feat(workspace): add uv workspace (pyproject.toml) discovery

Add discoverUvWorkspaceMembers() for discovering workspace members in
uv/Python monorepos. Parses pyproject.toml for [tool.uv.workspace]
member globs and resolves them via fast-glob. Requires both
pyproject.toml with workspace config and uv.lock to be present.

Handles virtual workspaces (no [project] section in root) by excluding
the root pyproject.toml from discovered manifests. Respects uv's
exclude patterns and the standard workspace discovery ignore mechanism.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Strum355

src/index.js

@@ -11,6 +11,7 @@ import {
 	discoverGoWorkspaceModules,
 	discoverGradleSubprojects,
 	discoverMavenModules,
+	discoverUvWorkspaceMembers,
 	discoverWorkspaceCrates,
 	discoverWorkspacePackages,
 	filterManifestPathsByDiscoveryIgnore,
@@ -29,6 +30,7 @@ export {
 	discoverGoWorkspaceModules,
 	discoverGradleSubprojects,
 	discoverMavenModules,
+	discoverUvWorkspaceMembers,
 	discoverWorkspacePackages,
 	discoverWorkspaceCrates,
 	validatePackageJson,
@@ -89,7 +91,7 @@ export {
 /**
  * @typedef {{
  *   workspaceRoot: string,
- *   ecosystem: 'javascript' | 'cargo' | 'unknown',
+ *   ecosystem: 'javascript' | 'cargo' | 'maven' | 'gradle' | 'gomodules' | 'pyproject' | 'unknown',
  *   total: number,
  *   successful: number,
  *   failed: number,
@@ -325,7 +327,7 @@ async function generateOneSbom(manifestPath, workspaceOpts) {
  *
  * @param {string} root - Resolved workspace root
  * @param {Options} opts
- * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'maven' | 'gradle' | 'gomodules' | 'unknown', manifestPaths: string[] }>}
+ * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'maven' | 'gradle' | 'gomodules' | 'pyproject' | 'unknown', manifestPaths: string[] }>}
  * @private
  */
 async function detectWorkspaceManifests(root, opts) {
@@ -361,6 +363,13 @@ async function detectWorkspaceManifests(root, opts) {
 		}
 	}
 
+	if (fs.existsSync(path.join(root, 'pyproject.toml')) && fs.existsSync(path.join(root, 'uv.lock'))) {
+		const manifestPaths = await discoverUvWorkspaceMembers(root, opts)
+		if (manifestPaths.length > 0) {
+			return { ecosystem: 'pyproject', manifestPaths }
+		}
+	}
+
 	const hasJsLock = fs.existsSync(path.join(root, 'pnpm-lock.yaml'))
 		|| fs.existsSync(path.join(root, 'yarn.lock'))
 		|| fs.existsSync(path.join(root, 'package-lock.json'))
@@ -519,7 +528,7 @@ async function stackAnalysisBatch(workspaceRoot, html = false, opts = {}) {
 	}
 
 	if (manifestPaths.length === 0) {
-		throw new Error(`No workspace manifests found at ${root}. Ensure a supported workspace root exists (Cargo.toml+Cargo.lock, pom.xml, settings.gradle[.kts], go.work, or package.json+lock file).`)
+		throw new Error(`No workspace manifests found at ${root}. Ensure a supported workspace root exists (Cargo.toml+Cargo.lock, pom.xml, settings.gradle[.kts], go.work, pyproject.toml+uv.lock, or package.json+lock file).`)
 	}
 
 	const workspaceOpts = { ...opts, TRUSTIFY_DA_WORKSPACE_DIR: root }

src/workspace.js

@@ -5,6 +5,7 @@ import path from 'node:path'
 import fg from 'fast-glob'
 import { load as yamlLoad } from 'js-yaml'
 import micromatch from 'micromatch'
+import { parse as parseToml } from 'smol-toml'
 
 import { getCustom, getCustomPath, getGitRootDir, getWrapperPreference, invokeCommand } from './tools.js'
 
@@ -15,6 +16,8 @@ const DEFAULT_WORKSPACE_DISCOVERY_IGNORE = [
 	'**/target/**',
 	'**/build/**',
 	'**/.gradle/**',
+	'**/__pycache__/**',
+	'**/.venv/**',
 ]
 
