feat: support both exhortignore and trustify-da-ignore

Author: soul2zimate

README.md

@@ -177,14 +177,22 @@ public class TrustifyExample {
 
 <h3>Excluding Packages</h3>
 <p>
-Excluding a package from any analysis can be achieved by marking the package for exclusion.
+Excluding a package from any analysis can be achieved by marking the package for exclusion using either the <code>trustify-da-ignore</code> syntax or the legacy <code>exhortignore</code>.
 </p>
 
 <ul>
 <li>
 <em>Java Maven</em> users can add a comment in <em>pom.xml</em>
 
 ```xml
+<!-- Using trustify-da-ignore syntax -->
+<dependency> <!--trustify-da-ignore-->
+    <groupId>...</groupId>
+    <artifactId>...</artifactId>
+    <version>0.0.9-SNAPSHOT</version>
+</dependency>
+
+<!-- Using legacy exhortignore syntax -->
 <dependency> <!--exhortignore-->
   <groupId>...</groupId>
   <artifactId>...</artifactId>
@@ -193,10 +201,8 @@ Excluding a package from any analysis can be achieved by marking the package for
 ```
 </li>
 
-</ul>
-<ul>
 <li>
-<em>Javascript NPM </em> users can add a root (key, value) pair with value of list of names (strings) to be ignored (without versions), and key called <b>exhortignore</b> in <em>package.json</em>,  example:
+<em>Javascript NPM</em> users can add ignore arrays in <em>package.json</em>:
 
 ```json
 {
@@ -213,14 +219,21 @@ Excluding a package from any analysis can be achieved by marking the package for
     "jsonwebtoken": "^8.5.1",
     "mongoose": "^5.9.18"
   },
+  "trustify-da-ignore": [
+    "mongoose"
+  ],
   "exhortignore": [
     "jsonwebtoken"
   ]
 }
-
 ```
 
-<em>Golang</em> users can add in go.mod a comment with //exhortignore next to the package to be ignored, or to "piggyback" on existing comment ( e.g - //indirect) , for example:
+Both arrays can coexist in the same package.json file.
+</li>
+
+<li>
+<em>Golang</em> users can add comments in <em>go.mod</em>:
+
 ```go
 module github.com/RHEcosystemAppEng/SaaSi/deployer
 
@@ -230,7 +243,7 @@ require (
         github.com/gin-gonic/gin v1.9.1
         github.com/google/uuid v1.1.2
         github.com/jessevdk/go-flags v1.5.0 //exhortignore
-        github.com/kr/pretty v0.3.1
+        github.com/kr/pretty v0.3.1 //trustify-da-ignore
         gopkg.in/yaml.v2 v2.4.0
         k8s.io/apimachinery v0.26.1
         k8s.io/client-go v0.26.1
@@ -239,12 +252,14 @@ require (
 require (
         github.com/davecgh/go-spew v1.1.1 // indirect exhortignore
         github.com/emicklei/go-restful/v3 v3.9.0 // indirect
-        github.com/go-logr/logr v1.2.3 // indirect //exhortignore
-
+        github.com/go-logr/logr v1.2.3 // indirect trustify-da-ignore
 )
 ```
+</li>
+
+<li>
+<em>Python pip</em> users can add comments in <em>requirements.txt</em>:
 
-<em>Python pip</em> users can add in requirement text a comment with #exhortignore(or # exhortignore) to the right of the same artifact to be ignored, for example:
 ```properties
 anyio==3.6.2
 asgiref==3.4.1
@@ -262,9 +277,9 @@ importlib-metadata==4.8.3
 itsdangerous==2.0.1
 Jinja2==3.0.3
 MarkupSafe==2.0.1
-pydantic==1.9.2 # exhortignore
+pydantic==1.9.2 # trustify-da-ignore
 requests==2.25.1
-six==1.16.0 
+six==1.16.0
 sniffio==1.2.0
 soupsieve==2.3.2.post1
 starlette==0.17.1
@@ -273,12 +288,15 @@ urllib3==1.26.16
 uvicorn==0.17.0
 Werkzeug==2.0.3
 zipp==3.6.0
-
 ```
-<em>Gradle</em> users can add in build.gradle a comment with //exhortignore next to the package to be ignored:
-```build.gradle
+</li>
+
+<li>
+<em>Gradle</em> users can add comments in <em>build.gradle</em>:
+
+```groovy
 plugins {
-id 'java'
+    id 'java'
 }
 
