npm workspace filtering#1798
Conversation
| } | ||
|
|
||
| populateChildren(graph, child, children, directWorkspaceDependency, combinedPackageJson, aliasMapping); | ||
| // When a workspace is excluded by the filter, do not traverse its children — |
There was a problem hiding this comment.
@dterrybd I believe this is the core logic right? rest is just plumbing code if I'm not wrong?
There was a problem hiding this comment.
For the npm CLI detector that is correct. This cuts off processing the children of a workspace that is being excluded and is the main logic addition for this detector. There are changes for the shrinkwrap/lockfile detector and the package json detector (see the bottom of the description of this PR for the specific classes) but the changes were smaller there. We mostly read workspace data into specific structures so if a workspace is excluded we could easily filter out that data.
| String workspaceJsonString | ||
| = FileUtils.readFileToString(new File(workspaceJsonPath.toString()), StandardCharsets.UTF_8); | ||
|
|
||
|
|
There was a problem hiding this comment.
@dterrybd this is just idenifying the workspace paths so the downstream extractor can apply the workspace filters correctly?
There was a problem hiding this comment.
yes, the CLI and shrinkwrap/lockfile detectors will use knowledge from the package.json to do their calculations so there is a little bit more logic in this class than just powering the package json detector
|
Can we improve the overall class and function comments in the npm detector package overall? Like this PR has nice comments! 👍 |
There's an internal document on npm when it was restructured for the new lockfiles a few years back. I'll file a ticket to bring some of that knowledge into the codebase as comments where it makes sense. |
3 participants
This PR adds two new configuration properties — detect.npm.excluded.workspaces and detect.npm.included.workspaces that let users control which npm workspaces are included in a Detect scan.
Workspaces are identified by their path relative to the project root (e.g. packages/react-components), matching the existing convention used by the equivalent Yarn properties (detect.yarn.excluded.workspaces / detect.yarn.included.workspaces). Both the lockfile path (NpmLockfilePackager) and the CLI path (NpmCliParser) respect the filter, and glob wildcards are supported (e.g. packages/internal-*). By default all workspaces are included; the exclude list takes precedence over the include list when both are specified.
note: based on review feedback I have added detect.npm.ignore.all.workspaces. When set to true this will ignore all workspaces and takes precedence over other settings.
filtering takes place primarily in:
package json detector: detectable/src/main/java/com/blackduck/integration/detectable/detectables/npm/packagejson/CombinedPackageJsonExtractor.java
shrinkwrap and lockfile detectors: detectable/src/main/java/com/blackduck/integration/detectable/detectables/npm/lockfile/parse/NpmLockfilePackager.java
cli detector:
detectable/src/main/java/com/blackduck/integration/detectable/detectables/npm/cli/parse/NpmCliParser.java