feat: add support for UV workspaces (#461)

Implements TC-4039

Author: Strum355

src/providers/base_pyproject.js

@@ -6,6 +6,7 @@ import { parse as parseToml } from 'smol-toml'
 
 import { getLicense } from '../license/license_utils.js'
 import Sbom from '../sbom.js'
+import { getCustom } from '../tools.js'
 
 const ecosystem = 'pip'
 
@@ -31,10 +32,71 @@ export default class Base_pyproject {
 
 	/**
 	 * @param {string} manifestDir
+	 * @param {Object} [opts={}]
+	 * @returns {boolean}
+	 */
+	validateLockFile(manifestDir, opts = {}) {
+		return this._findLockFileDir(manifestDir, opts) != null
+	}
+
+	/**
+	 * Walk up from manifestDir to find the directory containing the lock file.
+	 * Follows the same pattern as Base_javascript._findLockFileDir().
+	 * @param {string} manifestDir
+	 * @param {Object} [opts={}]
+	 * @returns {string|null}
+	 * @protected
+	 */
+	_findLockFileDir(manifestDir, opts = {}) {
+		const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts)
+		if (workspaceDir) {
+			const dir = path.resolve(workspaceDir)
+			return fs.existsSync(path.join(dir, this._lockFileName())) ? dir : null
+		}
+
+		let dir = path.resolve(manifestDir)
+		let parent = dir
+
+		do {
+			dir = parent
+
+			if (fs.existsSync(path.join(dir, this._lockFileName()))) {
+				return dir
+			}
+
+			if (this._isWorkspaceRoot(dir)) {
+				return null
+			}
+
+			parent = path.dirname(dir)
+		} while (parent !== dir)
+
+		return null
+	}
+
+	/**
+	 * Detect workspace root boundaries.
+	 * Currently only uv has native workspace support ([tool.uv.workspace] in pyproject.toml).
+	 * Poetry has no workspace/monorepo support (python-poetry/poetry#2270), so each
+	 * poetry project is treated independently — see Python_poetry._findLockFileDir().
+	 * @param {string} dir
 	 * @returns {boolean}
+	 * @protected
 	 */
-	validateLockFile(manifestDir) {
-		return fs.existsSync(path.join(manifestDir, this._lockFileName()))
+	_isWorkspaceRoot(dir) {
+		const pyprojectPath = path.join(dir, 'pyproject.toml')
+		if (!fs.existsSync(pyprojectPath)) {
+			return false
+		}
+		try {
+			const content = parseToml(fs.readFileSync(pyprojectPath, 'utf-8'))
+			if (content.tool?.uv?.workspace) {
+				return true
+			}
+		} catch (_) {
+			// ignore parse errors
+		}
+		return false
 	}
 
 	/**
@@ -106,14 +168,15 @@ export default class Base_pyproject {
 
 	/**
 	 * Resolve dependencies using the tool-specific command and parser.
-	 * @param {string} manifestDir
+	 * @param {string} manifestDir - directory containing the target pyproject.toml
+	 * @param {string} workspaceDir - workspace root (where the lock file lives), or same as manifestDir for standalone projects
 	 * @param {object} parsed - parsed pyproject.toml
 	 * @param {Object} opts
 	 * @returns {Promise<DependencyData>}
 	 * @protected
 	 */
 	// eslint-disable-next-line no-unused-vars
-	async _getDependencyData(manifestDir, parsed, opts) {
+	async _getDependencyData(manifestDir, workspaceDir, parsed, opts) {
 		throw new TypeError('_getDependencyData must be implemented')
 	}
 
@@ -284,7 +347,8 @@ export default class Base_pyproject {
 		let content = fs.readFileSync(manifest, 'utf-8')
 		let parsed = parseToml(content)
 
-		let { directDeps, graph } = await this._getDependencyData(manifestDir, parsed, opts)
+		let workspaceDir = this._findLockFileDir(manifestDir, opts) || manifestDir
+		let { directDeps, graph } = await this._getDependencyData(manifestDir, workspaceDir, parsed, opts)
 
 		let ignoredDeps = this._getIgnoredDeps(manifest)
 		let dependencies = this._buildDependencyTree(graph, directDeps, ignoredDeps, includeTransitive)

src/providers/python_poetry.js

@@ -1,9 +1,32 @@
-import { environmentVariableIsPopulated, getCustomPath, invokeCommand } from '../tools.js'
+import fs from 'node:fs'
+import path from 'node:path'
+
+import { environmentVariableIsPopulated, getCustom, getCustomPath, invokeCommand } from '../tools.js'
 
 import Base_pyproject from './base_pyproject.js'
 
