feat(workspace): add uv workspace (pyproject.toml) discovery

Author: Strum355

src/index.js

@@ -8,6 +8,7 @@ import fs from 'node:fs'
 import { getCustom } from "./tools.js";
 import { resolveBatchMetadata, resolveContinueOnError } from './batch_opts.js'
 import {
+	discoverUvWorkspaceMembers,
 	discoverWorkspaceCrates,
 	discoverWorkspacePackages,
 	filterManifestPathsByDiscoveryIgnore,
@@ -23,6 +24,7 @@ export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDeta
 
 export default { componentAnalysis, stackAnalysis, stackAnalysisBatch, imageAnalysis, validateToken, generateSbom }
 export {
+	discoverUvWorkspaceMembers,
 	discoverWorkspacePackages,
 	discoverWorkspaceCrates,
 	validatePackageJson,
@@ -83,7 +85,7 @@ export {
 /**
  * @typedef {{
  *   workspaceRoot: string,
- *   ecosystem: 'javascript' | 'cargo' | 'unknown',
+ *   ecosystem: 'javascript' | 'cargo' | 'pyproject' | 'unknown',
  *   total: number,
  *   successful: number,
  *   failed: number,
@@ -319,7 +321,7 @@ async function generateOneSbom(manifestPath, workspaceOpts) {
  *
  * @param {string} root - Resolved workspace root
  * @param {Options} opts
- * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'unknown', manifestPaths: string[] }>}
+ * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'pyproject' | 'unknown', manifestPaths: string[] }>}
  * @private
  */
 async function detectWorkspaceManifests(root, opts) {
@@ -331,6 +333,13 @@ async function detectWorkspaceManifests(root, opts) {
 		return { ecosystem: 'cargo', manifestPaths: await discoverWorkspaceCrates(root, opts) }
 	}
 
+	if (fs.existsSync(path.join(root, 'pyproject.toml')) && fs.existsSync(path.join(root, 'uv.lock'))) {
+		const manifestPaths = await discoverUvWorkspaceMembers(root, opts)
+		if (manifestPaths.length > 0) {
+			return { ecosystem: 'pyproject', manifestPaths }
+		}
+	}
+
 	const hasJsLock = fs.existsSync(path.join(root, 'pnpm-lock.yaml'))
 		|| fs.existsSync(path.join(root, 'yarn.lock'))
 		|| fs.existsSync(path.join(root, 'package-lock.json'))
@@ -489,7 +498,7 @@ async function stackAnalysisBatch(workspaceRoot, html = false, opts = {}) {
 	}
 
 	if (manifestPaths.length === 0) {
-		throw new Error(`No workspace manifests found at ${root}. Ensure Cargo.toml+Cargo.lock or package.json+lock file exist.`)
+		throw new Error(`No workspace manifests found at ${root}. Ensure a supported workspace root exists (Cargo.toml+Cargo.lock, pyproject.toml+uv.lock, or package.json+lock file).`)
 	}
 
 	const workspaceOpts = { ...opts, TRUSTIFY_DA_WORKSPACE_DIR: root }

src/workspace.js

@@ -4,13 +4,16 @@ import path from 'node:path'
 import fg from 'fast-glob'
 import { load as yamlLoad } from 'js-yaml'
 import micromatch from 'micromatch'
+import { parse as parseToml } from 'smol-toml'
 
 import { getCustom, getCustomPath, invokeCommand } from './tools.js'
 
 /** Default paths skipped during JS workspace discovery (merged with user patterns). */
 const DEFAULT_WORKSPACE_DISCOVERY_IGNORE = [
 	'**/node_modules/**',
 	'**/.git/**',
+	'**/__pycache__/**',
+	'**/.venv/**',
 ]
 
