Add Chef metadata and Berksfile support

[abhinavgautam01]

Closes #71

Summary

Add static Chef cookbook parsers for:

• metadata.rb
• metadata.json
• Berksfile

The Ruby DSL parsers extract literal declarations without executing Ruby, loading adjacent files, expanding constants or evaluating dynamic expressions.

Implementation

Cookbook metadata

Parse cookbook identity from metadata.rb and metadata.json:

• Name
• Version
• License
• Runtime dependencies
• Omitted, single and multiple version constraints

The JSON and Ruby formats produce equivalent dependency representations.

Berksfile

Parse literal Berksfile declarations for:

• Ordered public and private Supermarket sources
• Cookbook dependencies
• Optional version constraints
• Git repository sources
• Local path sources
• GitHub shorthand sources
• Multiline declarations and literal source options

A bare metadata directive is intentionally ignored and never reads an adjacent metadata.rb.

Source representation

Add source declaration types so the result model can preserve source configuration without claiming that dependency resolution occurred:

• ParseResult.Sources retains manifest-level sources in declaration order
• Dependency.Source retains an explicit source override
• Declaration.Source retains the same source-level information
• Git repositories and local paths are kept separate from RegistryURL

Chef dependency PURLs remain empty because chef is still only a candidate Package URL type without accepted name or namespace rules.

Static parsing and safety

The Ruby parser accepts:

• Single- and double-quoted strings
• Optional parentheses
• Normal whitespace
• Trailing comments
• Multiline calls continued by commas or parentheses
• Literal keyword and hash-rocket arguments

It skips declarations containing:

• String interpolation
• Variables or constants
• Method calls
• Concatenation
• Loops or other expressions
• Ambiguous source overrides

A dynamic or malformed declaration does not prevent later valid declarations from being parsed.

Testing

Added fixtures and tests covering:

• Cookbook name, version, and license
• Unconstrained and pessimistic dependencies
• Multiple literal constraints
• Equivalent Ruby and JSON metadata
• Public and private Supermarket sources
• Git, path, and GitHub cookbook sources
• Comments and optional parentheses
• Multiline calls
• Dynamic expressions mixed with valid declarations
• Interpolation and malformed input
• Bare metadata filesystem isolation
• Parser registration and candidate PURL behavior

Validation

• gofmt
• git diff --check
• go build ./...
• go vet ./...
• go test -count=1 ./...
• go test -race -count=1 ./...
• golangci-lint v2.13.2 — 0 issues

[Copilot]

Pull request overview

This PR adds static (non-evaluating) Chef cookbook manifest parsing support for metadata.rb, metadata.json, and Berksfile, and extends the result model to preserve manifest-level source declarations and per-dependency source overrides without implying resolution.

Changes:

• Add a Chef parser (internal/chef) that extracts literal identity, dependencies, and Berksfile sources while skipping dynamic Ruby expressions.
• Extend the core/public result types with SourceKind, Source, and ParseResult.Sources, plus per-dependency/per-declaration Source overrides.
• Add fixtures, unit tests, parser registration/imports, and README updates documenting the new Chef ecosystem and source model.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
testdata/chef/metadata.rb	Adds Chef metadata.rb fixture for identity + dependency constraints.
testdata/chef/metadata.json	Adds Chef metadata.json fixture mirroring Ruby metadata semantics.
testdata/chef/Berksfile	Adds Berksfile fixture covering sources, cookbook declarations, and overrides.
README.md	Documents Chef ecosystem support and the new Source fields/section.
manifests.go	Re-exports SourceKind/Source, adds ParseResult.Sources, and special-cases Chef PURLs to remain empty.
manifests_test.go	Adds ecosystem/fixture coverage and asserts candidate Chef PURLs remain empty; verifies metadata directive doesn’t read FS.
internal/core/types.go	Introduces SourceKind/Source and adds Source fields on Dependency/Declaration/Result.
internal/chef/chef.go	Implements static Ruby/JSON metadata parsing and Berksfile parsing without executing Ruby.
internal/chef/chef_test.go	Adds thorough unit tests for identity, constraints, sources, multiline, and dynamic-skip behavior.
imports.go	Registers the Chef parser package.
benchmark_test.go	Adds Chef fixtures to benchmark coverage.

Suppressed comments (1)

manifests.go:63

• ParseResult gained a new exported field (Sources). That can break downstream code using unkeyed composite literals (e.g., manifests.ParseResult{...}) and is hard to undo. At minimum, it’s worth documenting that callers should use keyed field names when constructing ParseResult values.

// ParseResult contains the parsed dependencies from a manifest or lockfile.
type ParseResult struct {
	Ecosystem string

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.