feat: add support for UV/poetry workspaces

Implements TC-4039

Author: Strum355

src/providers/base_pyproject.js

@@ -6,6 +6,7 @@ import { parse as parseToml } from 'smol-toml'
 
 import { getLicense } from '../license/license_utils.js'
 import Sbom from '../sbom.js'
+import { getCustom } from '../tools.js'
 
 const ecosystem = 'pip'
 
@@ -31,10 +32,73 @@ export default class Base_pyproject {
 
 	/**
 	 * @param {string} manifestDir
+	 * @param {Object} [opts={}]
+	 * @returns {boolean}
+	 */
+	validateLockFile(manifestDir, opts = {}) {
+		return this._findLockFileDir(manifestDir, opts) != null
+	}
+
+	/**
+	 * Walk up from manifestDir to find the directory containing the lock file.
+	 * Follows the same pattern as Base_javascript._findLockFileDir().
+	 * @param {string} manifestDir
+	 * @param {Object} [opts={}]
+	 * @returns {string|null}
+	 * @protected
+	 */
+	_findLockFileDir(manifestDir, opts = {}) {
+		const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts)
+		if (workspaceDir) {
+			const dir = path.resolve(workspaceDir)
+			return fs.existsSync(path.join(dir, this._lockFileName())) ? dir : null
+		}
+
+		let dir = path.resolve(manifestDir)
+		let parent = dir
+
+		do {
+			dir = parent
+
+			if (fs.existsSync(path.join(dir, this._lockFileName()))) {
+				return dir
+			}
+
+			if (this._isWorkspaceRoot(dir)) {
+				return null
+			}
+
+			parent = path.dirname(dir)
+		} while (parent !== dir)
+
+		return null
+	}
+
+	/**
+	 * Detect Python workspace root boundaries.
+	 * - uv: pyproject.toml with [tool.uv.workspace] section
+	 * - poetry: pyproject.toml with [tool.poetry] alongside poetry.lock
+	 * @param {string} dir
 	 * @returns {boolean}
+	 * @protected
 	 */
-	validateLockFile(manifestDir) {
-		return fs.existsSync(path.join(manifestDir, this._lockFileName()))
+	_isWorkspaceRoot(dir) {
+		const pyprojectPath = path.join(dir, 'pyproject.toml')
+		if (!fs.existsSync(pyprojectPath)) {
+			return false
+		}
+		try {
+			const content = parseToml(fs.readFileSync(pyprojectPath, 'utf-8'))
+			if (content.tool?.uv?.workspace) {
+				return true
+			}
+			if (content.tool?.poetry && fs.existsSync(path.join(dir, 'poetry.lock'))) {
+				return true
+			}
+		} catch (_) {
+			// ignore parse errors
+		}
+		return false
 	}
 
 	/**
@@ -284,7 +348,8 @@ export default class Base_pyproject {
 		let content = fs.readFileSync(manifest, 'utf-8')
 		let parsed = parseToml(content)
 
-		let { directDeps, graph } = await this._getDependencyData(manifestDir, parsed, opts)
+		let lockFileDir = this._findLockFileDir(manifestDir, opts) || manifestDir
+		let { directDeps, graph } = await this._getDependencyData(lockFileDir, parsed, opts)
 
 		let ignoredDeps = this._getIgnoredDeps(manifest)
 		let dependencies = this._buildDependencyTree(graph, directDeps, ignoredDeps, includeTransitive)

src/providers/python_uv.js

@@ -1,3 +1,8 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+import { parse as parseToml } from 'smol-toml'
+
 import { environmentVariableIsPopulated, getCustomPath, invokeCommand } from '../tools.js'
 
 import Base_pyproject from './base_pyproject.js'
@@ -24,7 +29,7 @@ export default class Python_uv extends Base_pyproject {
 	async _getDependencyData(manifestDir, parsed, opts) {
 		let projectName = this._getProjectName(parsed)
 		let uvOutput = this._getUvExportOutput(manifestDir, opts)
-		return this._parseUvExport(uvOutput, projectName)
+		return this._parseUvExport(uvOutput, projectName, manifestDir)
 	}
 
