feat(pyproject): add workspace/monorepo support by Strum355 · Pull Request #2 · Strum355/exhort-javascript-api

Strum355 · 2026-04-09T13:53:55Z

Summary

Add lock file walk-up (_findLockFileDir) and workspace root detection (_isWorkspaceRoot) to Base_pyproject, following the Base_javascript pattern
Handle uv editable installs (-e) in _parseUvExport so workspace members appear in the dependency graph with correct multi-level linkage
Support TRUSTIFY_DA_WORKSPACE_DIR override for directing lock file search
Run tool commands (uv export, poetry show) from the workspace root where the lock file lives

Implements TC-4039

Test plan

validateLockFile() finds lock files in parent directories (uv and poetry)
validateLockFile() stops at workspace root boundary when lock file is absent
TRUSTIFY_DA_WORKSPACE_DIR override directs lock file search
SBOM generation for uv workspace root, mid-package, and sub-package (3-level nesting)
SBOM generation for poetry workspace root and sub-package
Existing non-workspace pyproject.toml tests continue to pass

🤖 Generated with Claude Code

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

…uacsec#247)

…#253)

* feat!: set golang mvs true as default Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> * feat: update tests Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> * feat: update provider to trustify Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> * fix: ci build Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> * fix: update new perl-base sbom Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> * fix: align providers Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> --------- Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

* chore: rename trustification references to guacsec * chore: remove building OCI image in stage pipeline * chore: rename EXHORT_ opts to TRUSTIFY_DA_ * chore: move test url to env var

…istry changes (guacsec#260)

…#261)

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 1 to 2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@v1...v2) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…c#378)

…ec#391)

…updates (guacsec#401) Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7` | `8` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` | | [docker/login-action](https://github.com/docker/login-action) | `3` | `4` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `5` | `6` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6` | `7` | Updates `actions/download-artifact` from 7 to 8 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v7...v8) Updates `docker/setup-buildx-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v3...v4) Updates `docker/login-action` from 3 to 4 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v3...v4) Updates `docker/metadata-action` from 5 to 6 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@v5...v6) Updates `docker/build-push-action` from 6 to 7 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v6...v7) Updates `actions/upload-artifact` from 6 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v6...v7) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/metadata-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [minimatch](https://github.com/isaacs/minimatch) and [editorconfig](https://github.com/editorconfig/editorconfig-core-js). These dependencies needed to be updated together. Updates `minimatch` from 9.0.5 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `minimatch` from 5.1.6 to 5.1.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `editorconfig` from 1.0.4 to 1.0.7 - [Release notes](https://github.com/editorconfig/editorconfig-core-js/releases) - [Changelog](https://github.com/editorconfig/editorconfig-core-js/blob/main/CHANGELOG.md) - [Commits](editorconfig/editorconfig-core-js@v1.0.4...v1.0.7) --- updated-dependencies: - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: indirect - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect - dependency-name: minimatch dependency-version: 5.1.9 dependency-type: indirect - dependency-name: editorconfig dependency-version: 1.0.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: implement license resolution and identification * feat: calculate compatibility from backend information --------- Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

…csec#404)

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> Co-authored-by: Claude Sonnet <noreply@anthropic.com>

…bundled with webpack (guacsec#410)

…nse response to SBOM purls (guacsec#414) * fix: use PackageURL to canonicalize purls when matching deps.dev license response to SBOM purls The deps.dev backend returns package purls with qualifiers like ?scope=compile (e.g. pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4?scope=compile), while the SBOM generated by the client uses plain purls without qualifiers. The strict purls.includes(purl) check in normalizeLicensesResponse never matched qualifier-suffixed purls, causing incompatibleDependencies to always be empty even when LGPL/copyleft dependencies were present. Fix by using PackageURL.fromString() to parse purls and reconstructing them without qualifiers or subpath via new PackageURL(..., null, null). This produces canonical core purls for both the allowed set and the backend keys, making the match resilient to any qualifiers the backend may return. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: remove unused getLicenseForSbom function Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: rust analysis support * fix: use a proper toml parser * fix: remove duplicate functions * fix: update after review * fix: revert accidental changes to package-lock.json * fix: broken sboms * feat: include path dependencies in SBOM with repository_url=local qualifier --------- Signed-off-by: Adva Oren <aoren@redhat.com>

…csec#422) fix: analysis of an empty go manifest returns non-zero scanned depenedencies

