feat: add JS workspace discovery and public batch API

Add JavaScript/TypeScript monorepo workspace support to the Java client:

- Add JsWorkspaceDiscovery utility for parsing pnpm-workspace.yaml and
  package.json workspaces field to discover member package.json manifests
- Add parent-traversal lock file discovery to JavaScriptProviderFactory
  so workspace members find the lock file at the workspace root
- Add stackAnalysisBatch() and stackAnalysisBatchHtml() to Api interface
- Implement batch methods in ExhortApi using existing performBatchAnalysis()
  infrastructure with TRUSTIFY_DA_CONTINUE_ON_ERROR support
- Add jackson-dataformat-yaml dependency for YAML parsing
- Add comprehensive test suites for workspace discovery and lock file walk-up

Implements TC-3863

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: a-oren

pom.xml

@@ -151,6 +151,11 @@
         <artifactId>jackson-datatype-jsr310</artifactId>
         <version>${jackson.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.fasterxml.jackson.dataformat</groupId>
+        <artifactId>jackson-dataformat-yaml</artifactId>
+        <version>${jackson.version}</version>
+      </dependency>
       <dependency>
         <groupId>jakarta.annotation</groupId>
         <artifactId>jakarta.annotation-api</artifactId>
@@ -228,7 +233,10 @@
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
     </dependency>
-    <!-- https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jsr310 -->
+    <dependency>
+      <groupId>com.fasterxml.jackson.dataformat</groupId>
+      <artifactId>jackson-dataformat-yaml</artifactId>
+    </dependency>
 
     <dependency>
       <groupId>jakarta.annotation</groupId>

src/main/java/io/github/guacsec/trustifyda/Api.java

@@ -19,6 +19,7 @@
 import io.github.guacsec.trustifyda.api.v5.AnalysisReport;
 import io.github.guacsec.trustifyda.image.ImageRef;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.Arrays;
 import java.util.Map;
 import java.util.Objects;
@@ -134,4 +135,29 @@ CompletableFuture<Map<ImageRef, AnalysisReport>> imageAnalysis(Set<ImageRef> ima
    * @throws IllegalStateException when the manifest file type is not supported
    */
   String generateSbom(String manifestFile) throws IOException;
+
+  /**
+   * Performs batch stack analysis for all workspace members discovered in the given workspace
+   * directory. Discovers package.json manifests via pnpm-workspace.yaml or package.json workspaces
+   * field, generates SBOMs for each, and sends them as a batch to the backend.
+   *
+   * @param workspaceDir the workspace root directory path
+   * @param ignorePatterns glob patterns for paths to exclude from workspace discovery
+   * @return a map of manifest name to analysis report, wrapped in a CompletableFuture
+   * @throws IOException when workspace discovery or SBOM generation fails
+   */
+  CompletableFuture<Map<String, AnalysisReport>> stackAnalysisBatch(
+      Path workspaceDir, Set<String> ignorePatterns) throws IOException;
+
+  /**
+   * Performs batch stack analysis returning an HTML report for all workspace members discovered in
+   * the given workspace directory.
+   *
+   * @param workspaceDir the workspace root directory path
+   * @param ignorePatterns glob patterns for paths to exclude from workspace discovery
+   * @return the HTML report as a byte array wrapped in a CompletableFuture
+   * @throws IOException when workspace discovery or SBOM generation fails
+   */
+  CompletableFuture<byte[]> stackAnalysisBatchHtml(Path workspaceDir, Set<String> ignorePatterns)
+      throws IOException;
 }

src/main/java/io/github/guacsec/trustifyda/impl/ExhortApi.java

@@ -30,6 +30,7 @@
 import io.github.guacsec.trustifyda.image.ImageUtils;
 import io.github.guacsec.trustifyda.license.LicenseCheck;
 import io.github.guacsec.trustifyda.logging.LoggersFactory;
+import io.github.guacsec.trustifyda.providers.javascript.workspace.JsWorkspaceDiscovery;
 import io.github.guacsec.trustifyda.tools.Ecosystem;
 import io.github.guacsec.trustifyda.utils.Environment;
 import jakarta.mail.MessagingException;
@@ -51,6 +52,7 @@
 import java.time.temporal.ChronoUnit;
 import java.util.AbstractMap;
 import java.util.Collections;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
@@ -703,6 +705,86 @@ public CompletableFuture<String> identifyLicense(Path licenseFilePath) {
             });
   }
 
