Merge pull request step-security#82 from Prateek-stepsecurity/pn/fix/pnpm

fix(pnpm): resolve v11 global-scan regression

Author: ashishkurmi

internal/detector/nodescan.go

@@ -199,27 +199,73 @@ func (s *NodeScanner) scanYarnGlobal(ctx context.Context) (model.NodeScanResult,
 
 func (s *NodeScanner) scanPnpmGlobal(ctx context.Context) (model.NodeScanResult, bool) {
 	if err := s.checkPath(ctx, "pnpm"); err != nil {
+		s.log.Warn("pnpm not found on PATH — skipping pnpm global scan: %v", err)
 		return model.NodeScanResult{}, false
 	}
 
-	version := s.getVersion(ctx, "pnpm", "--version")
-	globalDir := s.getOutput(ctx, "pnpm", "root", "-g")
-	if globalDir == "" {
+	pnpmCmd := "pnpm"
+
+	versionOut, _, _, verErr := s.runCmd(ctx, 10*time.Second, pnpmCmd, "--version")
+	version := strings.TrimSpace(versionOut)
+	if verErr != nil || version == "" {
+		version = "unknown"
+	}
+
+	rootOut, _, rootExit, _ := s.runCmd(ctx, 10*time.Second, pnpmCmd, "root", "-g")
+	globalDir := strings.TrimSpace(rootOut)
+
+	// fallback logic in case `pnpm root -g` returns empty
+	var extra string
+	if rootExit != 0 || globalDir == "" {
+		extra = defaultPnpmBinDir(s.exec)
+		if extra != "" {
+			oldPath := os.Getenv("PATH")
+			_ = os.Setenv("PATH", extra+string(os.PathListSeparator)+oldPath)
+			defer os.Setenv("PATH", oldPath)
+
+			// For the delegation path, embed `PATH='extra':$PATH` in the command name.
+			// runCmd's delegation branch space-joins name+args into the shell command
+			// string, so the env-prefix flows through to the user's shell intact.
+			if s.shouldRunAsUser() {
+				pnpmCmd = "PATH=" + platformShellQuote(s.exec, extra) + ":$PATH pnpm"
+			}
+
+			s.log.Debug("pnpm root -g returned empty; retrying with bin dir %q prepended to PATH", extra)
+			rootOut, _, _, _ = s.runCmd(ctx, 10*time.Second, pnpmCmd, "root", "-g")
+			globalDir = strings.TrimSpace(rootOut)
+		}
+	}
+
+	if globalDir != "" {
+		globalDir = filepath.Dir(globalDir)
+	} else if extra != "" {
+		// Both attempts failed; use the bin dir itself as last-resort
+		// ProjectPath so we still produce a result rather than dropping the
+		// scan entirely.
+		s.log.Debug("pnpm root -g still empty after PATH workaround; using defaultPnpmBinDir=%q", extra)
+		globalDir = extra
+	} else {
+		s.log.Warn("pnpm found but `pnpm root -g` returned empty and no fallback available — skipping pnpm global scan")
 		return model.NodeScanResult{}, false
 	}
-	globalDir = filepath.Dir(globalDir)
 
+	// Try with --depth=3 first for transitive coverage (works on pnpm v10).
+	// Fall back to no --depth on non-zero exit — pnpm v11 hard-fails any
+	// --depth>=1 on -g and pnpm itself recommends omitting --depth.
 	start := time.Now()
-	// pnpm v11 exits non-zero on `--depth=3` for global scans; use `--depth=Infinity` there.
-	stdout, stderr, exitCode, _ := s.runCmd(ctx, 60*time.Second, "pnpm", "list", "-g", "--json", pnpmDepthArg(version))
+	stdout, stderr, exitCode, err := s.runCmd(ctx, 60*time.Second, pnpmCmd, "list", "-g", "--json", "--depth=3")
+	if exitCode != 0 {
+		s.log.Debug("pnpm list -g --depth=3 failed (exit=%d) — retrying without --depth (v11 path)", exitCode)
+		stdout, stderr, exitCode, err = s.runCmd(ctx, 60*time.Second, pnpmCmd, "list", "-g", "--json")
+	}
 	duration := time.Since(start).Milliseconds()
 
 	errMsg := ""
 	if exitCode != 0 {
 		errMsg = "pnpm list -g command failed"
 		s.log.Warn("pnpm list -g failed (exit_code=%d, %dms) — results may be incomplete", exitCode, duration)
 	}
-	s.log.Debug("pnpm global scan: version=%s global_dir=%s exit_code=%d stdout_bytes=%d duration=%dms", version, globalDir, exitCode, len(stdout), duration)
+	s.log.Debug("pnpm global scan: version=%s global_dir=%s exit_code=%d stdout_bytes=%d duration=%dms err=%v", version, globalDir, exitCode, len(stdout), duration, err)
 
 	return model.NodeScanResult{
 		ProjectPath:      globalDir,
@@ -234,6 +280,26 @@ func (s *NodeScanner) scanPnpmGlobal(ctx context.Context) (model.NodeScanResult,
 	}, true
 }
 
+// defaultPnpmBinDir returns the default pnpm global bin directory for the current OS
+// based on environment variables.
+func defaultPnpmBinDir(exec executor.Executor) string {
+	switch exec.GOOS() {
+	case model.PlatformDarwin:
+		if home := exec.Getenv("HOME"); home != "" {
+			return filepath.Join(home, "Library", "pnpm", "bin")
+		}
+	case model.PlatformLinux:
+		if home := exec.Getenv("HOME"); home != "" {
+			return filepath.Join(home, ".local", "share", "pnpm")
+		}
+	case model.PlatformWindows:
+		if localAppData := exec.Getenv("LOCALAPPDATA"); localAppData != "" {
+			return filepath.Join(localAppData, "pnpm")
+		}
+	}
+	return ""
+}
+
 // projectEntry holds a discovered package.json with its modification time for sorting.
 type projectEntry struct {
 	dir     string
@@ -405,19 +471,3 @@ func isInsideNodeModules(projectDir string) bool {
 	normalized := strings.ReplaceAll(projectDir, "\\", "/")
 	return strings.Contains(normalized, "/node_modules/")
 }
-
-// pnpmDepthArg picks the `--depth` arg for `pnpm list -g` based on the pnpm
-// version. pnpm v11 exits non-zero when `--depth=3` is passed to a global
-// scan; `--depth=Infinity` works on v11 and preserves transitive depth.
-// Falls back to `--depth=3` for older / unparseable versions to preserve
-// existing behavior.
-func pnpmDepthArg(version string) string {
-	v := strings.TrimSpace(version)
-	v = strings.TrimPrefix(v, "v")
-	major, _, _ := strings.Cut(v, ".")
-	n, err := strconv.Atoi(major)
-	if err == nil && n >= 11 {
-		return "--depth=Infinity"
-	}
-	return "--depth=3"
-}