* feat: allow monorepo lock files using workspaceDir Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com> Implements TC-3862 * refactor: improve workspace discovery robustness and batch analysis maintainability - Replace hand-rolled pnpm-workspace.yaml parser with js-yaml - Fix negation pattern handling in workspace discovery (e.g. !**/test/**) - Refactor stackAnalysisBatch into focused helpers, eliminating duplicated SBOM generation logic between fail-fast and continue-on-error paths - Add integration tests for stackAnalysisBatch with mocked providers and HTTP backend Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Implements TC-3862 * fix: address qodo review findings for batch analysis - Make generateOneSbom async and await provider.provideStack() to support async providers (e.g. python_pip) - Propagate workspaceDir as cwd for package manager commands so npm/pnpm/yarn run from workspace root in monorepos - Fix CLI --html --metadata printing wrapper object instead of HTML string Implements TC-3862 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: use TRUSTIFY_DA_WORKSPACE_DIR convention consistently Remove the opts.workspaceDir fallback pattern and use only the TRUSTIFY_DA_WORKSPACE_DIR key through getCustom(), keeping the existing single-convention pattern for option propagation. TC-3862 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve eslint warnings in workspace.js and batch test Use named import for js-yaml load function and fix import ordering in stack_analysis_batch.test.js. TC-3862 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

…c#431) * feat: walk up directory tree to find JS lockfile in monorepos Add parent-traversal logic to Base_javascript.validateLockFile and _buildDependencyTree, matching the existing Cargo provider pattern. When a nested package.json has no lockfile in its directory, the provider now walks up looking for package-lock.json/yarn.lock/ pnpm-lock.yaml, stopping at a package.json with "workspaces" field (the workspace root boundary) or the filesystem root. This enables single-file stack analysis to work for modules in JS/TS monorepos where the lockfile lives at the workspace root. TRUSTIFY_DA_WORKSPACE_DIR still takes precedence as an explicit override (no walk-up when set). Assisted-by: Claude Code Ref: TC-3891 * fix: pass correct cwd to commands and trim unnecessary comments Address Qodo review: #executeListCmd and #createLockFile now pass { cwd: manifestDir } to #invokeCommand so commands run from the lockfile directory, not the manifest directory. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Ref: TC-3891 * fix: add pnpm-workspace.yaml as workspace root boundary Address Qodo review: _findLockFileDir now also stops at directories containing pnpm-workspace.yaml, preventing the walk-up from escaping pnpm workspace roots that don't use package.json#workspaces. Ref: TC-3891 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

…ec#444) p-limit v5 uses Node.js subpath imports (#async_hooks) which webpack cannot resolve, breaking downstream consumers that bundle the client (e.g., the VS Code extension). v4 has an identical API without the subpath imports. Fixes guacsec#443 Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

…nalysis pnpm, yarn classic, and yarn berry providers were missing peer and/or optional dependencies from the SBOM, while yarn berry additionally included devDependencies. This caused inconsistent vulnerability reports across package managers for the same package.json. Root causes: - Manifest.loadDependencies() only read content.dependencies - base_javascript _getRootDependencies() and _addDependenciesToSbom() ignored pnpm's separate optionalDependencies key - yarn berry had no mechanism to filter out devDependencies from yarn info --all output Fixes: - Manifest now loads peer, optional, and bundled dependencies - Base JS provider merges optionalDependencies from dep tree output - ensurePeerAndOptionalDeps() injects manifest-declared peer/optional deps when the package manager does not resolve them - Yarn berry processor filters root dependencies against manifest Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>

…ct purl matching Address two review comments: 1. Yarn berry addDependenciesToSbom() now builds a reachable set via BFS from root production deps, so devDependency nodes and their entire transitive trees are excluded from the SBOM — not just the root edges. 2. Replace substring-based checkIfPackageInsideDependsOnList() with purl-prefix matching in ensurePeerAndOptionalDeps() to avoid false positives (e.g. "minimist" matching "minimist-options") and false negatives (e.g. "@hapi/joi" not matching URL-encoded "%40hapi/joi"). Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>

…pendencies in go.mod files (guacsec#416)

fix: include peer, optional, and bundled deps in JS stack/component a…

Implements: [TC-3850](https://redhat.atlassian.net/browse/TC-3850)

Implements TC-4039

Strum355 and others added 30 commits June 20, 2025 15:11

chore: use archive.apache.org instead of dlcdn.apache.org (guacsec#234)

5c40c6a

build: updated package with v0.2.4-ea.2 [skip ci]

cc39167

feat: support passing additional arguments to maven (guacsec#238)

a9c8bf2

build: updated package with v0.2.4-ea.3 [skip ci]