 export default class Python_poetry extends Base_pyproject {
 
+	/**
+	 * Poetry has no native workspace/monorepo support (python-poetry/poetry#2270).
+	 * Each poetry project is treated independently — no lock file walk-up.
+	 * Running `poetry show` from a parent directory returns the parent's deps, not
+	 * the sub-package's, so walk-up would produce incorrect SBOMs.
+	 * @param {string} manifestDir
+	 * @param {Object} [opts={}]
+	 * @returns {string|null}
+	 * @protected
+	 */
+	_findLockFileDir(manifestDir, opts = {}) {
+		const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts)
+		if (workspaceDir) {
+			const dir = path.resolve(workspaceDir)
+			return fs.existsSync(path.join(dir, this._lockFileName())) ? dir : null
+		}
+		const dir = path.resolve(manifestDir)
+		return fs.existsSync(path.join(dir, this._lockFileName())) ? dir : null
+	}
+
 	/** @returns {string} */
 	_lockFileName() {
 		return 'poetry.lock'
@@ -16,11 +39,13 @@ export default class Python_poetry extends Base_pyproject {
 
 	/**
 	 * @param {string} manifestDir
+	 * @param {string} _workspaceDir - unused (poetry has no workspace support)
 	 * @param {object} parsed - parsed pyproject.toml
 	 * @param {Object} opts
 	 * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
 	 */
-	async _getDependencyData(manifestDir, parsed, opts) {
+	// eslint-disable-next-line no-unused-vars
+	async _getDependencyData(manifestDir, _workspaceDir, parsed, opts) {
 		let treeOutput = this._getPoetryShowTreeOutput(manifestDir, opts)
 		let showAllOutput = this._getPoetryShowAllOutput(manifestDir, opts)
 		let versionMap = this._parsePoetryShowAll(showAllOutput)
@@ -97,7 +122,7 @@ export default class Python_poetry extends Base_pyproject {
 			if (!line.trim()) { continue }
 
 			// top-level line: "name version description..."
-			let topMatch = line.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s+(\S+)\s/)
+			let topMatch = line.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s+(\S+)(?:\s|$)/)
 			if (topMatch) {
 				let name = topMatch[1]
 				let version = topMatch[2]

src/providers/python_uv.js

@@ -1,3 +1,8 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+import { parse as parseToml } from 'smol-toml'
+
 import { environmentVariableIsPopulated, getCustomPath, invokeCommand } from '../tools.js'
 
 import Base_pyproject from './base_pyproject.js'
@@ -16,15 +21,16 @@ export default class Python_uv extends Base_pyproject {
 	}
 
 	/**
-	 * @param {string} manifestDir
+	 * @param {string} manifestDir - directory containing the target pyproject.toml
+	 * @param {string} workspaceDir - workspace root (for resolving editable install paths)
 	 * @param {object} parsed - parsed pyproject.toml
 	 * @param {Object} opts
 	 * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
 	 */
-	async _getDependencyData(manifestDir, parsed, opts) {
+	async _getDependencyData(manifestDir, workspaceDir, parsed, opts) {
 		let projectName = this._getProjectName(parsed)
 		let uvOutput = this._getUvExportOutput(manifestDir, opts)
-		return this._parseUvExport(uvOutput, projectName)
+		return this._parseUvExport(uvOutput, projectName, workspaceDir)
 	}
 
 	/**
@@ -47,9 +53,10 @@ export default class Python_uv extends Base_pyproject {
 	 *
 	 * @param {string} output
 	 * @param {string} projectName - canonical project name to identify direct deps
+	 * @param {string} workspaceDir - workspace root (for resolving editable install paths)
 	 * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
 	 */
-	async _parseUvExport(output, projectName) {
+	async _parseUvExport(output, projectName, workspaceDir) {
 		let [parser, pinnedVersionQuery] = await Promise.all([
 			getParser(), getPinnedVersionQuery()
 		])
@@ -62,6 +69,30 @@ export default class Python_uv extends Base_pyproject {
 		let collectingVia = false
 
 		for (let child of root.children) {
+			if (child.type === 'global_opt') {
+				let optNode = child.children.find(c => c.type === 'option')
+				let pathNode = child.children.find(c => c.type === 'path')
+				if (optNode?.text === '-e' && pathNode && workspaceDir) {
+					let memberDir = path.resolve(workspaceDir, pathNode.text)
+					let memberManifest = path.join(memberDir, 'pyproject.toml')
+					if (fs.existsSync(memberManifest)) {
+						let memberParsed = parseToml(fs.readFileSync(memberManifest, 'utf-8'))
+						let name = memberParsed.project?.name || memberParsed.tool?.poetry?.name
+						let version = memberParsed.project?.version || memberParsed.tool?.poetry?.version
+						if (name && version) {
+							let key = this._canonicalize(name)
+							currentPkg = { name, version, parents: new Set() }
+							packages.set(key, currentPkg)
+							collectingVia = false
+							continue
+						}
+					}
+				}
+				currentPkg = null
+				collectingVia = false
+				continue
+			}
+
 			if (child.type === 'requirement') {
 				let nameNode = child.children.find(c => c.type === 'package')
 				if (!nameNode) { continue }

test/providers/python_pyproject.test.js

@@ -1,4 +1,5 @@
 import fs from 'fs'
+import path from 'path'
 
 import { expect } from 'chai'
 import { useFakeTimers } from 'sinon'
@@ -196,4 +197,128 @@ suite('testing the python-pyproject data provider', () => {
 		}
 	})
 
