feat(workspace): add Go workspace (go.work) discovery

Author: Strum355

src/index.js

@@ -8,6 +8,7 @@ import fs from 'node:fs'
 import { getCustom } from "./tools.js";
 import { resolveBatchMetadata, resolveContinueOnError } from './batch_opts.js'
 import {
+	discoverGoWorkspaceModules,
 	discoverWorkspaceCrates,
 	discoverWorkspacePackages,
 	filterManifestPathsByDiscoveryIgnore,
@@ -23,6 +24,7 @@ export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDeta
 
 export default { componentAnalysis, stackAnalysis, stackAnalysisBatch, imageAnalysis, validateToken, generateSbom }
 export {
+	discoverGoWorkspaceModules,
 	discoverWorkspacePackages,
 	discoverWorkspaceCrates,
 	validatePackageJson,
@@ -319,7 +321,7 @@ async function generateOneSbom(manifestPath, workspaceOpts) {
  *
  * @param {string} root - Resolved workspace root
  * @param {Options} opts
- * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'unknown', manifestPaths: string[] }>}
+ * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'gomodules' | 'unknown', manifestPaths: string[] }>}
  * @private
  */
 async function detectWorkspaceManifests(root, opts) {
@@ -331,6 +333,13 @@ async function detectWorkspaceManifests(root, opts) {
 		return { ecosystem: 'cargo', manifestPaths: await discoverWorkspaceCrates(root, opts) }
 	}
 
+	if (fs.existsSync(path.join(root, 'go.work'))) {
+		const manifestPaths = await discoverGoWorkspaceModules(root, opts)
+		if (manifestPaths.length > 0) {
+			return { ecosystem: 'gomodules', manifestPaths }
+		}
+	}
+
 	const hasJsLock = fs.existsSync(path.join(root, 'pnpm-lock.yaml'))
 		|| fs.existsSync(path.join(root, 'yarn.lock'))
 		|| fs.existsSync(path.join(root, 'package-lock.json'))
@@ -489,7 +498,7 @@ async function stackAnalysisBatch(workspaceRoot, html = false, opts = {}) {
 	}
 
 	if (manifestPaths.length === 0) {
-		throw new Error(`No workspace manifests found at ${root}. Ensure Cargo.toml+Cargo.lock or package.json+lock file exist.`)
+		throw new Error(`No workspace manifests found at ${root}. Ensure a supported workspace root exists (Cargo.toml+Cargo.lock, go.work, or package.json+lock file).`)
 	}
 
 	const workspaceOpts = { ...opts, TRUSTIFY_DA_WORKSPACE_DIR: root }

src/workspace.js

@@ -269,3 +269,56 @@ export async function discoverWorkspaceCrates(workspaceRoot, opts = {}) {
 	const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts)
 	return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns)
 }
+
+/**
+ * Discover all go.mod manifest paths in a Go workspace.
+ * Uses `go work edit -json` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain go.work)
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to go.mod files (absolute)
+ */
+export async function discoverGoWorkspaceModules(workspaceRoot, opts = {}) {
+	const root = path.resolve(workspaceRoot)
+	const goWork = path.join(root, 'go.work')
+
+	if (!fs.existsSync(goWork)) {
+		return []
+	}
+
+	const goBin = getCustomPath('go', opts)
+	let output
+	try {
+		output = invokeCommand(goBin, ['work', 'edit', '-json', goWork], { cwd: root })
+	} catch {
+		return []
+	}
+
+	let workspace
+	try {
+		workspace = JSON.parse(output.toString().trim())
+	} catch {
+		return []
+	}
+
+	const useEntries = workspace.Use || []
+	if (useEntries.length === 0) {
+		return []
+	}
+
+	const manifestPaths = []
+	for (const entry of useEntries) {
+		const diskPath = entry.DiskPath
+		if (!diskPath) {
+			continue
+		}
+		const moduleDir = path.resolve(root, diskPath)
+		const goMod = path.join(moduleDir, 'go.mod')
+		if (fs.existsSync(goMod)) {
+			manifestPaths.push(goMod)
+		}
+	}
+
+	const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts)
+	return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns)
+}

test/providers/tst_manifests/golang/go_workspace/go.work

@@ -0,0 +1,6 @@
+go 1.22
+
+use (
+	./module-a
+	./module-b
+)

test/providers/tst_manifests/golang/go_workspace/module-a/go.mod

@@ -0,0 +1,3 @@
+module example.com/module-a
+
+go 1.22

test/providers/tst_manifests/golang/go_workspace/module-b/go.mod

@@ -0,0 +1,3 @@
+module example.com/module-b
+
+go 1.22

test/providers/tst_manifests/golang/go_workspace_missing_module/existing/go.mod

@@ -0,0 +1,3 @@
+module example.com/existing
+
+go 1.22

test/providers/tst_manifests/golang/go_workspace_missing_module/go.work

@@ -0,0 +1,6 @@
+go 1.22
+
+use (
+	./existing
+	./nonexistent
+)

test/providers/tst_manifests/golang/go_workspace_nested/go.work

@@ -0,0 +1,6 @@
+go 1.22
+
+use (
+	./libs/core
+	./libs/util
+)

test/providers/tst_manifests/golang/go_workspace_nested/libs/core/go.mod

@@ -0,0 +1,3 @@
+module example.com/libs/core
+
+go 1.22

test/providers/tst_manifests/golang/go_workspace_nested/libs/util/go.mod

@@ -0,0 +1,3 @@
+module example.com/libs/util
+
+go 1.22