Merge upstream:main

componentDetection.test.ts

@@ -68,3 +68,114 @@ describe("ComponentDetection.makePackageUrl", () => {
     expect(packageUrl).toBe("");
   });
 });
+
+describe("ComponentDetection.processComponentsToManifests", () => {
+  test("adds package as direct dependency when no top level referrers", () => {
+    const componentsFound = [
+      {
+        component: {
+          name: "test-package",
+          version: "1.0.0",
+          packageUrl: {
+            Scheme: "pkg",
+            Type: "npm",
+            Name: "test-package",
+            Version: "1.0.0"
+          },
+          id: "test-package 1.0.0 - npm"
+        },
+        isDevelopmentDependency: false,
+        topLevelReferrers: [], // Empty = direct dependency
+        locationsFoundAt: ["package.json"]
+      }
+    ];
+
+    const manifests = ComponentDetection.processComponentsToManifests(componentsFound);
+
+    expect(manifests).toHaveLength(1);
+    expect(manifests[0].name).toBe("package.json");
+    expect(manifests[0].directDependencies()).toHaveLength(1);
+    expect(manifests[0].indirectDependencies()).toHaveLength(0);
+    expect(manifests[0].countDependencies()).toBe(1);
+  });
+
+  test("adds package as indirect dependency when has top level referrers", () => {
+    const componentsFound = [
+      {
+        component: {
+          name: "test-package",
+          version: "1.0.0",
+          packageUrl: {
+            Scheme: "pkg",
+            Type: "npm",
+            Name: "test-package",
+            Version: "1.0.0"
+          },
+          id: "test-package 1.0.0 - npm"
+        },
+        isDevelopmentDependency: false,
+        topLevelReferrers: [
+          {
+            name: "parent-package",
+            version: "1.0.0",
+            packageUrl: {
+              Scheme: "pkg",
+              Type: "npm",
+              Name: "parent-package",
+              Version: "1.0.0"
+            }
+          }
+        ],
+        locationsFoundAt: ["package.json"]
+      }
+    ];
+
+    const manifests = ComponentDetection.processComponentsToManifests(componentsFound);
+
+    expect(manifests).toHaveLength(1);
+    expect(manifests[0].name).toBe("package.json");
+    expect(manifests[0].directDependencies()).toHaveLength(0);
+    expect(manifests[0].indirectDependencies()).toHaveLength(1);
+    expect(manifests[0].countDependencies()).toBe(1);
+  });
+
+  test("adds package as direct dependency when top level referrer is itself", () => {
+    const componentsFound = [
+      {
+        component: {
+          name: "test-package",
+          version: "1.0.0",
+          packageUrl: {
+            Scheme: "pkg",
+            Type: "npm",
+            Name: "test-package",
+            Version: "1.0.0"
+          },
+          id: "test-package 1.0.0 - npm"
+        },
+        isDevelopmentDependency: false,
+        topLevelReferrers: [
+          {
+            name: "test-package",
+            version: "1.0.0",
+            packageUrl: {
+              Scheme: "pkg",
+              Type: "npm",
+              Name: "test-package",
+              Version: "1.0.0"
+            }
+          }
+        ],
+        locationsFoundAt: ["package.json"]
+      }
+    ];
+
+    const manifests = ComponentDetection.processComponentsToManifests(componentsFound);
+
+    expect(manifests).toHaveLength(1);
+    expect(manifests[0].name).toBe("package.json");
+    expect(manifests[0].directDependencies()).toHaveLength(1);
+    expect(manifests[0].indirectDependencies()).toHaveLength(0);
+    expect(manifests[0].countDependencies()).toBe(1);
+  });
+});

componentDetection.ts

@@ -68,14 +68,17 @@ export default class ComponentDetection {
 
   public static async getManifestsFromResults(): Promise<Manifest[] | undefined> {
     core.info("Getting manifests from results");
+    const results = await fs.readFileSync(this.outputPath, 'utf8');
+    var json: any = JSON.parse(results);
+    return this.processComponentsToManifests(json.componentsFound);
+  }
+
+  public static processComponentsToManifests(componentsFound: any[]): Manifest[] {
     // Parse the result file and add the packages to the package cache
     const packageCache = new PackageCache();
     const packages: Array<ComponentDetectionPackage> = [];
 
