Skip to content

Commit a5ff5bc

Browse files
MalickBurgerMalickBurger
committed
feat: add support for targetting specific workspaces
Signed-off-by: MalickBurger <[email protected]>
1 parent c6936ab commit a5ff5bc

File tree

4 files changed

+136
-38
lines changed

4 files changed

+136
-38
lines changed

Diff for: ‎README.md

+42-36
Original file line numberDiff line numberDiff line change
@@ -74,44 +74,50 @@ Usage: cyclonedx-npm [options] [--] [<package-manifest>]
7474
Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.
7575
7676
Arguments:
77-
<package-manifest> Path to project's manifest file.
78-
(default: "package.json" file in current working directory)
77+
<package-manifest> Path to project's manifest file.
78+
(default: "package.json" file in current working directory)
7979
8080
Options:
81-
--ignore-npm-errors Whether to ignore errors of NPM.
82-
This might be used, if "npm install" was run with "--force" or "--legacy-peer-deps".
83-
(default: false)
84-
--package-lock-only Whether to only use the lock file, ignoring "node_modules".
85-
This means the output will be based only on the few details in and the tree described by the "npm-shrinkwrap.json" or "package-lock.json", rather than the contents of "node_modules" directory.
86-
(default: false)
87-
--omit <type...> Dependency types to omit from the installation tree.
88-
(can be set multiple times)
89-
(choices: "dev", "optional", "peer", default: "dev" if the NODE_ENV environment variable is set to "production", otherwise empty)
90-
--flatten-components Whether to flatten the components.
91-
This means the actual nesting of node packages is not represented in the SBOM result.
92-
(default: false)
93-
--short-PURLs Omit all qualifiers from PackageURLs.
94-
This causes information loss in trade-off shorter PURLs, which might improve ingesting these strings.
95-
(default: false)
96-
--spec-version <version> Which version of CycloneDX spec to use.
97-
(choices: "1.2", "1.3", "1.4", "1.5", "1.6", default: "1.4")
98-
--output-reproducible Whether to go the extra mile and make the output reproducible.
99-
This requires more resources, and might result in loss of time- and random-based-values.
100-
(env: BOM_REPRODUCIBLE)
101-
--output-format <format> Which output format to use.
102-
(choices: "JSON", "XML", default: "JSON")
103-
--output-file <file> Path to the output file.
104-
Set to "-" to write to STDOUT.
105-
(default: write to STDOUT)
106-
--validate Validate resulting BOM before outputting.
107-
Validation is skipped, if requirements not met. See the README.
108-
--no-validate Disable validation of resulting BOM.
109-
--mc-type <type> Type of the main component.
110-
(choices: "application", "firmware", "library", default: "application")
111-
-v, --verbose Increase the verbosity of messages.
112-
Use multiple times to increase the verbosity even more.
113-
-V, --version output the version number
114-
-h, --help display help for command
81+
--ignore-npm-errors Whether to ignore errors of NPM.
82+
This might be used, if "npm install" was run with "--force" or "--legacy-peer-deps".
83+
(default: false)
84+
--package-lock-only Whether to only use the lock file, ignoring "node_modules".
85+
This means the output will be based only on the few details in and the tree described by the "npm-shrinkwrap.json" or "package-lock.json", rather than the contents of "node_modules" directory.
86+
(default: false)
87+
--omit <type...> Dependency types to omit from the installation tree.