310ffbd

[Snyk] Upgrade node-fetch from 2.6.11 to 2.7.0 (guacsec#237)

ad0d019

build: updated package with v0.2.4-ea.4 [skip ci]

7a75938

chore(deps): upgrade fast-xml-parser from 4.3.2 to 4.5.3 (guacsec#235)

fb08d25

build: updated package with v0.2.4-ea.5 [skip ci]

3d04997

chore(ci): add multi-arch integration tests (guacsec#200)

60c5f9d

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

fix: use & pass down opts for getCustom in imageAnalysis (guacsec#244)

6058deb

build: updated package with v0.2.4-ea.6 [skip ci]

969dc24

fix: properly handle go.mod files with no dependencies (guacsec#245)

5ea1a5e

build: updated package with v0.2.4-ea.7 [skip ci]

d454a4a

fix: allow ignored packages without version (guacsec#246)

b45975f

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

build: updated package with v0.2.4-ea.8 [skip ci]

854a70a

fix: correctly fallback to podman if docker hostinfo returns nothing (g…

e906448

…uacsec#247)

build: updated package with v0.2.4-ea.9 [skip ci]

d23acc7

chore: include package manager in exhort API request headers (guacsec…

a93a7f9

…#253)

build: updated package with v0.2.4-ea.10 [skip ci]

57853f3

feat: separate telemetry id header from auth token header (guacsec#254)

b7c8977

build: updated package with v0.2.4-ea.11 [skip ci]

8e44e06

build: updated package with v0.2.4-ea.12 [skip ci]

3962c91

chore: rename trustification references to guacsec (guacsec#249)

06853ec

* chore: rename trustification references to guacsec * chore: remove building OCI image in stage pipeline * chore: rename EXHORT_ opts to TRUSTIFY_DA_ * chore: move test url to env var

chore: fix-up & tidy-up workflows and remove references to .npmrc reg…

4fe9424

…istry changes (guacsec#260)

chore: publish to npm only from 'trusted publisher' pipeline (guacsec…

fefbd25

…#261)

chore: publish public package with provenance (guacsec#264)

be76688

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

chore: trigger upon release.yml change (guacsec#265)

b427266

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

chore: use newer node & npm versions (guacsec#267)

7b7b21f

fix: pass --tag prerelease for prerelease publishing (guacsec#268)

a92f214

Strum355 and others added 29 commits February 3, 2026 12:08

chore: ignore test manifests with dependabot (guacsec#360)

892110f

chore: bump dependency versions (guacsec#361)

d349baa

chore: bump GHA workflow versions (guacsec#368)

c555cdf

chore: group dependabot pull requests (guacsec#374)

62f6bc7

fix: extract & pass correct headers & header values to exhort (guacse…

a109536

…c#378)

chore: bump yargs to v18 for Node 25 support (guacsec#392)

aba4457

feat: use tree-sitter to parse requirements.txt more correctly (guacs…

477151f

…ec#391)

chore: fix requirements.txt parser init & re-enable python tests (gua…

6549d2a

…csec#404)

chore: use path.resolve to find tree-sitter wasm files (guacsec#407)

ff266a3

feat: fall back to LICENSE file (guacsec#409)

f2c4df7

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> Co-authored-by: Claude Sonnet <noreply@anthropic.com>

chore: colocate tree-sitter-requirements.wasm to resolve issues when …

29f6867

…bundled with webpack (guacsec#410)

fix: analysis of an empty manifest returns non-zero scanned deps (gua…

59f00f7

…csec#422) fix: analysis of an empty go manifest returns non-zero scanned depenedencies

fix: update npm before npm ci in CI workflows (guacsec#427)

9988076

fix: wrong content type for batch-analysis (guacsec#429)

7144952

Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>

chore: correctly parse and differentiate between indirect & direct de…

de12f6a

…pendencies in go.mod files (guacsec#416)

Merge pull request guacsec#449 from soul2zimate/TC-3977

d71f957

fix: include peer, optional, and bundled deps in JS stack/component a…

feat: add support for pyproject.toml via uv & poetry (guacsec#432)

f2d5d72

Implements: [TC-3850](https://redhat.atlassian.net/browse/TC-3850)

feat: add support for UV/poetry workspaces

4b1bc6a

Implements TC-4039

Strum355 closed this Apr 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(pyproject): add workspace/monorepo support#2

feat(pyproject): add workspace/monorepo support#2
Strum355 wants to merge 103 commits into
mainfrom
TC-4039

Strum355 commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Strum355 commented Apr 9, 2026

Summary

Test plan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants