Rename dependency is_resolved to is_pinned (#3888)

* Rename dependency attribute is_resolved

Renaming the dependency attribute is_resolved to is_pinned to
more accurately represent this attribute accurately.
This is more relevant after the changes in aboutcode-org/scancode.io#1066

Reference: aboutcode-org/scancode.io#1066
Signed-off-by: Ayan Sinha Mahapatra <ayansmahapatra@gmail.com>

Author: AyanSinhaMahapatra

CHANGELOG.rst

@@ -37,6 +37,20 @@ v33.0.0 (next next, roadmap)
   of these in other summary plugins.
   See https://github.com/nexB/scancode-toolkit/issues/1745
 
+Major API/other changes:
+
+- Output Format Version updated to 4.0.0 (major version bump)
+- Dependency attribute rename: ``is_resolved`` renamed to ``is_pinned``
+  See https://github.com/nexB/scancode-toolkit/pull/3888 for more details.
+
+Changes in Output Data Structure:
+
+- The data structure of the JSON output has changed for
+  dependencies at file level package_data, and at top-level.
+  Note that the change is a modification to the JSON output,
+  so we have a major version bump ``3.2.0`` to ``4.0.0``:
+
+  - Dependency attribute ``is_resolved`` renamed to ``is_pinned``
 - Update link references of ownership from nexB to aboutcode-org
   See https://github.com/aboutcode-org/scancode-toolkit/issues/3885
 

docs/source/cli-reference/basic-options.rst

@@ -175,7 +175,8 @@
                     "scope": "dependencies",
                     "is_runtime": true,
                     "is_optional": false,
-                    "is_resolved": false,
+                    "is_pinned": false,
+                    "is_direct": true,
                     "resolved_package": {},
                     "extra_data": {},
                     "dependency_uid": "pkg:bower/get-size?uuid=fixed-uid-done-for-testing-5642512d1758",
@@ -341,7 +342,8 @@
                                     "scope": "dependencies",
                                     "is_runtime": true,
                                     "is_optional": false,
-                                    "is_resolved": false,
+                                    "is_pinned": false,
+                                    "is_direct": true,
                                     "resolved_package": {},
                                     "extra_data": {}
                                 }

etc/scripts/sch2js/doc/DependentPackage-json-schema.json

@@ -63,12 +63,12 @@
         }
       ]
     }, 
-    "is_resolved": {
+    "is_pinned": {
       "oneOf": [
         {
           "type": "boolean", 
-          "title": "is resolved flag", 
-          "description": "True if this dependency version requirement has been resolved and this dependency url points to an exact version."
+          "title": "is pinned flag", 
+          "description": "True if this dependency version requirement has been pinned and this dependency points to an exact version."
         }, 
         {
           "type": "null"

etc/scripts/sch2js/doc/Package-json-schema.json

@@ -455,7 +455,7 @@
                   }
                 ]
               }, 
-              "is_resolved": {
+              "is_pinned": {
                 "oneOf": [
                   {
                     "type": "boolean", 

src/formattedcode/output_cyclonedx.py

@@ -519,7 +519,7 @@ def from_package(cls, package, components_by_purl):
         for dependency in package.get('dependencies', []):
             dpurl = dependency['purl']
 
-            if dependency['is_resolved']:
+            if dependency['is_pinned']:
                 dependencies_by_dependent[purl].add(dpurl)
             else:
                 existing = components_by_purl.get(dpurl)

src/packagedcode/alpine.py

@@ -1014,7 +1014,7 @@ def D_dependencies_handler(value, dependencies=None, **kwargs):
 
         requirement = None
         version = None
-        is_resolved = False
+        is_pinned = False
         segments = split_name_and_requirement(dep)
         if len(segments) == 1:
             # we have no requirement...just a plain name
@@ -1027,7 +1027,7 @@ def D_dependencies_handler(value, dependencies=None, **kwargs):
             operator = ''.join(sorted(operator))
             if operator == '=':
                 version = ver
-                is_resolved = True
+                is_pinned = True
 
             requirement = operator + ver
 
@@ -1042,7 +1042,7 @@ def D_dependencies_handler(value, dependencies=None, **kwargs):
             purl=purl,
             scope=scope,
             extracted_requirement=requirement,
-            is_resolved=is_resolved,
+            is_pinned=is_pinned,
         )
         if dependency not in dependencies:
             dependencies.append(dependency.to_dict())

src/packagedcode/build_gradle.py

@@ -360,7 +360,7 @@ def build_package(cls, dependencies, package_only=False):
                 extracted_requirement=version,
                 is_runtime=is_runtime,
                 is_optional=is_optional,
-                is_resolved=bool(version),
+                is_pinned=bool(version),
             )
         )
 

src/packagedcode/cargo.py

@@ -299,7 +299,7 @@ def parse(cls, location, package_only=False):
                     scope='dependencies',
                     is_runtime=True,
                     is_optional=False,
-                    is_resolved=True,
+                    is_pinned=True,
                 )
             )
 
@@ -346,7 +346,7 @@ def dependency_mapper(dependencies, scope='dependencies'):
             scope=scope,
             is_runtime=is_runtime,
             is_optional=is_optional,
-            is_resolved=False,
+            is_pinned=False,
             extra_data=extra_data,
         )
 

src/packagedcode/cocoapods.py

@@ -345,7 +345,7 @@ def get_pods_dependency_with_resolved_package(
             extracted_requirement=xreq,
             is_runtime=False,
             is_optional=True,
-            is_resolved=True,
+            is_pinned=True,
             is_direct=is_direct,
             resolved_package=resolved_package,
         )
@@ -377,7 +377,7 @@ def get_dependencies_for_resolved_package(cls, dependency_data, dep_pods):
                 extracted_requirement=dep_xreq,
                 is_runtime=False,
                 is_optional=True,
-                is_resolved=True,
+                is_pinned=True,
                 is_direct=True,
             ).to_dict()
             dependencies_for_resolved.append(dependency_for_resolved)

src/packagedcode/conan.py

@@ -270,9 +270,9 @@ def assemble(
         yield resource
 
 
-def is_constraint_resolved(constraint):
+def is_constraint_pinned(constraint):
     """
-    Checks if a constraint is resolved and it specifies an exact version.
+    Checks if a constraint is pinned and it specifies an exact version.
     """
     range_characters = {">", "<", "[", "]", ">=", "<="}
     return not any(char in range_characters for char in constraint)
@@ -282,9 +282,9 @@ def get_dependencies(requires):
     dependent_packages = []
     for req in requires:
         name, constraint = req.split("/", 1)
-        is_resolved = is_constraint_resolved(constraint)
+        is_pinned = is_constraint_pinned(constraint)
         version = None
-        if is_resolved:
+        if is_pinned:
             version = constraint
         purl = PackageURL(type="conan", name=name, version=version)
         dependent_packages.append(
@@ -293,7 +293,7 @@ def get_dependencies(requires):
                 scope="install",
                 is_runtime=True,
                 is_optional=False,
-                is_resolved=is_resolved,
+                is_pinned=is_pinned,
                 extracted_requirement=constraint,
             )
         )