88+
(can be set multiple times)
89+
(choices: "dev", "optional", "peer", default: "dev" if the NODE_ENV environment variable is set to "production", otherwise empty)
90+
--flatten-components Whether to flatten the components.
91+
This means the actual nesting of node packages is not represented in the SBOM result.
92+
(default: false)
93+
--short-PURLs Omit all qualifiers from PackageURLs.
94+
This causes information loss in trade-off shorter PURLs, which might improve ingesting these strings.
95+
(default: false)
96+
--spec-version <version> Which version of CycloneDX spec to use.
97+
(choices: "1.2", "1.3", "1.4", "1.5", "1.6", default: "1.4")
98+
--output-reproducible Whether to go the extra mile and make the output reproducible.
99+
This requires more resources, and might result in loss of time- and random-based-values.
100+
(env: BOM_REPRODUCIBLE)
101+
--output-format <format> Which output format to use.
102+
(choices: "JSON", "XML", default: "JSON")
103+
--output-file <file> Path to the output file.
104+
Set to "-" to write to STDOUT.
105+
(default: write to STDOUT)
106+
--validate Validate resulting BOM before outputting.
107+
Validation is skipped, if requirements not met. See the README.
108+
--no-validate Disable validation of resulting BOM.
109+
--mc-type <type> Type of the main component.
110+
(choices: "application", "firmware", "library", default: "application")
111+
-w --workspace <workspace...> Whether to only include dependencies for specific workspaces.
112+
(can be set multiple times)
113+
(default: empty)
114+
-wr --include-workspace-root Include the workspace root when workspaces are defined using "-w" or "--workspace".
115+
(default: false)
116+
-no-ws --no-workspaces Do not include dependencies for workspaces.
117+
-v, --verbose Increase the verbosity of messages.
118+
Use multiple times to increase the verbosity even more.
119+
-V, --version output the version number
120+
-h, --help display help for command
115121
```
116122

117123
## Demo

Diff for: ‎src/builders.ts

+35
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@ interface BomBuilderOptions {
3737
reproducible?: BomBuilder['reproducible']
3838
flattenComponents?: BomBuilder['flattenComponents']
3939
shortPURLs?: BomBuilder['shortPURLs']
40+
workspace?: BomBuilder['workspace']
41+
includeWorkspaceRoot?: BomBuilder['includeWorkspaceRoot']
42+
workspaces?: BomBuilder['workspaces']
4043
}
4144

4245
type cPath = string
@@ -56,6 +59,9 @@ export class BomBuilder {
5659
reproducible: boolean
5760
flattenComponents: boolean
5861
shortPURLs: boolean
62+
workspace: string[]
63+
includeWorkspaceRoot: boolean
64+
workspaces: boolean
5965

6066
console: Console
6167

@@ -79,6 +85,9 @@ export class BomBuilder {
7985
this.reproducible = options.reproducible ?? false
8086
this.flattenComponents = options.flattenComponents ?? false
8187
this.shortPURLs = options.shortPURLs ?? false
88+
this.workspace = options.workspace ?? []
89+
this.includeWorkspaceRoot = options.includeWorkspaceRoot ?? false
90+
this.workspaces = options.workspaces ?? true
8291

8392
this.console = console_
8493
}
@@ -165,6 +174,32 @@ export class BomBuilder {
165174
}
166175
}
167176

177+
for (const workspace of this.workspace) {
178+
if (npmVersionT[0] >= 7) {
179+
args.push(`--workspace=${workspace}`)
180+
} else {
181+
this.console.warn('WARN | your NPM does not support "--workspace=%s", internally skipped this option', workspace)
182+
}
183+
}
184+
185+