+  @Override
+  public CompletableFuture<Map<String, AnalysisReport>> stackAnalysisBatch(
+      final Path workspaceDir, final Set<String> ignorePatterns) throws IOException {
+    return this.performBatchAnalysis(
+        () -> getBatchStackSboms(workspaceDir, ignorePatterns),
+        MediaType.APPLICATION_JSON,
+        HttpResponse.BodyHandlers.ofString(),
+        this::getBatchStackAnalysisReports,
+        Collections::emptyMap,
+        "Batch Stack Analysis");
+  }
+
+  @Override
+  public CompletableFuture<byte[]> stackAnalysisBatchHtml(
+      final Path workspaceDir, final Set<String> ignorePatterns) throws IOException {
+    return this.performBatchAnalysis(
+        () -> getBatchStackSboms(workspaceDir, ignorePatterns),
+        MediaType.TEXT_HTML,
+        HttpResponse.BodyHandlers.ofByteArray(),
+        HttpResponse::body,
+        () -> new byte[0],
+        "Batch Stack Analysis");
+  }
+
+  Map<String, JsonNode> getBatchStackSboms(
+      final Path workspaceDir, final Set<String> ignorePatterns) {
+    boolean continueOnError = Environment.getBoolean("TRUSTIFY_DA_CONTINUE_ON_ERROR", false);
+    try {
+      List<Path> manifests =
+          JsWorkspaceDiscovery.discoverWorkspaceManifests(workspaceDir, ignorePatterns);
+      if (manifests.isEmpty()) {
+        LOG.warning("No workspace members discovered in " + workspaceDir);
+        return Collections.emptyMap();
+      }
+
+      return manifests.parallelStream()
+          .map(
+              manifest -> {
+                try {
+                  var provider = Ecosystem.getProvider(manifest);
+                  var content = provider.provideStack();
+                  var sbomJson = mapper.readTree(content.buffer);
+                  String key = manifest.getParent().getFileName().toString();
+                  return new AbstractMap.SimpleEntry<>(key, sbomJson);
+                } catch (Exception ex) {
+                  if (continueOnError) {
+                    LOG.warning(
+                        String.format(
+                            "Skipping manifest %s due to error: %s", manifest, ex.getMessage()));
+                    return null;
+                  }
+                  throw new RuntimeException("Failed to generate SBOM for " + manifest, ex);
+                }
+              })
+          .filter(Objects::nonNull)
+          .collect(
+              Collectors.toMap(AbstractMap.SimpleEntry::getKey, AbstractMap.SimpleEntry::getValue));
+    } catch (IOException e) {
+      throw new RuntimeException("Failed to discover workspace manifests", e);
+    }
+  }
+
+  Map<String, AnalysisReport> getBatchStackAnalysisReports(
+      final HttpResponse<String> httpResponse) {
+    if (httpResponse.statusCode() == 200) {
+      try {
+        Map<?, ?> reports = this.mapper.readValue(httpResponse.body(), Map.class);
+        return reports.entrySet().stream()
+            .collect(
+                Collectors.toMap(
+                    e -> e.getKey().toString(),
+                    e -> mapper.convertValue(e.getValue(), AnalysisReport.class)));
+      } catch (JsonProcessingException e) {
+        throw new CompletionException(e);
+      }
+    } else {
+      return Collections.emptyMap();
+    }
+  }
+
   /**
    * Build an HTTP request for sending to the Backend API.
    *

src/main/java/io/github/guacsec/trustifyda/providers/JavaScriptProviderFactory.java