 	/**
@@ -47,9 +52,10 @@ export default class Python_uv extends Base_pyproject {
 	 *
 	 * @param {string} output
 	 * @param {string} projectName - canonical project name to identify direct deps
+	 * @param {string} manifestDir - directory where uv export was run (for resolving editable installs)
 	 * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
 	 */
-	async _parseUvExport(output, projectName) {
+	async _parseUvExport(output, projectName, manifestDir) {
 		let [parser, pinnedVersionQuery] = await Promise.all([
 			getParser(), getPinnedVersionQuery()
 		])
@@ -62,6 +68,30 @@ export default class Python_uv extends Base_pyproject {
 		let collectingVia = false
 
 		for (let child of root.children) {
+			if (child.type === 'global_opt') {
+				let optNode = child.children.find(c => c.type === 'option')
+				let pathNode = child.children.find(c => c.type === 'path')
+				if (optNode?.text === '-e' && pathNode && manifestDir) {
+					let memberDir = path.resolve(manifestDir, pathNode.text)
+					let memberManifest = path.join(memberDir, 'pyproject.toml')
+					if (fs.existsSync(memberManifest)) {
+						let memberParsed = parseToml(fs.readFileSync(memberManifest, 'utf-8'))
+						let name = memberParsed.project?.name || memberParsed.tool?.poetry?.name
+						let version = memberParsed.project?.version || memberParsed.tool?.poetry?.version
+						if (name && version) {
+							let key = this._canonicalize(name)
+							currentPkg = { name, version, parents: new Set() }
+							packages.set(key, currentPkg)
+							collectingVia = false
+							continue
+						}
+					}
+				}
+				currentPkg = null
+				collectingVia = false
+				continue
+			}
+
 			if (child.type === 'requirement') {
 				let nameNode = child.children.find(c => c.type === 'package')
 				if (!nameNode) { continue }

test/providers/python_pyproject.test.js

@@ -1,4 +1,5 @@
 import fs from 'fs'
+import path from 'path'
 
 import { expect } from 'chai'
 import { useFakeTimers } from 'sinon'
@@ -196,4 +197,187 @@ suite('testing the python-pyproject data provider', () => {
 		}
 	})
 
