Track workspaces for transitive dependencies for uv monorepos

Signed-off-by: Prabhu Subramanian <[email protected]>
CycloneDX · Jan 20, 2025 · 5646093 · 5646093
1 parent e6b6d67
commit 5646093
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 3 deletions.
diff --git a/.github/workflows/repotests.yml b/.github/workflows/repotests.yml
@@ -431,8 +431,6 @@ jobs:
       - name: repotests bionomia
         run: |
           bin/cdxgen.js -r -t ruby repotests/bionomia -o bomresults/bom-bionomia.json --fail-on-error
-          CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -r -t ruby3.3.6 repotests/bionomia -o bomresults/bom-bionomia-deep.json --deep --fail-on-error
-          CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -r -p -t ruby3.3.6 repotests/bionomia -o bomresults/bom-bionomia-research.json --profile research --fail-on-error
         shell: bash
       - name: repotests bazel-examples
         run: |

diff --git a/lib/helpers/utils.js b/lib/helpers/utils.js
@@ -4647,6 +4647,7 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
   const dependenciesList = [];
   const depsMap = {};
   const existingPkgMap = {};
+  const pkgBomRefMap = {};
   let directDepsKeys = {};
   let groupDepsKeys = {};
   let parentComponent;
@@ -4901,6 +4902,7 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
     }
     // This would help the lookup
     existingPkgMap[pkg.name.toLowerCase()] = pkg["bom-ref"];
+    pkgBomRefMap[pkg["bom-ref"]] = pkg;
     pkgList.push(pkg);
     if (!depsMap[pkg["bom-ref"]]) {
       depsMap[pkg["bom-ref"]] = new Set();
@@ -4922,6 +4924,19 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
           const nameStr =
             apkgDep.name || apkgDep.split(/(==|<=|~=|>=)/)[0].split(" ")[0];
           depsMap[pkg["bom-ref"]].add(existingPkgMap[nameStr] || nameStr);
+          // Propagate the workspace properties to the child components
+          if (
+            existingPkgMap[nameStr] &&
+            pkgBomRefMap[existingPkgMap[nameStr]]
+          ) {
+            const dependentPkg = pkgBomRefMap[existingPkgMap[nameStr]];
+            dependentPkg.properties = dependentPkg.properties || [];
+            for (const pprop of pkg.properties) {
+              if (pprop.name.startsWith("internal:workspace")) {
+                dependentPkg.properties.push(pprop);
+              }
+            }
+          }
         }
       } else if (Object.keys(apkg.dependencies).length) {
         for (const apkgDep of Object.keys(apkg.dependencies)) {

diff --git a/types/lib/helpers/utils.d.ts.map b/types/lib/helpers/utils.d.ts.map