Merge pull request #253 from a-oren/TC-3865

feat(batch): add batch workspace analysis action and settings UI

Author: a-oren

.github/workflows/IJ-latest.yml

@@ -15,10 +15,10 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'temurin'
           cache: 'gradle'
       - name: Grant execute permission for gradlew

.github/workflows/IJ.yml

@@ -16,10 +16,10 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'temurin'
           cache: 'gradle'
       - name: Grant execute permission for gradlew

.github/workflows/ci.yml

@@ -15,10 +15,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up JDK 17
+    - name: Set up JDK 21
       uses: actions/setup-java@v3
       with:
-        java-version: 17
+        java-version: 21
         distribution: 'temurin'
         cache: 'gradle'
     - name: Grant execute permission for gradlew
@@ -34,10 +34,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up JDK 17
+    - name: Set up JDK 21
       uses: actions/setup-java@v3
       with:
-        java-version: 17
+        java-version: 21
         distribution: 'temurin'
         cache: 'gradle'
     - name: Grant execute permission for gradlew
@@ -53,10 +53,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up JDK 17
+    - name: Set up JDK 21
       uses: actions/setup-java@v3
       with:
-        java-version: 17
+        java-version: 21
         distribution: 'temurin'
         cache: 'gradle'
     - name: Grant execute permission for gradlew

.github/workflows/publish-marketplace.yml

@@ -24,10 +24,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v4
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'temurin'
           cache: 'gradle'
 

.github/workflows/release.yml

@@ -8,10 +8,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'temurin'
           cache: 'gradle'
       - name: Grant execute permission for gradlew

.github/workflows/stage.yml

@@ -17,10 +17,10 @@ jobs:
       - name: Checkout sources
         uses: actions/checkout@v4
 
-      - name: Install Java 17
+      - name: Install Java 21
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'oracle'
           cache: 'gradle'
 

README.md

@@ -150,6 +150,12 @@ according to your preferences.
 - **Proxy Configuration** :
   <br >From IntelliJ IDEA Appearance & Behavior > System Settings > HTTP Proxy, you can configure a static proxy for all HTTP requests made by the plugin. This is useful when your environment requires going through a proxy to access external services. For example:`http://proxy.example.com:8080`
 
+- **Batch Analysis** :
+  <br >Configure settings for batch workspace analysis, which analyzes all packages in a JS/TS monorepo or Cargo workspace at once.
+  <br >**Concurrency**: Maximum number of concurrent analyses during batch workspace analysis (default: 10).
+  <br >**Continue on Error**: Continue analyzing remaining packages when one package analysis fails (default: enabled).
+  <br >**Include Metadata**: Include additional metadata in batch analysis results (default: enabled).
+
 - **Manifest Exclusion Patterns** :
   <br >You can exclude manifest files from component analysis using glob patterns. This is useful for excluding third-party dependencies, test files, or other manifests that should not be analyzed.
   <br >Enter one pattern per line. Examples: `**/node_modules/**/package.json` to exclude all package.json files in node_modules directories, or `test/**/pom.xml` to exclude all Maven files in test directories.
@@ -396,6 +402,16 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla
     <br >Right-click on any manifest file and select **Exclude from Component Analysis** to quickly add an exclusion pattern for that specific file.
 
 
+- **Batch Workspace Analysis**
+  <br >For JS/TS monorepos (npm, pnpm, yarn workspaces) and Cargo workspaces, you can run a batch analysis that scans
+  all packages in the workspace at once and generates a combined vulnerability report.
+  <br >To run a batch analysis, right-click in the **Project** window and click **Batch Workspace Analysis Report**.
+  <br >The workspace root must contain a supported workspace layout:
+  - JS/TS workspace: `package.json` with a lock file (`package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock`)
+  - Cargo workspace: `Cargo.toml` with `Cargo.lock`
+  <br >Exclusion patterns configured in **Manifest Exclusion Patterns** are applied during workspace discovery to skip
+  specific packages from the batch analysis.
+
 - **Red Hat Dependency Analytics report**
   <br >The Red Hat Dependency Analytics report is a temporary HTML file that exist if the **Red Hat Dependency Analytics
   Report** tab remains open.

USAGE_DATA.md

@@ -5,4 +5,6 @@
 * when plugin is started
 * when plugin analyse dependency file for vulnerability(s) and file name
 * when plugin analyse dependency file fails, error message and file name
+* when plugin runs batch workspace analysis on a workspace root
+* when plugin batch workspace analysis fails, error message
 * when plugin is shutdown

build.gradle.kts

@@ -15,8 +15,8 @@ version = providers.gradleProperty("projectVersion").get() // Plugin version
 val platformVersion = providers.gradleProperty("ideaVersion").get()
 // Set the JVM language level used to build the project.
 java {
-    sourceCompatibility = JavaVersion.VERSION_17
-    targetCompatibility = JavaVersion.VERSION_17
+    sourceCompatibility = JavaVersion.VERSION_21
+    targetCompatibility = JavaVersion.VERSION_21
     withSourcesJar()
     withJavadocJar()
 }

gradle/libs.versions.toml

@@ -4,10 +4,10 @@ caffeine = "3.1.8"
 commons-compress = "1.21"
 commons-io = "2.16.1"
 trustify-da-api-spec = "2.0.2"
-trustify-da-java-client = "0.0.15"
+trustify-da-java-client = "0.0.16"
 github-api = "1.314"
 junit = "4.13.2"
-mockito = "4.11.0"
+mockito = "5.14.2"
 packageurl-java = "1.4.1"
 
 # plugins