockspecParser using Lua AST parsing with luaparser library
Extracts package metadata: name, version, description, license, homepage_url, vcs_url (non-exhaustive list)
Integrated handler into APPLICATION_PACKAGE_DATAFILE_HANDLERS registry
Added 23 comprehensive unit and integration tests
Fixed dead documentation links in CONTRIBUTING.rst

Tasks

Reviewed contribution guidelines
PR is descriptively titled 📑 and links the original issue above 🔗
Tests pass -- look for a green checkbox ✔️ a few minutes after opening your PR
Run tests locally to check for errors.
Commits are in uniquely-named feature branch and has no merge conflicts 📁
Updated documentation pages (if applicable)
Updated CHANGELOG.rst (if applicable)

Signed-off-by: Prashanna Dahal prashanna217@gmail.com

AyanSinhaMahapatra

Thanks++ @SLASH217 for the PR, looking good already, but you need to modify the tests so we can see the full output and verify the functionality added before I can do an in depth review. Added some other feedback you also need to address.

AyanSinhaMahapatra · 2026-02-18T09:47:46Z

+        parser = rockspec.RockspecParser(test_file)
+        data = parser.parse()
+
+        assert data['rockspec_format'] == '3.0'


This is not how we write tests for package manifest parsers, asserting the data one by one. Instead we dump the whole results in a JSON file and check the output matches to it, so we can see the entire output and test it, and not just some fields. And this result is more readable, and for changes we can regen and check the changes in output.
This is done using tests.packagedcode.packages_test_utils.Packagetester.check_packages_data()

See how this is done in all other test files for package manifest parsers, for example:

scancode-toolkit/tests/packagedcode/test_pypi.py

Line 163 in 022ddc8

self.check_packages_data(package, expected_loc, regen=REGEN_TEST_FIXTURES)

AyanSinhaMahapatra · 2026-02-18T09:49:41Z

+build = {
+  type = "builtin",
+  modules = {
+    ["kong"] = "kong/init.lua",


AFAIK we are not parsing/storing the modules info here and this is increasing the test file size without contributing anything to the test, can you remove these modules from all the tests?

Same for all non essential things in other test files.

I have removed the unnecessary bloat from the test files.

AyanSinhaMahapatra · 2026-02-18T09:50:37Z

@@ -0,0 +1,530 @@
+package = "kong"


Would be great to add the link to this test file (and all others) as a comment, since these are real files(?) and we should provide where we got them from

Added the source of the rockspec files in test_file_source.txt.

AyanSinhaMahapatra · 2026-02-18T10:07:05Z

+            - name: Package name
+            - version_number: Clean version number (e.g. "3.1.3") or None
+            - version_spec: Full version specification with operator (e.g. "== 3.1.3") or None
+            - raw: Original input string


Not sure why you want to pass back the input, don't we already have this in context?

AyanSinhaMahapatra · 2026-02-18T10:08:49Z

+            package_name: Name of the package
+            package_version: Optional version string (without operators)
+
+        Returns:


This is additional information you're conveying twice, and not how we write the docstrings. Just describe the output, what it does and the inputs in a short to-the-point docstring. For all the functions

AyanSinhaMahapatra · 2026-02-18T10:10:05Z

+            extra_data['supported_platforms'] = platforms
+
+        # Future fields can be added here
+        # e.g., build_backend, build_requires, etc.


Why not just add these now? And if you're keeping work for later, add a TODO:

AyanSinhaMahapatra · 2026-02-18T10:12:38Z

    jsonstreams >= 0.5.0
    license_expression >= 30.4.4
    lxml >= 5.4.0
+    luaparser == 4.0.0


Let's not pin dependencies, you can add this as a lower bound. We are a library too :)

Understood! Will keep in mind for future commits.

SLASH217 · 2026-02-19T17:19:49Z

Thank you for your feedback and valuable time.
I will diligently make the updates and push as soon as possible.

SLASH217 · 2026-02-21T16:49:08Z

@AyanSinhaMahapatra I have updated the PR, adding all the fixes you have requested.
Please do review it!

AyanSinhaMahapatra

Thanks @SLASH217, almost there. A couple small changes suggested for your consideration.

Could you also check if #3249 is fixed by this? See #3249 (comment) for the input.

SLASH217 · 2026-04-19T20:19:27Z

Understood! I will get to work as soon my exams end.

Implement base handler class and Lua rockspec parser using luaparser for AST-based dependency extraction. Signed-off-by: Prashanna Dahal <prashanna217@gmail.com>

Extract package metadata and dependencies from rockspec files with version specification parsing. Signed-off-by: Prashanna Dahal <prashanna217@gmail.com>

* Test parser with real Kong rockspec file * Test handler integration with patterns Signed-off-by: Prashanna Dahal <prashanna217@gmail.com>

Register handler in APPLICATION_PACKAGE_DATAFILE_HANDLERS to enable automatic .rockspec file detection. Signed-off-by: Prashanna Dahal <prashanna217@gmail.com>

* Update contributing-docs link to new structure * Ensure both documentation links work correctly * Point to getting-started/contribute path Signed-off-by: Prashanna Dahal <prashanna217@gmail.com>

Change luaparser from == to match project's version pinning pattern: * requirements.txt: luaparser==1.4.3 (exact pinning) * setup.cfg: luaparser == 1.4.3 (exact pinning) Signed-off-by: Prashanna Dahal <prashanna217@gmail.com>