feat: add support for pyproject.toml via uv & poetry

Author: Strum355

.github/workflows/test.yml

@@ -60,6 +60,12 @@ jobs:
         run: |
           echo "python-bin-location=$(echo $pythonLocation)/bin" >> $GITHUB_OUTPUT
 
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Install Poetry
+        run: pipx install poetry
+
       - name: setup go
         uses: actions/setup-go@v6
         with:

src/index.js

@@ -74,6 +74,8 @@ export {
  * TRUSTIFY_DA_CONTINUE_ON_ERROR?: string | undefined,
  * batchMetadata?: boolean | undefined,
  * TRUSTIFY_DA_BATCH_METADATA?: string | undefined,
+ * TRUSTIFY_DA_UV_PATH?: string | undefined,
+ * TRUSTIFY_DA_POETRY_PATH?: string | undefined,
  * [key: string]: string | number | boolean | string[] | undefined,
  * }} Options
  */

src/provider.js

@@ -8,6 +8,7 @@ import Javascript_npm from './providers/javascript_npm.js';
 import Javascript_pnpm from './providers/javascript_pnpm.js';
 import Javascript_yarn from './providers/javascript_yarn.js';
 import pythonPipProvider from './providers/python_pip.js'
+import pythonPyprojectProvider from './providers/python_pyproject.js'
 import rustCargoProvider from './providers/rust_cargo.js'
 
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
@@ -26,6 +27,7 @@ export const availableProviders = [
 	new Javascript_npm(),
 	golangGomodulesProvider,
 	pythonPipProvider,
+	pythonPyprojectProvider,
 	rustCargoProvider]
 
 /**

src/providers/python_pip.js

@@ -87,7 +87,7 @@ function addAllDependencies(source, dep, sbom) {
 	sbom.addDependency(source, targetPurl)
 	let directDeps = dep["dependencies"]
 	if (directDeps !== undefined && directDeps.length > 0) {
-		directDeps.forEach((dependency) => { addAllDependencies(toPurl(dep["name"],dep["version"]), dependency, sbom) })
+		directDeps.forEach((dependency) => { addAllDependencies(toPurl(dep["name"], dep["version"]), dependency, sbom) })
 	}
 }
 
@@ -123,7 +123,7 @@ async function getIgnoredDependencies(manifest) {
 async function handleIgnoredDependencies(manifest, sbom, opts = {}) {
 	let ignoredDeps = await getIgnoredDependencies(manifest)
 	let matchManifestVersions = getCustom("MATCH_MANIFEST_VERSIONS", "true", opts);
-	if(matchManifestVersions === "true") {
+	if (matchManifestVersions === "true") {
 		const ignoredDepsVersion = ignoredDeps.filter(dep => dep.version !== undefined);
 		sbom.filterIgnoredDepsIncludingVersion(ignoredDepsVersion.map(dep => dep.toString()))
 	} else {
@@ -150,7 +150,7 @@ function getPythonPipBinaries(binaries, opts) {
 			invokeCommand(python, ['--version'])
 			invokeCommand(pip, ['--version'])
 		} catch (error) {
-			throw new Error(`Failed checking for python/pip binaries from supplied environment variables`, {cause: error})
+			throw new Error(`Failed checking for python/pip binaries from supplied environment variables`, { cause: error })
 		}
 	}
 	binaries.pip = pip
@@ -240,6 +240,6 @@ async function getSbomForComponentAnalysis(manifest, opts = {}) {
  * @param version
  * @return {PackageURL}
  */
-function toPurl(name,version) {
+function toPurl(name, version) {
 	return new PackageURL('pypi', undefined, name, version, undefined, undefined);
 }