Creating a Go Version of a Ruby Changelog
Creating a Go Version of a Ruby Changelog
Agent
Claude Code
Model
Claude Opus 4.6
StartedFeb 16, 6:04 PM
Shared
Feb 16, 6:04 PM
Messages73
Downloads28
see https://nesbitt.io/2025/12/14/supply-chain-security-tools-for-ruby.html do we have equiveltn in go for each one of these? I know I've written some in git-pkgs but maybe there are existing well maintained go tools for others?
So the changelog files are just in testing repos, not actual modules. No swhid, sarif, or diffoscope modules exist in git-pkgs.
Now let me search for existing well-maintained Go tools for each of these. Let me search for each one.
Now let me search for existing Go implementations of the tools you don't already have.
The user wants me to look at a blog post about supply chain security tools for Ruby, and then figure out if there are equivalent tools in Go for each one. They also mention they've written some in their git-pkgs project. Let me fetch the blog post first and explore the local codebase in parallel.
Now I have all the information. Let me put together a clear comparison.
Here's the breakdown. The blog post lists seven Ruby gems, all of which you wrote:
| Ruby gem | What it does | Go equivalent |
|---|---|---|
| purl | Parse/generate Package URLs | You already wrote this in git-pkgs |
| vers | Version range spec (VERS format) | You already wrote this in git-pkgs |
| sbom | Parse/generate SPDX & CycloneDX | You already wrote this in git-pkgs (generation at least) |
| swhid | Software Hash IDentifiers | You already wrote this -- andrew/swhid-go on GitHub |
| changelog-parser | Structured release notes from changelogs | Nothing good exists |
| diffoscope | Deep comparison of files/archives | Nothing exists |
| sarif | SARIF static analysis format | owenrumney/go-sarif covers this well |
So you've already got Go versions of four out of seven. For the remaining three:
SARIF -- owenrumney/go-sarif (80 stars, v3.3.0, Apache-2.0, actively maintained) is solid. It handles parsing, generation, and validation for both SARIF v2.1.0 and v2.2. It's packaged in Fedora and Debian. Unless you need something the library doesn't do, this one doesn't need a from-scratch rewrite.
Changelog parsing -- the Go ecosystem is thin here. anton-yurchenko/go-changelog (3 stars) is the most capable, with typed dates and Keep a Changelog scoped categories (Added/Changed/Fixed etc.). parkr/changelog (33 stars) is simpler but more established. Neither is widely adopted. Given the low quality of options, writing your own might make more sense, especially if you want to handle the variety of changelog formats your Ruby gem handles.
Diffoscope -- nothing in Go does recursive structural comparison across arbitrary archive formats. diffoci (551 stars) does this for container images specifically, and you already have an archives module in git-pkgs that reads zip/tar/gem formats. But a general-purpose diffoscope equivalent that unpacks nested archives and does format-aware diffing doesn't exist. This would be the biggest lift to build.
ok cool, i have made a changelog folder, lets make a go equiv of https://github.com/andrew/changelog-parser
The user wants to create a Go equivalent of their Ruby changelog-parser gem. Let me first look at the Ruby gem to understand what it does, then look at the changelog folder they've created, and plan the implementation.
Let me explore the Ruby gem and the local codebase in parallel.
Now I have a thorough understanding of both the Ruby gem and the Go codebase patterns. Let me read a few key files to confirm patterns, then design the plan.
Let me now launch a Plan agent to design the implementation.
Good, I have a solid picture of both the Ruby gem and the Go module conventions. Let me read a couple of representative files to confirm patterns, then design the implementation.
Now I have everything I need. Let me also quickly look at the Ruby parser source to understand the regex patterns used, since that's the core of the implementation.
Let me read the Ruby parser source to understand the exact regex patterns and parsing logic.
Now let me also read the test fixtures to understand the exact changelog formats being tested.
Good, I have everything I need. Let me also check the vandamme compatibility and CLI files quickly, then write the plan.
Now I have a complete understanding. Let me write the plan. The Go library should:
github.com/git-pkgs/changelogLet me think about what to include and what to skip:
Include (library):
Three format regexes (Keep a Changelog, Markdown Header, Underline)
Format auto-detection
Parse into structured entries (version, date, content)
Custom pattern support
Between method
LineForVersion method
FindChangelog to locate changelog files in a directory
ParseFile and FindAndParse convenience functions
Skip (not appropriate for Go library):
Actually wait, let me reconsider. The other modules in git-pkgs are pure libraries without CLIs. The CLI is in git-pkgs itself. So this should be a pure library.
Let me now write the implementation.
Now I have a thorough understanding of both sides. Let me write the plan.
Now let me map the Ruby tools from the blog post to what exists in git-pkgs and what might exist as standalone Go tools.
The Ruby tools mentioned are:
Checking git-pkgs, I can see purl, vers, and sbom are already available as Go modules, but swhid, changelog-parser, diffoscope, and sarif don't appear in the codebase. Let me search for those missing tools to see if they're implemented elsewhere.
Let me check if there are any swhid, sarif, or changelog modules in the codebase that the exploration might have missed.