-    const results = await fs.readFileSync(this.outputPath, 'utf8');
+    componentsFound.forEach(async (component: any) => {
-
-    var json: any = JSON.parse(results);
-    json.componentsFound.forEach(async (component: any) => {
       // Skip components without packageUrl
       if (!component.component.packageUrl) {
         core.debug(`Skipping component detected without packageUrl: ${JSON.stringify({
@@ -113,6 +116,7 @@ export default class ComponentDetection {
         }
 
         const referrerUrl = ComponentDetection.makePackageUrl(referrer.packageUrl);
+        referrer.packageUrlString = referrerUrl
 
         // Skip if the generated packageUrl is empty
         if (!referrerUrl) {
@@ -135,20 +139,32 @@ export default class ComponentDetection {
     const manifests: Array<Manifest> = [];
 
     // Check the locationsFoundAt for every package and add each as a manifest
-    packages.forEach(async (pkg: ComponentDetectionPackage) => {
+    this.addPackagesToManifests(packages, manifests);
-      pkg.locationsFoundAt.forEach(async (location: any) => {
+
+    return manifests;
+  }
+
+  private static addPackagesToManifests(packages: Array<ComponentDetectionPackage>, manifests: Array<Manifest>): void {
+    packages.forEach((pkg: ComponentDetectionPackage) => {
+      pkg.locationsFoundAt.forEach((location: any) => {
         if (!manifests.find((manifest: Manifest) => manifest.name == location)) {
           const manifest = new Manifest(location, location);
           manifests.push(manifest);
         }
-        if (pkg.topLevelReferrers.length == 0) {
+
+        // Filter out self-references from topLevelReferrers
+        const nonSelfReferrers = pkg.topLevelReferrers.filter((referrer: any) => {
+          if (!referrer.packageUrlString) return false;
+          return referrer.packageUrlString !== pkg.packageUrlString;
+        });
+
+        if (nonSelfReferrers.length == 0) {
           manifests.find((manifest: Manifest) => manifest.name == location)?.addDirectDependency(pkg, ComponentDetection.getDependencyScope(pkg));
         } else {
           manifests.find((manifest: Manifest) => manifest.name == location)?.addIndirectDependency(pkg, ComponentDetection.getDependencyScope(pkg));
         }
       });
     });
-    return manifests;
   }
 
   private static getDependencyScope(pkg: ComponentDetectionPackage) {
@@ -236,10 +252,12 @@ export default class ComponentDetection {
 }
 
 class ComponentDetectionPackage extends Package {
+  public packageUrlString: string;
 
   constructor(packageUrl: string, public id: string, public isDevelopmentDependency: boolean, public topLevelReferrers: [],
     public locationsFoundAt: [], public containerDetailIds: [], public containerLayerIds: []) {
     super(packageUrl);
+    this.packageUrlString = packageUrl;
   }
 }
 

dist/componentDetection.d.ts

@@ -7,6 +7,8 @@ export default class ComponentDetection {
     static runComponentDetection(path: string): Promise<void>;
     private static getComponentDetectionParameters;
     static getManifestsFromResults(): Promise<Manifest[] | undefined>;
+    static processComponentsToManifests(componentsFound: any[]): Manifest[];
+    private static addPackagesToManifests;
     private static getDependencyScope;
     static makePackageUrl(packageUrlJson: any): string;
     private static getLatestReleaseURL;