// No need to set explicitly if false as this is default behaviour
186+
if (this.includeWorkspaceRoot) {
187+
if (npmVersionT[0] >= 7) {
188+
args.push('--include-workspace-root=true')
189+
} else {
190+
this.console.warn('WARN | your NPM does not support "--include-workspace-root=true", internally skipped this option')
191+
}
192+
}
193+
194+
// No need to set explicitly if true as this is default behaviour
195+
if (!this.workspaces) {
196+
if (npmVersionT[0] >= 7) {
197+
args.push('--workspaces=false')
198+
} else {
199+
this.console.warn('WARN | your NPM does not support "--workspaces=false", internally skipped this option')
200+
}
201+
}
202+
168203
this.console.info('INFO | gathering dependency tree ...')
169204
this.console.debug('DEBUG | npm-ls: run npm with %j in %j', args, projectDir)
170205
let npmLsReturns: Buffer

Diff for: ‎src/cli.ts

+37-1
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@ interface CommandOptions {
5151
outputFile: string
5252
validate: boolean | undefined
5353
mcType: Enums.ComponentType
54+
workspace: string[]
55+
includeWorkspaceRoot: boolean
56+
workspaces: boolean | undefined
5457
verbose: number
5558
}
5659

@@ -166,6 +169,22 @@ function makeCommand (process: NodeJS.Process): Command {
166169
).default(
167170
Enums.ComponentType.Application
168171
)
172+
).addOption(
173+
new Option(
174+
'-w, --workspace <workspace...>',
175+
'Whether to only include dependencies for a specific workspace. ' +
176+
'(can be set multiple times)'
177+
).default([], 'empty')
178+
).addOption(
179+
new Option(
180+
'-no-ws, --no-workspaces',
181+
'Do not include dependencies for workspaces.'
182+
)
183+
).addOption(
184+
new Option(
185+
'-wr, --include-workspace-root',
186+
'Include the workspace root when workspaces are defined using `-w` or `--workspace`.'
187+
).default(false)
169188
).addOption(
170189
new Option(
171190
'-v, --verbose',
@@ -231,6 +250,20 @@ export async function run (process: NodeJS.Process): Promise<number> {
231250
throw new Error('missing evidence')
232251
}
233252

253+
if (options.workspaces !== undefined && !options.workspaces) {
254+
if (options.workspace !== undefined && options.workspace.length > 0) {
255+
myConsole.error('ERROR | Bad config: `--workspace` option cannot be used when `--no-workspaces` is also configured')
256+
throw new Error('bad config')
257+
}
258+
}
259+
260+
if (options.includeWorkspaceRoot) {
261+
if (options.workspace.length === 0) {
262+
myConsole.error('ERROR | Bad config: `--include-workspace-root` can only be used when `--workspace` is also configured')
263+
throw new Error('bad config')
264+
}
265+
}
266+
234267
const extRefFactory = new Factories.FromNodePackageJson.ExternalReferenceFactory()
235268

236269
myConsole.log('LOG | gathering BOM data ...')
@@ -249,7 +282,10 @@ export async function run (process: NodeJS.Process): Promise<number> {
249282
omitDependencyTypes: options.omit,
250283
reproducible: options.outputReproducible,
251284
flattenComponents: options.flattenComponents,
252-
shortPURLs: options.shortPURLs
285+
shortPURLs: options.shortPURLs,
286+
workspace: options.workspace,
287+
includeWorkspaceRoot: options.includeWorkspaceRoot,
288+
workspaces: options.workspaces
253289
},
254290
myConsole
255291
).buildFromProjectDir(projectDir, process)

Diff for: ‎tests/integration/cli.args-pass-through.test.js

+22-1
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,29 @@ describe('integration.cli.args-pass-through', () => {
