feat(workspace): add Go workspace (go.work) discovery (#495)

Author: Strum355

src/index.js

@@ -9,6 +9,7 @@ import { getCustom } from "./tools.js";
 import { resolveBatchMetadata, resolveContinueOnError } from './batch_opts.js'
 import { discoverMavenModules } from './providers/java_maven.js'
 import { discoverGradleSubprojects } from './providers/java_gradle.js'
+import { discoverGoWorkspaceModules } from './providers/golang_gomodules.js'
 import {
 	discoverWorkspaceCrates,
 	discoverWorkspacePackages,
@@ -27,6 +28,7 @@ export default { componentAnalysis, stackAnalysis, stackAnalysisBatch, imageAnal
 export {
 	discoverMavenModules,
 	discoverGradleSubprojects,
+	discoverGoWorkspaceModules,
 	discoverWorkspacePackages,
 	discoverWorkspaceCrates,
 	validatePackageJson,
@@ -323,7 +325,7 @@ async function generateOneSbom(manifestPath, workspaceOpts) {
  *
  * @param {string} root - Resolved workspace root
  * @param {Options} opts
- * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'maven' | 'gradle' | 'unknown', manifestPaths: string[] }>}
+ * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'maven' | 'gradle' | 'gomodules' | 'unknown', manifestPaths: string[] }>}
  * @private
  */
 async function detectWorkspaceManifests(root, opts) {
@@ -352,6 +354,13 @@ async function detectWorkspaceManifests(root, opts) {
 		}
 	}
 
+	if (fs.existsSync(path.join(root, 'go.work'))) {
+		const manifestPaths = await discoverGoWorkspaceModules(root, opts)
+		if (manifestPaths.length > 0) {
+			return { ecosystem: 'gomodules', manifestPaths }
+		}
+	}
+
 	const hasJsLock = fs.existsSync(path.join(root, 'pnpm-lock.yaml'))
 		|| fs.existsSync(path.join(root, 'yarn.lock'))
 		|| fs.existsSync(path.join(root, 'package-lock.json'))
@@ -547,7 +556,7 @@ async function stackAnalysisBatch(workspaceRoot, html = false, opts = {}) {
 	}
 
 	if (manifestPaths.length === 0) {
-		throw new Error(`No workspace manifests found at ${root}. Ensure Cargo.toml+Cargo.lock or package.json+lock file exist.`)
+		throw new Error(`No workspace manifests found at ${root}. Ensure a supported workspace root exists (Cargo.toml+Cargo.lock, go.work, or package.json+lock file).`)
 	}
 
 	const workspaceOpts = { ...opts, TRUSTIFY_DA_WORKSPACE_DIR: root }

src/providers/golang_gomodules.js

@@ -6,6 +6,7 @@ import { PackageURL } from 'packageurl-js'
 import { readLicenseFile } from '../license/license_utils.js'
 import Sbom from '../sbom.js'
 import { getCustom, getCustomPath, invokeCommand } from "../tools.js";
+import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js'
 
 import { getParser, getRequireQuery } from './gomod_parser.js'
 
@@ -427,3 +428,56 @@ function getLineSeparatorGolang() {
 	let reg = /\n|\r\n/
 	return reg
 }
+
+/**
+ * Discover all go.mod manifest paths in a Go workspace.
+ * Uses `go work edit -json` to get workspace members.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain go.work)
+ * @param {import('../index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to go.mod files (absolute)
+ */
+export async function discoverGoWorkspaceModules(workspaceRoot, opts = {}) {
+	const root = path.resolve(workspaceRoot)
+	const goWork = path.join(root, 'go.work')
+
+	if (!fs.existsSync(goWork)) {
+		return []
+	}
+
+	const goBin = getCustomPath('go', opts)
+	let output
+	try {
+		output = invokeCommand(goBin, ['work', 'edit', '-json', goWork], { cwd: root })
+	} catch {
+		return []
+	}
+
+	let workspace
+	try {
+		workspace = JSON.parse(output.toString().trim())
+	} catch {
+		return []
+	}
+
+	const useEntries = workspace.Use || []
+	if (useEntries.length === 0) {
+		return []
+	}
+
+	const manifestPaths = []
+	for (const entry of useEntries) {
+		const diskPath = entry.DiskPath
+		if (!diskPath) {
+			continue
+		}
+		const moduleDir = path.resolve(root, diskPath)
+		const goMod = path.join(moduleDir, 'go.mod')
+		if (fs.existsSync(goMod)) {
+			manifestPaths.push(goMod)
+		}
+	}
+
+	const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts)
+	return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns)
+}

test/providers/tst_manifests/golang/go_workspace/go.work

@@ -0,0 +1,6 @@
+go 1.22
+
+use (
+	./module-a
+	./module-b
+)

test/providers/tst_manifests/golang/go_workspace/module-a/go.mod

@@ -0,0 +1,3 @@
+module example.com/module-a
+
+go 1.22

test/providers/tst_manifests/golang/go_workspace/module-b/go.mod

@@ -0,0 +1,3 @@
+module example.com/module-b
+
+go 1.22

test/providers/tst_manifests/golang/go_workspace_empty/go.work

@@ -0,0 +1 @@
+go 1.22

test/providers/tst_manifests/golang/go_workspace_missing_module/existing/go.mod

@@ -0,0 +1,3 @@
+module example.com/existing
+
+go 1.22

test/providers/tst_manifests/golang/go_workspace_missing_module/go.work

@@ -0,0 +1,6 @@
+go 1.22
+
+use (
+	./existing
+	./nonexistent
+)

test/providers/tst_manifests/golang/go_workspace_nested/go.work

@@ -0,0 +1,6 @@
+go 1.22
+
+use (
+	./libs/core
+	./libs/util
+)

test/providers/tst_manifests/golang/go_workspace_nested/libs/core/go.mod

@@ -0,0 +1,3 @@
+module example.com/libs/core
+
+go 1.22