+	suite('workspace/monorepo support', () => {
+		const uvWorkspace = 'test/providers/tst_manifests/pyproject/uv_workspace'
+
+		test('uv validateLockFile finds uv.lock in parent directory', () => {
+			expect(uvProvider.validateLockFile(
+				path.join(uvWorkspace, 'packages/sub-pkg')
+			)).to.equal(true)
+		})
+
+		test('poetry validateLockFile does not walk up to parent directory', () => {
+			// Poetry has no native workspace support (python-poetry/poetry#2270).
+			// Each poetry project is treated independently — no lock file walk-up.
+			let tmpDir = 'test/providers/tst_manifests/pyproject/boundary_test_poetry'
+			let subDir = path.join(tmpDir, 'packages', 'child')
+			fs.mkdirSync(subDir, { recursive: true })
+			fs.writeFileSync(path.join(tmpDir, 'pyproject.toml'),
+				'[tool.poetry]\nname = "root"\nversion = "0.1.0"\n')
+			fs.writeFileSync(path.join(tmpDir, 'poetry.lock'), '')
+			fs.writeFileSync(path.join(subDir, 'pyproject.toml'),
+				'[tool.poetry]\nname = "child"\nversion = "0.1.0"\n')
+			try {
+				// poetry.lock exists at root but poetry should NOT walk up
+				expect(poetryProvider.validateLockFile(subDir)).to.equal(false)
+			} finally {
+				fs.rmSync(tmpDir, { recursive: true, force: true })
+			}
+		})
+
+		test('validateLockFile stops at uv workspace root boundary when lock file is absent', () => {
+			let tmpDir = 'test/providers/tst_manifests/pyproject/boundary_test'
+			let subDir = path.join(tmpDir, 'packages', 'child')
+			fs.mkdirSync(subDir, { recursive: true })
+			// root has workspace marker but no lock file
+			fs.writeFileSync(path.join(tmpDir, 'pyproject.toml'),
+				'[tool.uv.workspace]\nmembers = ["packages/*"]\n')
+			fs.writeFileSync(path.join(subDir, 'pyproject.toml'),
+				'[project]\nname = "child"\nversion = "0.1.0"\n')
+			try {
+				expect(uvProvider.validateLockFile(subDir)).to.equal(false)
+			} finally {
+				fs.rmSync(tmpDir, { recursive: true, force: true })
+			}
+		})
+
+		test('TRUSTIFY_DA_WORKSPACE_DIR override directs lock file search', () => {
+			let overrideDir = path.resolve(uvWorkspace)
+			expect(uvProvider.validateLockFile(
+				'test/providers/tst_manifests/pyproject/poetry_lock',
+				{ TRUSTIFY_DA_WORKSPACE_DIR: overrideDir }
+			)).to.equal(true)
+
+			expect(uvProvider.validateLockFile(
+				'test/providers/tst_manifests/pyproject/poetry_lock',
+				{ TRUSTIFY_DA_WORKSPACE_DIR: '/nonexistent/dir' }
+			)).to.equal(false)
+		})
+
+		test('verify uv workspace root stack analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'expected_stack_sbom.json')).toString()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideStack(path.join(uvWorkspace, 'pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify uv workspace root component analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'expected_component_sbom.json')).toString().trim()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideComponent(path.join(uvWorkspace, 'pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify uv workspace mid-package stack analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'packages/mid-pkg/expected_stack_sbom.json')).toString()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideStack(path.join(uvWorkspace, 'packages/mid-pkg/pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify uv workspace mid-package component analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'packages/mid-pkg/expected_component_sbom.json')).toString().trim()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideComponent(path.join(uvWorkspace, 'packages/mid-pkg/pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify uv workspace sub-package stack analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'packages/sub-pkg/expected_stack_sbom.json')).toString()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideStack(path.join(uvWorkspace, 'packages/sub-pkg/pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+
+		test('verify uv workspace sub-package component analysis', async () => {
+			let expectedSbom = fs.readFileSync(path.join(uvWorkspace, 'packages/sub-pkg/expected_component_sbom.json')).toString().trim()
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let result = await uvProvider.provideComponent(path.join(uvWorkspace, 'packages/sub-pkg/pyproject.toml'))
+			expect(result).to.deep.equal({
+				ecosystem: 'pip',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+		}).timeout(TIMEOUT)
+	})
+
 }).beforeAll(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z'))).afterAll(() => clock.restore())