 /**
@@ -269,3 +272,71 @@ export async function discoverWorkspaceCrates(workspaceRoot, opts = {}) {
 	const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts)
 	return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns)
 }
+
+/**
+ * Discover all pyproject.toml manifest paths in a uv workspace.
+ * Parses `[tool.uv.workspace]` from root pyproject.toml and glob-expands member patterns.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pyproject.toml and uv.lock)
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {Promise<string[]>} Paths to pyproject.toml files (absolute)
+ */
+export async function discoverUvWorkspaceMembers(workspaceRoot, opts = {}) {
+	const root = path.resolve(workspaceRoot)
+	const rootPyproject = path.join(root, 'pyproject.toml')
+	const uvLock = path.join(root, 'uv.lock')
+
+	if (!fs.existsSync(rootPyproject) || !fs.existsSync(uvLock)) {
+		return []
+	}
+
+	let parsed
+	try {
+		parsed = parseToml(fs.readFileSync(rootPyproject, 'utf-8'))
+	} catch {
+		return []
+	}
+
+	const workspaceConfig = parsed?.tool?.uv?.workspace
+	if (!workspaceConfig) {
+		return []
+	}
+
+	const memberPatterns = workspaceConfig.members
+	if (!Array.isArray(memberPatterns) || memberPatterns.length === 0) {
+		return []
+	}
+
+	const excludePatterns = Array.isArray(workspaceConfig.exclude) ? workspaceConfig.exclude : []
+	const excludeGlobs = excludePatterns
+		.filter(p => typeof p === 'string' && p.trim())
+		.map(p => `${p.trim()}/pyproject.toml`)
+
+	const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts)
+	const globOpts = buildWorkspaceDiscoveryGlobOptions(root, [...ignorePatterns, ...excludeGlobs])
+
+	const patterns = toManifestGlobPatterns(
+		memberPatterns.filter(p => typeof p === 'string'),
+		'pyproject.toml',
+	)
+	const manifestPaths = await fg(patterns, globOpts)
+
+	if (!manifestPaths.includes(rootPyproject) && hasProjectMetadata(rootPyproject)) {
+		manifestPaths.unshift(rootPyproject)
+	}
+
+	return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns)
+}
+
+/**
+ * @param {string} pyprojectPath
+ * @returns {boolean}
+ */
+function hasProjectMetadata(pyprojectPath) {
+	try {
+		const content = parseToml(fs.readFileSync(pyprojectPath, 'utf-8'))
+		return typeof content?.project?.name === 'string' && content.project.name.trim() !== ''
+	} catch {
+		return false
+	}
+}

test/providers/tst_manifests/pyproject/uv_workspace_exclude/packages/core/pyproject.toml

@@ -0,0 +1,4 @@
+[project]
+name = "core"
+version = "0.1.0"
+dependencies = []

test/providers/tst_manifests/pyproject/uv_workspace_exclude/packages/internal/pyproject.toml

@@ -0,0 +1,4 @@
+[project]
+name = "internal"
+version = "0.1.0"
+dependencies = []

test/providers/tst_manifests/pyproject/uv_workspace_exclude/pyproject.toml

@@ -0,0 +1,8 @@
+[project]
+name = "exclude-workspace"
+version = "0.1.0"
+dependencies = []
+
+[tool.uv.workspace]
+members = ["packages/*"]
+exclude = ["packages/internal"]

test/providers/tst_manifests/pyproject/uv_workspace_exclude/uv.lock

@@ -0,0 +1,4 @@
+[project]
+name = "backend"
+version = "0.1.0"
+dependencies = []

test/providers/tst_manifests/pyproject/uv_workspace_nested/apps/backend/pyproject.toml

@@ -0,0 +1,4 @@
+[project]
+name = "core"
+version = "0.1.0"
+dependencies = []

test/providers/tst_manifests/pyproject/uv_workspace_nested/libs/core/pyproject.toml

@@ -0,0 +1,7 @@
+[project]
+name = "nested-workspace"
+version = "0.1.0"
+dependencies = []
+
+[tool.uv.workspace]
+members = ["apps/*", "libs/*"]