 /**
@@ -591,3 +594,71 @@ export async function discoverGoWorkspaceModules(workspaceRoot, opts = {}) {
 	const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts)
 	return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns)
 }
+
+/**
+ * Discover all pyproject.toml manifest paths in a uv workspace.
+ * Parses `[tool.uv.workspace]` from root pyproject.toml and glob-expands member patterns.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pyproject.toml and uv.lock)
+ * @param {{ workspaceDiscoveryIgnore?: string[], TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE?: string, [key: string]: unknown }} [opts={}]
+ * @returns {Promise<string[]>} Paths to pyproject.toml files (absolute)
+ */
+export async function discoverUvWorkspaceMembers(workspaceRoot, opts = {}) {
+	const root = path.resolve(workspaceRoot)
+	const rootPyproject = path.join(root, 'pyproject.toml')
+	const uvLock = path.join(root, 'uv.lock')
+
+	if (!fs.existsSync(rootPyproject) || !fs.existsSync(uvLock)) {
+		return []
+	}
+
+	let parsed
+	try {
+		parsed = parseToml(fs.readFileSync(rootPyproject, 'utf-8'))
+	} catch {
+		return []
+	}
+
+	const workspaceConfig = parsed?.tool?.uv?.workspace
+	if (!workspaceConfig) {
+		return []
+	}
+
+	const memberPatterns = workspaceConfig.members
+	if (!Array.isArray(memberPatterns) || memberPatterns.length === 0) {
+		return []
+	}
+
+	const excludePatterns = Array.isArray(workspaceConfig.exclude) ? workspaceConfig.exclude : []
+	const excludeGlobs = excludePatterns
+		.filter(p => typeof p === 'string' && p.trim())
+		.map(p => `${p.trim()}/pyproject.toml`)
+
+	const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts)
+	const globOpts = buildWorkspaceDiscoveryGlobOptions(root, [...ignorePatterns, ...excludeGlobs])
+
+	const patterns = toManifestGlobPatterns(
+		memberPatterns.filter(p => typeof p === 'string'),
+		'pyproject.toml',
+	)
+	const manifestPaths = await fg(patterns, globOpts)
+
+	if (!manifestPaths.includes(rootPyproject) && hasProjectMetadata(rootPyproject)) {
+		manifestPaths.unshift(rootPyproject)
+	}
+
+	return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns)
+}
+
+/**
+ * @param {string} pyprojectPath
+ * @returns {boolean}
+ */
+function hasProjectMetadata(pyprojectPath) {
+	try {
+		const content = parseToml(fs.readFileSync(pyprojectPath, 'utf-8'))
+		return typeof content?.project?.name === 'string' && content.project.name.trim() !== ''
+	} catch {
+		return false
+	}
+}

test/providers/tst_manifests/pyproject/uv_workspace_exclude/packages/core/pyproject.toml

@@ -0,0 +1,4 @@
+[project]
+name = "core"
+version = "0.1.0"
+dependencies = []

test/providers/tst_manifests/pyproject/uv_workspace_exclude/packages/internal/pyproject.toml

@@ -0,0 +1,4 @@
+[project]
+name = "internal"
+version = "0.1.0"
+dependencies = []

test/providers/tst_manifests/pyproject/uv_workspace_exclude/pyproject.toml

@@ -0,0 +1,8 @@
+[project]
+name = "exclude-workspace"
+version = "0.1.0"
+dependencies = []
+
+[tool.uv.workspace]
+members = ["packages/*"]
+exclude = ["packages/internal"]

test/providers/tst_manifests/pyproject/uv_workspace_exclude/uv.lock

@@ -0,0 +1,4 @@
+[project]
+name = "backend"
+version = "0.1.0"
+dependencies = []

test/providers/tst_manifests/pyproject/uv_workspace_nested/apps/backend/pyproject.toml

@@ -0,0 +1,4 @@
+[project]
+name = "core"
+version = "0.1.0"
+dependencies = []

test/providers/tst_manifests/pyproject/uv_workspace_nested/libs/core/pyproject.toml

@@ -0,0 +1,7 @@
+[project]
+name = "nested-workspace"
+version = "0.1.0"
+dependencies = []
+
+[tool.uv.workspace]
+members = ["apps/*", "libs/*"]