@@ -16,11 +16,15 @@
  */
 package io.github.guacsec.trustifyda.providers;
 
+import io.github.guacsec.trustifyda.providers.javascript.workspace.JsWorkspaceDiscovery;
+import io.github.guacsec.trustifyda.tools.Operations;
+import io.github.guacsec.trustifyda.utils.Environment;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Map;
 import java.util.function.Function;
 
+/** Factory for creating the appropriate {@link JavaScriptProvider} based on lock file presence. */
 public final class JavaScriptProviderFactory {
 
   private static final Map<String, Function<Path, JavaScriptProvider>> JS_PROVIDERS =
@@ -29,18 +33,78 @@ public final class JavaScriptProviderFactory {
           JavaScriptYarnProvider.LOCK_FILE, JavaScriptYarnProvider::new,
           JavaScriptPnpmProvider.LOCK_FILE, JavaScriptPnpmProvider::new);
 
+  /**
+   * Creates a JavaScript provider by locating the lock file. Checks the manifest directory first,
+   * then walks up parent directories to find the lock file at a workspace root.
+   *
+   * @param manifestPath the path to the package.json manifest
+   * @return the matching JavaScript provider
+   * @throws IllegalStateException if no supported lock file is found
+   */
   public static JavaScriptProvider create(final Path manifestPath) {
     var manifestDir = manifestPath.getParent();
+
+    // Check manifest directory first (fast path)
     for (var entry : JS_PROVIDERS.entrySet()) {
       var lockFilePath = manifestDir.resolve(entry.getKey());
       if (Files.isRegularFile(lockFilePath)) {
         return entry.getValue().apply(manifestPath);
       }
     }
+
+    // Walk up parent directories to find lock file at workspace root
+    Path lockFileDir = findLockFileDirInParents(manifestDir);
+    if (lockFileDir != null) {
+      for (var entry : JS_PROVIDERS.entrySet()) {
+        if (Files.isRegularFile(lockFileDir.resolve(entry.getKey()))) {
+          return entry.getValue().apply(manifestPath);
+        }
+      }
+    }
+
     var validLockFiles = String.join(",", JS_PROVIDERS.keySet());
     throw new IllegalStateException(
         String.format(
             "No known lock file found for %s. Supported lock files: %s",
             manifestPath, validLockFiles));
   }
+
+  private static Path findLockFileDirInParents(Path startDir) {
+    // Environment override takes precedence
+    String workspaceDirOverride = Environment.get("TRUSTIFY_DA_WORKSPACE_DIR");
+    if (workspaceDirOverride != null && !workspaceDirOverride.isBlank()) {
+      Path overrideDir = Path.of(workspaceDirOverride);
+      for (String lockFile : JS_PROVIDERS.keySet()) {
+        if (Files.isRegularFile(overrideDir.resolve(lockFile))) {
+          return overrideDir;
+        }
+      }
+      return null;
+    }
+
+    String gitRoot = Operations.getGitRootDir(startDir.toString()).orElse(null);
+    Path boundary = gitRoot != null ? Path.of(gitRoot) : startDir.toAbsolutePath().getRoot();
+
+    Path current = startDir.toAbsolutePath().normalize().getParent();
+    while (current != null) {
+      for (String lockFile : JS_PROVIDERS.keySet()) {
+        if (Files.isRegularFile(current.resolve(lockFile))) {
+          return current;
+        }
+      }
+
+      // Stop at workspace root boundary
+      if (JsWorkspaceDiscovery.isWorkspaceRoot(current)) {
+        return null;
+      }
+
+      if (current.equals(boundary.toAbsolutePath().normalize())) {
+        break;
+      }
+
+      current = current.getParent();
+    }
+
+    return null;
+  }
 }