refactor: use TRUSTIFY_DA_WORKSPACE_DIR convention consistently

Remove the opts.workspaceDir fallback pattern and use only the
TRUSTIFY_DA_WORKSPACE_DIR key through getCustom(), keeping the
existing single-convention pattern for option propagation.

TC-3862

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

src/cli.js

@@ -31,7 +31,7 @@ const component = {
 	}),
 	handler: async args => {
 		let manifestName = args['/path/to/manifest']
-		const opts = args.workspaceDir ? { workspaceDir: args.workspaceDir } : {}
+		const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {}
 		let res = await client.componentAnalysis(manifestName, opts)
 		console.log(JSON.stringify(res, null, 2))
 	}
@@ -157,7 +157,7 @@ const stack = {
 		let manifest = args['/path/to/manifest']
 		let html = args['html']
 		let summary = args['summary']
-		const opts = args.workspaceDir ? { workspaceDir: args.workspaceDir } : {}
+		const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {}
 		let theProvidersSummary = new Map();
 		let theProvidersObject ={}
 		let res = await client.stackAnalysis(manifest, html, opts)

src/index.js

@@ -65,7 +65,7 @@ export {
  * TRUSTIFY_DA_SOURCE?: string | undefined,
  * TRUSTIFY_DA_TOKEN?: string | undefined,
  * TRUSTIFY_DA_TELEMETRY_ID?: string | undefined,
- * workspaceDir?: string | undefined,
+ * TRUSTIFY_DA_WORKSPACE_DIR?: string | undefined,
  * batchConcurrency?: number | undefined,
  * TRUSTIFY_DA_BATCH_CONCURRENCY?: string | undefined,
  * workspaceDiscoveryIgnore?: string[] | undefined,
@@ -280,7 +280,7 @@ function buildBatchAnalysisMetadata(root, ecosystem, totalSbomAttempts, successf
  * Generate an SBOM for a single manifest, returning a normalized result.
  *
  * @param {string} manifestPath
- * @param {Options} workspaceOpts - opts with `workspaceDir` set
+ * @param {Options} workspaceOpts - opts with `TRUSTIFY_DA_WORKSPACE_DIR` set
  * @returns {Promise<SbomResult>}
  * @private
  */
@@ -473,7 +473,7 @@ async function stackAnalysisBatch(workspaceRoot, html = false, opts = {}) {
 		throw new Error(`No workspace manifests found at ${root}. Ensure Cargo.toml+Cargo.lock or package.json+lock file exist.`)
 	}
 
-	const workspaceOpts = { ...opts, workspaceDir: root }
+	const workspaceOpts = { ...opts, TRUSTIFY_DA_WORKSPACE_DIR: root }
 	const concurrency = resolveBatchConcurrency(opts)
 
 	let sbomByPurl

src/provider.js

@@ -51,7 +51,7 @@ export function matchForLicense(manifestPath, providers) {
  * Each provider MUST export 'provideStack' taking manifest path returning a {@link Provided}.
  * @param {string} manifest - the name-type or path of the manifest
  * @param {[Provider]} providers - list of providers to iterate over
- * @param {{workspaceDir?: string, TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional; workspaceDir (or TRUSTIFY_DA_WORKSPACE_DIR) overrides lock file location for workspaces
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional; TRUSTIFY_DA_WORKSPACE_DIR overrides lock file location for workspaces
  * @returns {Provider}
  * @throws {Error} when the manifest is not supported and no provider was matched
  */

src/providers/base_javascript.js

@@ -113,14 +113,14 @@ export default class Base_javascript {
 
 	/**
    * Checks if a required lock file exists in the manifest directory or at the workspace root.
-   * When workspaceDir is provided (e.g. from TRUSTIFY_DA_WORKSPACE_DIR or opts.workspaceDir),
+   * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
    * checks only that directory for the lock file.
    * @param {string} manifestDir - The base directory where the manifest is located
-   * @param {{workspaceDir?: string, TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
+   * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
    * @returns {boolean} True if the lock file exists
    */
 	validateLockFile(manifestDir, opts = {}) {
-		const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts) ?? opts.workspaceDir
+		const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts)
 		const dirToCheck = workspaceDir ? path.resolve(workspaceDir) : manifestDir
 		const lock = path.join(dirToCheck, this._lockFileName())
 		return fs.existsSync(lock)
@@ -181,14 +181,14 @@ export default class Base_javascript {
 	/**
    * Builds the dependency tree for the project
    * @param {boolean} includeTransitive - Whether to include transitive dependencies
-   * @param {Object} [opts={}] - Configuration options; when `workspaceDir` is set, commands run from workspace root
+   * @param {Object} [opts={}] - Configuration options; when `TRUSTIFY_DA_WORKSPACE_DIR` is set, commands run from workspace root
    * @returns {Object} The dependency tree
    * @protected
    */
 	_buildDependencyTree(includeTransitive, opts = {}) {
 		this._version();
 		const manifestDir = path.dirname(this.#manifest.manifestPath);
-		const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts) ?? opts.workspaceDir
+		const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts)
 		const cmdDir = workspaceDir ? path.resolve(workspaceDir) : manifestDir;
 		this.#createLockFile(cmdDir);
 

