Skip to content

v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Jul 07:08
· 2 commits to master since this release
v0.3.0
1ff1276

Yocto Lens v0.3.0

Yocto Lens v0.3.0 focuses on faster large-layer scans, fewer false positives, stronger CI/static-analysis workflows, and AI-agent guidance for Yocto/OpenEmbedded developers.

Highlights

Performance Improvements

  • Parallelized parsing for .bb, .bbappend, and .patch files.
  • Added bounded worker-pool parsing for large layers such as meta-openembedded.
  • Added layer file indexing to avoid repeated full-tree include lookups.
  • Added scan-local metadata parse caching.
  • Added --profile to show scan phase timings.

Analysis Coverage

  • Added scanning support for .inc and .bbclass metadata files.
  • Added missing patch reference checks for SRC_URI.
  • Added configured Yocto target release compatibility checks.
  • Added duplicate explicit provider detection.
  • Improved layer, recipe, append, patch, and metadata rule handling.

Reduced False Positives

  • Reduced noisy line-level matching.
  • Avoided treating comments as active metadata.
  • Avoided host-path warnings for normal target paths like /tmp.
  • Improved hardcoded secret detection.
  • Avoided duplicate license/style findings.
  • Avoided implicit provider false positives for normal multi-version recipes.
  • Disabled default unreferenced patch warnings because patch references may be indirect.

Project Configuration

Yocto Lens now supports .yocto-lens.json or yocto-lens.json:

{
  "target_release": "scarthgap",
  "exclude": ["recipes-test/**"],
  "disabled_rules": ["style/*"],
  "severity": {
    "static/license-closed": "HIGH"
  }
}

Suppressions

Inline suppressions are now supported:

# yocto-lens-disable-next-line static/license-closed
LICENSE = "CLOSED"

CI and Export Improvements

  • Stabilized SARIF output ordering.
  • Improved SARIF artifact paths.
  • Preserved stable rule IDs for CI and code scanning.

AI Agent Support

Added AGENTS.md for Codex-compatible agents.
Added CLAUDE.md for Claude Code.
Added docs/AI_AGENTS.md with Yocto/BitBake official-doc-first agent guidance.
Added optional companion reference to awesome-yocto-ai-agent-skills.

Recommended Upgrade

This release is recommended for anyone scanning large Yocto/OpenEmbedded layers or using Yocto Lens in CI.

Installation

Download the binary for your platform from the release assets and run:
yocto-lens --no-tui /path/to/meta-layer

For profiling:

yocto-lens --profile /path/to/meta-layer

Assets 7
Loading