+	suite('workspace/monorepo support', () => {
+		const uvWorkspace = 'test/providers/tst_manifests/pyproject/uv_workspace'
+		const poetryWorkspace = 'test/providers/tst_manifests/pyproject/poetry_workspace'
+
+		test('uv validateLockFile finds uv.lock in parent directory', () => {
+			expect(uvProvider.validateLockFile(
+				path.join(uvWorkspace, 'packages/sub-pkg')
+			)).to.equal(true)
+		})
+
+		test('poetry validateLockFile finds poetry.lock in parent directory', () => {
+			expect(poetryProvider.validateLockFile(
+				path.join(poetryWorkspace, 'packages/sub-pkg')
+			)).to.equal(true)
+		})
+
+		test('validateLockFile stops at workspace root boundary when lock file is absent', () => {
+			let tmpDir = 'test/providers/tst_manifests/pyproject/boundary_test'
+			let subDir = path.join(tmpDir, 'packages', 'child')
+			fs.mkdirSync(subDir, { recursive: true })
+			// root has workspace marker but no lock file
+			fs.writeFileSync(path.join(tmpDir, 'pyproject.toml'),
+				'[tool.uv.workspace]\nmembers = ["packages/*"]\n')
+			fs.writeFileSync(path.join(subDir, 'pyproject.toml'),
+				'[project]\nname = "child"\nversion = "0.1.0"\n')
+			try {
+				expect(uvProvider.validateLockFile(subDir)).to.equal(false)
+			} finally {
+				fs.rmSync(tmpDir, { recursive: true, force: true })
+			}
+		})
+
+		test('poetry validateLockFile stops at workspace root boundary when lock file is absent', () => {
+			let tmpDir = 'test/providers/tst_manifests/pyproject/boundary_test_poetry'
+			let subDir = path.join(tmpDir, 'packages', 'child')
+			fs.mkdirSync(subDir, { recursive: true })
+			// root has [tool.poetry] + poetry.lock = workspace boundary
+			// but we're testing a DIFFERENT poetry provider that looks for poetry.lock
+			// The root IS the workspace root, and it HAS poetry.lock, so validateLockFile should return true
+			// To test boundary stop: create a nested workspace inside another
+			fs.writeFileSync(path.join(tmpDir, 'pyproject.toml'),
+				'[tool.poetry]\nname = "root"\nversion = "0.1.0"\n')
+			fs.writeFileSync(path.join(tmpDir, 'poetry.lock'), '')
+			fs.writeFileSync(path.join(subDir, 'pyproject.toml'),
+				'[tool.poetry]\nname = "child"\nversion = "0.1.0"\n')
+			try {
+				// poetry.lock exists at root, so walk-up should find it
+				expect(poetryProvider.validateLockFile(subDir)).to.equal(true)
+
+				// Now remove poetry.lock — root still has [tool.poetry] but no lock file
+				// _isWorkspaceRoot checks for [tool.poetry] + poetry.lock,
+				// so without poetry.lock it won't be a boundary
+				fs.unlinkSync(path.join(tmpDir, 'poetry.lock'))
+				expect(poetryProvider.validateLockFile(subDir)).to.equal(false)
+			} finally {
+				fs.rmSync(tmpDir, { recursive: true, force: true })
+			}
+		})
+
+		test('TRUSTIFY_DA_WORKSPACE_DIR override directs lock file search', () => {
+			let overrideDir = path.resolve(uvWorkspace)
+			expect(uvProvider.validateLockFile(
+				'test/providers/tst_manifests/pyproject/poetry_lock',
+				{ TRUSTIFY_DA_WORKSPACE_DIR: overrideDir }
+			)).to.equal(true)
+
+			expect(uvProvider.validateLockFile(
+				'test/providers/tst_manifests/pyproject/poetry_lock',
+				{ TRUSTIFY_DA_WORKSPACE_DIR: '/nonexistent/dir' }
+			)).to.equal(false)
+		})
+
+		test('verify uv workspace root stack analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'expected_stack_sbom.json')).toString()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideStack(path.join(uvWorkspace, 'pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify uv workspace root component analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'expected_component_sbom.json')).toString().trim()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideComponent(path.join(uvWorkspace, 'pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify uv workspace mid-package stack analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'packages/mid-pkg/expected_stack_sbom.json')).toString()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideStack(path.join(uvWorkspace, 'packages/mid-pkg/pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify uv workspace mid-package component analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'packages/mid-pkg/expected_component_sbom.json')).toString().trim()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideComponent(path.join(uvWorkspace, 'packages/mid-pkg/pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify uv workspace sub-package stack analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'packages/sub-pkg/expected_stack_sbom.json')).toString()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideStack(path.join(uvWorkspace, 'packages/sub-pkg/pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify uv workspace sub-package component analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'packages/sub-pkg/expected_component_sbom.json')).toString().trim()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideComponent(path.join(uvWorkspace, 'packages/sub-pkg/pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify poetry workspace root stack analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(poetryWorkspace, 'expected_stack_sbom.json')).toString()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await poetryProvider.provideStack(path.join(poetryWorkspace, 'pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify poetry workspace root component analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(poetryWorkspace, 'expected_component_sbom.json')).toString().trim()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await poetryProvider.provideComponent(path.join(poetryWorkspace, 'pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify poetry workspace sub-package stack analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(poetryWorkspace, 'packages/sub-pkg/expected_stack_sbom.json')).toString()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await poetryProvider.provideStack(path.join(poetryWorkspace, 'packages/sub-pkg/pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify poetry workspace sub-package component analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(poetryWorkspace, 'packages/sub-pkg/expected_component_sbom.json')).toString().trim()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await poetryProvider.provideComponent(path.join(poetryWorkspace, 'packages/sub-pkg/pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+	})
+
 }).beforeAll(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z'))).afterAll(() => clock.restore())

test/providers/tst_manifests/pyproject/poetry_workspace/expected_component_sbom.json

@@ -0,0 +1,36 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2023-10-01T00:00:00.000Z",
+    "component": {
+      "name": "poetry-mono",
+      "version": "0.1.0",
+      "purl": "pkg:pypi/poetry-mono@0.1.0",
+      "type": "application",
+      "bom-ref": "pkg:pypi/poetry-mono@0.1.0"
+    }
+  },
+  "components": [
+    {
+      "name": "requests",
+      "version": "2.33.1",
+      "purl": "pkg:pypi/requests@2.33.1",
+      "type": "library",
+      "bom-ref": "pkg:pypi/requests@2.33.1"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "pkg:pypi/poetry-mono@0.1.0",
+      "dependsOn": [
+        "pkg:pypi/requests@2.33.1"
+      ]
+    },
+    {
+      "ref": "pkg:pypi/requests@2.33.1",
+      "dependsOn": []
+    }
+  ]
+}