6666
['package-lock-only npm 7', `7.${rMinor}.${rPatch}`, ['--package-lock-only'], [...npm7ArgsGeneral, '--package-lock-only']],
6767
['package-lock-only npm 8', `8.${rMinor}.${rPatch}`, ['--package-lock-only'], [...npm8ArgsGeneral, '--package-lock-only']],
6868
['package-lock-only npm 9', `9.${rMinor}.${rPatch}`, ['--package-lock-only'], [...npm9ArgsGeneral, '--package-lock-only']],
69-
['package-lock-only npm 10', `10.${rMinor}.${rPatch}`, ['--package-lock-only'], [...npm10ArgsGeneral, '--package-lock-only']]
69+
['package-lock-only npm 10', `10.${rMinor}.${rPatch}`, ['--package-lock-only'], [...npm10ArgsGeneral, '--package-lock-only']],
7070
// endregion package-lock-only
71+
// region workspace
72+
['workspace not supported npm 6', `6.${rMinor}.${rPatch}`, ['--workspace', 'my-wsA', '-w', 'my-wsB'], [...npm6ArgsGeneral]],
73+
['workspace npm 7', `7.${rMinor}.${rPatch}`, ['--workspace', 'my-wsA', '-w', 'my-wsB'], [...npm7ArgsGeneral, '--workspace=my-wsA', '--workspace=my-wsB']],
74+
['workspace npm 8', `8.${rMinor}.${rPatch}`, ['--workspace', 'my-wsA', '-w', 'my-wsB'], [...npm8ArgsGeneral, '--workspace=my-wsA', '--workspace=my-wsB']],
75+
['workspace npm 9', `9.${rMinor}.${rPatch}`, ['--workspace', 'my-wsA', '-w', 'my-wsB'], [...npm9ArgsGeneral, '--workspace=my-wsA', '--workspace=my-wsB']],
76+
['workspace npm 10', `10.${rMinor}.${rPatch}`, ['--workspace', 'my-wsA', '-w', 'my-wsB'], [...npm10ArgsGeneral, '--workspace=my-wsA', '--workspace=my-wsB']],
77+
// endregion workspace
78+
// region include-workspace-root
79+
['workspace root not supported npm 6', `6.${rMinor}.${rPatch}`, ['-w', 'my-wsA', '--include-workspace-root'], [...npm6ArgsGeneral]],
80+
['workspace root npm 7', `7.${rMinor}.${rPatch}`, ['--workspace', 'my-wsA', '-w', 'my-wsB', '--include-workspace-root'], [...npm7ArgsGeneral, '--workspace=my-wsA', '--workspace=my-wsB', '--include-workspace-root=true']],
81+
['workspace root npm 8', `8.${rMinor}.${rPatch}`, ['--workspace', 'my-wsA', '-w', 'my-wsB', '--include-workspace-root'], [...npm8ArgsGeneral, '--workspace=my-wsA', '--workspace=my-wsB', '--include-workspace-root=true']],
82+
['workspace root npm 9', `9.${rMinor}.${rPatch}`, ['--workspace', 'my-wsA', '-w', 'my-wsB', '--include-workspace-root'], [...npm9ArgsGeneral, '--workspace=my-wsA', '--workspace=my-wsB', '--include-workspace-root=true']],
83+
['workspace root npm 10', `10.${rMinor}.${rPatch}`, ['--workspace', 'my-wsA', '-w', 'my-wsB', '--include-workspace-root'], [...npm10ArgsGeneral, '--workspace=my-wsA', '--workspace=my-wsB', '--include-workspace-root=true']],
84+
// endregion include-workspace-root
85+
// region workspaces
86+
['workspaces disabled not supported npm 6', `6.${rMinor}.${rPatch}`, ['--no-workspaces'], [...npm6ArgsGeneral]],
87+
['workspaces disabled npm 7', `7.${rMinor}.${rPatch}`, ['--no-workspaces'], [...npm7ArgsGeneral, '--workspaces=false']],
88+
['workspaces disabled npm 8', `8.${rMinor}.${rPatch}`, ['-no-ws'], [...npm8ArgsGeneral, '--workspaces=false']],
89+
['workspaces disabled npm 9', `9.${rMinor}.${rPatch}`, ['--no-workspaces'], [...npm9ArgsGeneral, '--workspaces=false']],
90+
['workspaces disabled npm 10', `10.${rMinor}.${rPatch}`, ['-no-ws'], [...npm10ArgsGeneral, '--workspaces=false']]
91+
// endregion workspaces
7192
])('%s', async (purpose, npmVersion, cdxArgs, expectedArgs) => {
7293
const logFileBase = join(tmpRootRun, purpose.replace(/\W/g, '_'))
7394
const cwd = dummyProjectsRoot

0 commit comments

Comments
 (0)