Repository navigation
fix(misc/npm-source): annotate packages when scanning the project directory - #2495
Open
Thanatos9404 wants to merge 1 commit into
Open
Thanatos9404 wants to merge 1 commit into
Thanatos9404 wants to merge 1 commit into
Conversation
…ectory
npmProjectRootDirectory looked for "/node_modules/" in the package.json
path to find the project root. When the scan root is the project
directory itself, the paths start with "node_modules/" and have no
leading slash. Top level packages were then skipped, and nested packages
were matched against a directory inside node_modules where no lockfile
exists. In both cases the source from the project lockfile was lost.
Map a path that starts with "node_modules/" to the scan root (".") so
the lockfile next to node_modules is used.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When scalibr is run with the project directory as the scan root, the
misc/npm-sourceannotator doesn't set the package source. Paths then look likenode_modules/foo/package.json, butnpmProjectRootDirectoryonly looks for/node_modules/with a leading slash. Top level packages get no project root and end up with?source=UNKNOWN, and nested ones look for a lockfile inside their parent package. Scanning the parent directory works.This change maps a path that starts with
node_modules/to the scan root (.), soResolvedFromLockfilereads the lockfile from there. Paths with a directory in front ofnode_modulesare handled as before.Tests: new cases in
TestMapNPMProjectRootsToPackagesandTestAnnotate_LockfileV2for scans from the project directory. Those cases fail without the fix and pass with it; the other new cases guard the existing behaviour.Fixes #1486