npm auto install for non-root package.json (#1478)

Signed-off-by: Prabhu Subramanian <[email protected]>

lib/cli/index.js

@@ -2271,7 +2271,11 @@ export async function createNodejsBom(path, options) {
     }
   }
   const pkgJsonLockFile = getAllFiles(path, "package-lock.json", options);
-  const pkgJsonFile = getAllFiles(path, "package.json", options);
+  const pkgJsonFile = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}package.json`,
+    options,
+  );
   const yarnLockFile = getAllFiles(path, "yarn.lock", options);
   const pnpmLockFile = getAllFiles(path, "pnpm-lock.yaml", options);
   if (
@@ -2283,7 +2287,7 @@ export async function createNodejsBom(path, options) {
   ) {
     let pkgMgr = "npm";
     const supPkgMgrs = ["npm", "yarn", "yarnpkg", "pnpm", "pnpx"];
-    const pkgData = JSON.parse(readFileSync(`${path}/package.json`, "utf8"));
+    const pkgData = JSON.parse(readFileSync(pkgJsonFile[0], "utf8"));
     const mgrData = pkgData.packageManager;
     let mgr = "";
     let installArgs = ["install"];
@@ -2299,9 +2303,10 @@ export async function createNodejsBom(path, options) {
         process.env[`${pkgMgr.toUpperCase()}_INSTALL_ARGS`].split(" ");
       installArgs = installArgs.concat(addArgs);
     }
-    console.log(`Executing '${pkgMgr} ${installArgs.join(" ")}' in`, path);
+    const basePath = dirname(pkgJsonFile[0]);
+    console.log(`Executing '${pkgMgr} ${installArgs.join(" ")}' in`, basePath);
     const result = spawnSync(pkgMgr, installArgs, {
-      cwd: path,
+      cwd: basePath,
       encoding: "utf-8",
       timeout: TIMEOUT_MS,
       maxBuffer: MAX_BUFFER,
@@ -6070,7 +6075,6 @@ export async function createXBom(path, options) {
   } catch (err) {
     return undefined;
   }
-  // node.js - package.json
   if (
     existsSync(join(path, "package.json")) ||
     existsSync(join(path, "rush.json")) ||

lib/helpers/utils.js

@@ -543,9 +543,17 @@ export function getAllFiles(dirPath, pattern, options = {}) {
     "**/flow-typed/**",
     "**/coverage/**",
   ];
-  // Only ignore node_modules and docs if the caller is not looking for package.json
+  // Only ignore node_modules if the caller is not looking for package.json
   if (!pattern.includes("package.json")) {
     ignoreList.push("**/node_modules/**");
+  }
+  // ignore docs only for non-lock file lookups
+  if (
+    !pattern.includes("package.json") &&
+    !pattern.includes("package-lock.json") &&
+    !pattern.includes("yarn.lock") &&
+    !pattern.includes("pnpm-lock.yaml")
+  ) {
     ignoreList.push("**/docs/**");
   }
   if (options?.exclude && Array.isArray(options.exclude)) {