 group = 'groupName'
@@ -290,24 +308,27 @@ repositories {
 
 dependencies {
     implementation "groupId:artifactId:version" // exhortignore
+    implementation "anotherGroup:anotherArtifact:version" // trustify-da-ignore
 }
+
 test {
     useJUnitPlatform()
 }
 ```
+</li>
+
 </ul>
-All of the 5 above examples are valid for marking a package to be ignored 
+
+#### Migration from exhortignore to trustify-da-ignore
+Both `exhortignore` and `trustify-da-ignore` patterns work identically and can be used interchangeably. The `trustify-da-ignore` syntax is recommended for new projects, while `exhortignore` continues to be supported for backwards compatibility. You can gradually migrate your projects or use both patterns in the same manifest.
 
 #### Ignore Strategies - experimental
- You can specify the method to ignore dependencies in manifest (globally), by setting the environment variable `TRUSTIFY_DA_IGNORE_METHOD` to one of the following values: \
- **_Possible values:_**
-- `insensitive` - ignoring the dependency and all of its subtree(all transitives) - default.
-- `sensitive` - ignoring the dependency but let its transitives remain if they are also transitive of another dependency in the tree or if they're direct dependency of root in the dependency tree.
-  
 
-</li>
+You can specify the method to ignore dependencies in manifest (globally), by setting the environment variable `TRUSTIFY_DA_IGNORE_METHOD` to one of the following values:
 
-</ul>
+**Possible values:**
+- `insensitive` - ignoring the dependency and all of its subtree(all transitives) - default.
+- `sensitive` - ignoring the dependency but let its transitives remain if they are also transitive of another dependency in the tree or if they're direct dependency of root in the dependency tree.
 
 <h3>Customization</h3>
 <p>

src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java

@@ -28,6 +28,7 @@
 import io.github.guacsec.trustifyda.tools.Ecosystem.Type;
 import io.github.guacsec.trustifyda.tools.Operations;
 import io.github.guacsec.trustifyda.utils.Environment;
+import io.github.guacsec.trustifyda.utils.IgnorePatternDetector;
 import io.github.guacsec.trustifyda.vcs.GitVersionControlSystemImpl;
 import io.github.guacsec.trustifyda.vcs.TagInfo;
 import io.github.guacsec.trustifyda.vcs.VersionControlSystem;
@@ -459,15 +460,16 @@ private String extractPackageName(String line) {
 
   public boolean IgnoredLine(String line) {
     boolean result = false;
-    if (line.contains("exhortignore")) {
-      // if exhortignore is alone in a comment or is in a comment together with indirect or as a
+    if (IgnorePatternDetector.containsIgnorePattern(line)) {
+      // if exhortignore or trustify-da-ignore is alone in a comment or is in a comment together
+      // with indirect or as a
       // comment inside a
       // comment ( e.g // indirect  //exhort)
       // then this line is to be checked if it's a comment after a package name.
-      if (Pattern.matches(".+//\\s*exhortignore", line)
-          || Pattern.matches(".+//\\sindirect (//)?\\s*exhortignore", line)) {
+      if (Pattern.matches(".+//\\s*(exhortignore|trustify-da-ignore)", line)
+          || Pattern.matches(".+//\\sindirect (//)?\\s*(exhortignore|trustify-da-ignore)", line)) {
         String trimmedRow = line.trim();
-        // filter out lines where exhortignore has no meaning
+        // filter out lines where exhortignore or trustify-da-ignore has no meaning
         if (!trimmedRow.startsWith("module ")
             && !trimmedRow.startsWith("go ")
             && !trimmedRow.startsWith("require (")

src/main/java/io/github/guacsec/trustifyda/providers/GradleProvider.java

@@ -27,6 +27,7 @@
 import io.github.guacsec.trustifyda.sbom.SbomFactory;
 import io.github.guacsec.trustifyda.tools.Ecosystem.Type;
 import io.github.guacsec.trustifyda.tools.Operations;
+import io.github.guacsec.trustifyda.utils.IgnorePatternDetector;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -202,7 +203,7 @@ private boolean depHasLibsNotation(String depToBeIgnored) {
   }
 
   private boolean isIgnoredLine(String line) {
-    return line.contains("exhortignore");
+    return IgnorePatternDetector.containsIgnorePattern(line);
   }
 
   private String extractPackageName(String line) {

src/main/java/io/github/guacsec/trustifyda/providers/JavaMavenProvider.java

@@ -28,6 +28,7 @@
 import io.github.guacsec.trustifyda.tools.Ecosystem.Type;
 import io.github.guacsec.trustifyda.tools.Operations;
 import io.github.guacsec.trustifyda.utils.Environment;
+import io.github.guacsec.trustifyda.utils.IgnorePatternDetector;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -277,7 +278,7 @@ private List<DependencyAggregator> getDependencies(final Path manifestPath) thro
         if (!Objects.isNull(dependencyAggregator)) {
           // if we hit an ignore comment, mark aggregator to be ignored
           if (reader.getEventType() == XMLStreamConstants.COMMENT
-              && "exhortignore".equals(reader.getText().strip())) {
+              && IgnorePatternDetector.isIgnoreComment(reader.getText())) {
