feat: add JS workspace discovery and public batch API#415
Open
a-oren wants to merge 4 commits intoguacsec:mainfrom
Open
feat: add JS workspace discovery and public batch API#415a-oren wants to merge 4 commits intoguacsec:mainfrom
a-oren wants to merge 4 commits intoguacsec:mainfrom
Conversation
Add JavaScript/TypeScript monorepo workspace support to the Java client: - Add JsWorkspaceDiscovery utility for parsing pnpm-workspace.yaml and package.json workspaces field to discover member package.json manifests - Add parent-traversal lock file discovery to JavaScriptProviderFactory so workspace members find the lock file at the workspace root - Add stackAnalysisBatch() and stackAnalysisBatchHtml() to Api interface - Implement batch methods in ExhortApi using existing performBatchAnalysis() infrastructure with TRUSTIFY_DA_CONTINUE_ON_ERROR support - Add jackson-dataformat-yaml dependency for YAML parsing - Add comprehensive test suites for workspace discovery and lock file walk-up Implements TC-3863 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
Author
|
/review |
ruromero
requested changes
Apr 15, 2026
| var provider = Ecosystem.getProvider(manifest); | ||
| var content = provider.provideStack(); | ||
| var sbomJson = mapper.readTree(content.buffer); | ||
| String key = manifest.getParent().getFileName().toString(); |
Collaborator
There was a problem hiding this comment.
the key must be a purl, not the file name.
Use the sbom metadata.component.purl
|
|
||
| Map<String, JsonNode> getBatchStackSboms( | ||
| final Path workspaceDir, final Set<String> ignorePatterns) { | ||
| boolean continueOnError = Environment.getBoolean("TRUSTIFY_DA_CONTINUE_ON_ERROR", false); |
Collaborator
There was a problem hiding this comment.
This defaults to true in the JS implementation
https://github.com/guacsec/trustify-da-javascript-client/blob/main/src/batch_opts.js#L10
| boolean continueOnError = Environment.getBoolean("TRUSTIFY_DA_CONTINUE_ON_ERROR", false); | ||
| try { | ||
| List<Path> manifests = | ||
| JsWorkspaceDiscovery.discoverWorkspaceManifests(workspaceDir, ignorePatterns); |
Collaborator
There was a problem hiding this comment.
This should be generic and also support Cargo. At this point it should detect the provider and get the manifests for this provider.
As this PR is only for Cargo support, implement only the manifest detection and the provider resolution.
| final Path workspaceDir, final Set<String> ignorePatterns) { | ||
| boolean continueOnError = Environment.getBoolean("TRUSTIFY_DA_CONTINUE_ON_ERROR", false); | ||
| try { | ||
| List<Path> manifests = |
Collaborator
There was a problem hiding this comment.
I recommend that here if the root is not private we also return the root as a folder so that a report for the root is also generated having 1 + N (root + modules)
This is not possible in all package managers but when possible it should be done to provide more information about license and production deps in the root package
- Use purl as SBOM map key instead of directory name - Default TRUSTIFY_DA_CONTINUE_ON_ERROR to true (matching JS client) - Add generic ecosystem detection: Cargo workspace first, then JS - Add Cargo workspace discovery via cargo metadata --no-deps - Add configurable batch concurrency (TRUSTIFY_DA_BATCH_CONCURRENCY) - Add batch metadata logging (TRUSTIFY_DA_BATCH_METADATA) - Add ignore pattern resolution from defaults + env var + caller - Include root package.json when not private (1+N pattern) - Extract shared WorkspaceUtils.filterByIgnorePatterns() utility - Check for JS lock file before attempting JS workspace discovery Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
Author
|
@ruromero Thanks for the review! I pushed the changes |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
JsWorkspaceDiscoveryutility for parsingpnpm-workspace.yamlandpackage.jsonworkspaces field to discover memberpackage.jsonmanifestsJavaScriptProviderFactoryso workspace members find the lock file at the workspace rootstackAnalysisBatch()andstackAnalysisBatchHtml()toApiinterface andExhortApiimplementationjackson-dataformat-yamldependency for YAML parsingDetails
JsWorkspaceDiscoveryis a static utility class that discovers workspacemember packages by parsing
pnpm-workspace.yaml(packages array) orpackage.json(workspaces array/object format). It globs forpackage.jsonfiles, filters by ignore patterns, and validates each manifest has
nameand
versionfields.JavaScriptProviderFactory.create()now walks up parent directories whenno lock file is found in the manifest directory. This enables workspace
member packages to find the single lock file at the workspace root.
The walk-up stops at workspace root boundaries or git root, and supports
TRUSTIFY_DA_WORKSPACE_DIRoverride.The batch API methods delegate to the existing
performBatchAnalysis()infrastructure, following the same pattern as
imageAnalysis(). Config(
TRUSTIFY_DA_CONTINUE_ON_ERROR) is read from environment internally.Implements TC-3863
Test plan
🤖 Generated with Claude Code