src/providers/rust_cargo.js

@@ -102,14 +102,14 @@ function readLicenseFromManifest(manifestPath) {
  * up the directory tree looking for Cargo.lock (stopping when we find a
  * Cargo.toml that contains a [workspace] section, or when we reach the
  * filesystem root).
- * When workspaceDir is provided (e.g. from TRUSTIFY_DA_WORKSPACE_DIR or opts.workspaceDir),
+ * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
  * checks only that directory for Cargo.lock — no walk-up.
  * @param {string} manifestDir - the directory where the manifest lies
- * @param {{workspaceDir?: string, TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
  * @returns {boolean} true if Cargo.lock is found
  */
 function validateLockFile(manifestDir, opts = {}) {
-	const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts) ?? opts.workspaceDir
+	const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts)
 	if (workspaceDir) {
 		const dir = path.resolve(workspaceDir)
 		return fs.existsSync(path.join(dir, 'Cargo.lock'))

test/providers/javascript.test.js

@@ -152,17 +152,17 @@ suite('testing the javascript-npm data provider', async () => {
 		expect(() => new Manifest(manifestPath)).to.throw(Error);
 	});
 
-	test('verify match with opts.workspaceDir finds npm provider when lock is at workspace root', () => {
+	test('verify match with opts.TRUSTIFY_DA_WORKSPACE_DIR finds npm provider when lock is at workspace root', () => {
 		const manifest = 'test/providers/provider_manifests/npm/with_lock_file/package.json'
-		const opts = { workspaceDir: 'test/providers/provider_manifests/npm/with_lock_file' }
+		const opts = { TRUSTIFY_DA_WORKSPACE_DIR: 'test/providers/provider_manifests/npm/with_lock_file' }
 		const provider = match(manifest, availableProviders, opts)
 		expect(provider).to.not.be.null
 		expect(provider.isSupported('package.json')).to.be.true
 	})
 
-	test('verify match with opts.workspaceDir finds pnpm provider when lock is at workspace root', () => {
+	test('verify match with opts.TRUSTIFY_DA_WORKSPACE_DIR finds pnpm provider when lock is at workspace root', () => {
 		const manifest = 'test/providers/provider_manifests/pnpm/with_lock_file/package.json'
-		const opts = { workspaceDir: 'test/providers/provider_manifests/pnpm/with_lock_file' }
+		const opts = { TRUSTIFY_DA_WORKSPACE_DIR: 'test/providers/provider_manifests/pnpm/with_lock_file' }
 		const provider = match(manifest, availableProviders, opts)
 		expect(provider).to.not.be.null
 		expect(provider.isSupported('package.json')).to.be.true

test/providers/rust_cargo.test.js

@@ -126,18 +126,18 @@ suite('testing the rust-cargo data provider', () => {
 		expect(rustCargo.validateLockFile('test/providers/provider_manifests/cargo/workspace_member_without_lock/member1')).to.equal(false)
 	})
 
-	test('verify validateLockFile with opts.workspaceDir returns true when Cargo.lock exists at workspace root', () => {
+	test('verify validateLockFile with opts.TRUSTIFY_DA_WORKSPACE_DIR returns true when Cargo.lock exists at workspace root', () => {
 		const workspaceRoot = 'test/providers/provider_manifests/cargo/workspace_member_with_lock'
-		expect(rustCargo.validateLockFile('test/providers/provider_manifests/cargo/workspace_member_with_lock/member1', { workspaceDir: workspaceRoot })).to.equal(true)
+		expect(rustCargo.validateLockFile('test/providers/provider_manifests/cargo/workspace_member_with_lock/member1', { TRUSTIFY_DA_WORKSPACE_DIR: workspaceRoot })).to.equal(true)
 	})
 
-	test('verify validateLockFile with opts.workspaceDir returns false when Cargo.lock is not at workspace root', () => {
+	test('verify validateLockFile with opts.TRUSTIFY_DA_WORKSPACE_DIR returns false when Cargo.lock is not at workspace root', () => {
 		const wrongDir = 'test/providers/provider_manifests/cargo/workspace_member_without_lock'
-		expect(rustCargo.validateLockFile('test/providers/provider_manifests/cargo/workspace_member_with_lock/member1', { workspaceDir: wrongDir })).to.equal(false)
+		expect(rustCargo.validateLockFile('test/providers/provider_manifests/cargo/workspace_member_with_lock/member1', { TRUSTIFY_DA_WORKSPACE_DIR: wrongDir })).to.equal(false)
 	})
 
-	test('verify match with opts.workspaceDir finds Cargo provider when lock is at workspace root', () => {
-		const opts = { workspaceDir: 'test/providers/provider_manifests/cargo/workspace_member_with_lock' }
+	test('verify match with opts.TRUSTIFY_DA_WORKSPACE_DIR finds Cargo provider when lock is at workspace root', () => {
+		const opts = { TRUSTIFY_DA_WORKSPACE_DIR: 'test/providers/provider_manifests/cargo/workspace_member_with_lock' }
 		const provider = match('test/providers/provider_manifests/cargo/workspace_member_with_lock/member1/Cargo.toml', availableProviders, opts)
 		expect(provider).to.not.be.null
 		expect(provider.isSupported('Cargo.toml')).to.be.true