             dependencyAggregator.ignored = true;
             continue;
           }

src/main/java/io/github/guacsec/trustifyda/providers/JavaScriptProvider.java

@@ -36,10 +36,8 @@
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Iterator;
-import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.TreeMap;
@@ -240,18 +238,6 @@ protected String parseDepTreeOutput(String output) {
     return output;
   }
 
-  protected List<String> getIgnoredDeps(JsonNode manifest) {
-    var ignored = new ArrayList<String>();
-    var ignoredNode = manifest.withArray("exhortignore");
-    if (ignoredNode == null) {
-      return ignored;
-    }
-    for (JsonNode n : ignoredNode) {
-      ignored.add(n.asText());
-    }
-    return ignored;
-  }
-
   protected Map<String, String> getExecEnv() {
     String pathEnv = Environment.get(pathEnv());
     if (pathEnv != null && !pathEnv.isBlank()) {

src/main/java/io/github/guacsec/trustifyda/providers/PythonPipProvider.java

@@ -29,6 +29,7 @@
 import io.github.guacsec.trustifyda.tools.Ecosystem;
 import io.github.guacsec.trustifyda.tools.Operations;
 import io.github.guacsec.trustifyda.utils.Environment;
+import io.github.guacsec.trustifyda.utils.IgnorePatternDetector;
 import io.github.guacsec.trustifyda.utils.PythonControllerBase;
 import io.github.guacsec.trustifyda.utils.PythonControllerRealEnv;
 import io.github.guacsec.trustifyda.utils.PythonControllerVirtualEnv;
@@ -173,7 +174,7 @@ private Set<PackageURL> getIgnoredDependencies(String requirementsDeps) {
     String[] requirementsLines = requirementsDeps.split(System.lineSeparator());
     Set<PackageURL> collected =
         Arrays.stream(requirementsLines)
-            .filter(line -> line.contains("#exhortignore") || line.contains("# exhortignore"))
+            .filter(IgnorePatternDetector::containsPythonIgnorePattern)
             .map(PythonPipProvider::extractDepFull)
             .map(this::splitToNameVersion)
             .map(dep -> toPurl(dep[0], dep[1]))

src/main/java/io/github/guacsec/trustifyda/providers/javascript/model/Manifest.java

@@ -70,12 +70,16 @@ private Set<String> loadDependencies(JsonNode content) {
   private Set<String> loadIgnored(JsonNode content) {
     var names = new HashSet<String>();
     if (content != null) {
-      var ignore = (ArrayNode) content.get("exhortignore");
-      if (ignore == null || ignore.isEmpty()) {
-        return Collections.emptySet();
-      }
+      processIgnoreArray(content, "exhortignore", names);
+      processIgnoreArray(content, "trustify-da-ignore", names);
+    }
+    return names.isEmpty() ? Collections.emptySet() : Collections.unmodifiableSet(names);
+  }
+
+  private void processIgnoreArray(JsonNode content, String key, Set<String> names) {
+    var ignore = (ArrayNode) content.get(key);
+    if (ignore != null && !ignore.isEmpty()) {
       ignore.forEach(n -> names.add(n.asText()));
     }
-    return Collections.unmodifiableSet(names);
   }
 }

src/main/java/io/github/guacsec/trustifyda/utils/IgnorePatternDetector.java

@@ -0,0 +1,64 @@
+/*
+ * Copyright 2023-2025 Trustify Dependency Analytics Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.github.guacsec.trustifyda.utils;
+
+/**
+ * Utility class for detecting ignore patterns in dependency manifests. Supports both legacy
+ * 'exhortignore' and new 'trustify-da-ignore' patterns for backwards compatibility.
+ */
+public class IgnorePatternDetector {
+
+  public static final String LEGACY_IGNORE_PATTERN = "exhortignore";
+  public static final String NEW_IGNORE_PATTERN = "trustify-da-ignore";
+
+  /**
+   * Checks if a text line contains any ignore pattern (exhortignore or trustify-da-ignore). Used
+   * for inline comment detection in requirements.txt, go.mod, build.gradle, etc.
+   *
+   * @param text the text to check
+   * @return true if the text contains any ignore pattern
+   */
+  public static boolean containsIgnorePattern(String text) {
+    return text.contains(LEGACY_IGNORE_PATTERN) || text.contains(NEW_IGNORE_PATTERN);
+  }
+
+  /**
+   * Checks if a comment text exactly matches an ignore pattern. Used for XML comment detection in
+   * pom.xml files.
+   *
+   * @param commentText the comment text to check (will be stripped of whitespace)
+   * @return true if the comment exactly matches an ignore pattern
+   */
+  public static boolean isIgnoreComment(String commentText) {
+    String stripped = commentText.strip();
+    return LEGACY_IGNORE_PATTERN.equals(stripped) || NEW_IGNORE_PATTERN.equals(stripped);
+  }
+
+  /**
+   * Checks if a text line contains a Python pip ignore pattern. Handles both '#exhortignore' and
+   * '#trustify-da-ignore' with optional spacing.
+   *
+   * @param line the line to check
+   * @return true if the line contains a Python pip ignore pattern
+   */
+  public static boolean containsPythonIgnorePattern(String line) {
+    return line.contains("#" + LEGACY_IGNORE_PATTERN)
+        || line.contains("# " + LEGACY_IGNORE_PATTERN)
+        || line.contains("#" + NEW_IGNORE_PATTERN)
+        || line.contains("# " + NEW_IGNORE_PATTERN);
+  }
+}