dist/index.js

@@ -36054,78 +36054,91 @@ class ComponentDetection {
     static getManifestsFromResults() {
         return __awaiter(this, void 0, void 0, function* () {
             core.info("Getting manifests from results");
-            // Parse the result file and add the packages to the package cache
-            const packageCache = new dependency_submission_toolkit_1.PackageCache();
-            const packages = [];
             const results = yield fs_1.default.readFileSync(this.outputPath, 'utf8');
             var json = JSON.parse(results);
-            json.componentsFound.forEach((component) => __awaiter(this, void 0, void 0, function* () {
+            return this.processComponentsToManifests(json.componentsFound);
-                // Skip components without packageUrl
+        });
-                if (!component.component.packageUrl) {
+    }
-                    core.debug(`Skipping component detected without packageUrl: ${JSON.stringify({
+    static processComponentsToManifests(componentsFound) {
-                        id: component.component.id,
+        // Parse the result file and add the packages to the package cache
-                        name: component.component.name || 'unnamed',
+        const packageCache = new dependency_submission_toolkit_1.PackageCache();
-                        type: component.component.type || 'unknown'
+        const packages = [];
-                    }, null, 2)}`);
+        componentsFound.forEach((component) => __awaiter(this, void 0, void 0, function* () {
+            // Skip components without packageUrl
+            if (!component.component.packageUrl) {
+                core.debug(`Skipping component detected without packageUrl: ${JSON.stringify({
+                    id: component.component.id,
+                    name: component.component.name || 'unnamed',
+                    type: component.component.type || 'unknown'
+                }, null, 2)}`);
+                return;
+            }
+            const packageUrl = ComponentDetection.makePackageUrl(component.component.packageUrl);
+            // Skip if the packageUrl is empty (indicates an invalid or missing packageUrl)
+            if (!packageUrl) {
+                core.debug(`Skipping component with invalid packageUrl: ${component.component.id}`);
+                return;
+            }
+            if (!packageCache.hasPackage(packageUrl)) {
+                const pkg = new ComponentDetectionPackage(packageUrl, component.component.id, component.isDevelopmentDependency, component.topLevelReferrers, component.locationsFoundAt, component.containerDetailIds, component.containerLayerIds);
+                packageCache.addPackage(pkg);
+                packages.push(pkg);
+            }
+        }));
+        // Set the transitive dependencies
+        core.debug("Sorting out transitive dependencies");
+        packages.forEach((pkg) => __awaiter(this, void 0, void 0, function* () {
+            pkg.topLevelReferrers.forEach((referrer) => __awaiter(this, void 0, void 0, function* () {
+                // Skip if referrer doesn't have a valid packageUrl
+                if (!referrer.packageUrl) {
+                    core.debug(`Skipping referrer without packageUrl for component: ${pkg.id}`);
                     return;
                 }
-                const packageUrl = ComponentDetection.makePackageUrl(component.component.packageUrl);
+                const referrerUrl = ComponentDetection.makePackageUrl(referrer.packageUrl);
-                // Skip if the packageUrl is empty (indicates an invalid or missing packageUrl)
+                referrer.packageUrlString = referrerUrl;
-                if (!packageUrl) {
+                // Skip if the generated packageUrl is empty
-                    core.debug(`Skipping component with invalid packageUrl: ${component.component.id}`);
+                if (!referrerUrl) {
+                    core.debug(`Skipping referrer with invalid packageUrl for component: ${pkg.id}`);
                     return;
                 }
-                if (!packageCache.hasPackage(packageUrl)) {
+                try {
-                    const pkg = new ComponentDetectionPackage(packageUrl, component.component.id, component.isDevelopmentDependency, component.topLevelReferrers, component.locationsFoundAt, component.containerDetailIds, component.containerLayerIds);
+                    const referrerPackage = packageCache.lookupPackage(referrerUrl);
-                    packageCache.addPackage(pkg);
+                    if (referrerPackage) {
-                    packages.push(pkg);
+                        referrerPackage.dependsOn(pkg);
+                    }
+                }
+                catch (error) {
+                    core.debug(`Error looking up referrer package: ${error}`);
                 }
             }));
-            // Set the transitive dependencies
+        }));
-            core.debug("Sorting out transitive dependencies");
+        // Create manifests
-            packages.forEach((pkg) => __awaiter(this, void 0, void 0, function* () {
+        const manifests = [];
-                pkg.topLevelReferrers.forEach((referrer) => __awaiter(this, void 0, void 0, function* () {
+        // Check the locationsFoundAt for every package and add each as a manifest
-                    // Skip if referrer doesn't have a valid packageUrl
+        this.addPackagesToManifests(packages, manifests);
-                    if (!referrer.packageUrl) {
+        return manifests;
-                        core.debug(`Skipping referrer without packageUrl for component: ${pkg.id}`);
+    }
-                        return;
+    static addPackagesToManifests(packages, manifests) {
-                    }
+        packages.forEach((pkg) => {
-                    const referrerUrl = ComponentDetection.makePackageUrl(referrer.packageUrl);
+            pkg.locationsFoundAt.forEach((location) => {
-                    // Skip if the generated packageUrl is empty
+                var _a, _b;
-                    if (!referrerUrl) {
+                if (!manifests.find((manifest) => manifest.name == location)) {
-                        core.debug(`Skipping referrer with invalid packageUrl for component: ${pkg.id}`);
+                    const manifest = new dependency_submission_toolkit_1.Manifest(location, location);
-                        return;
+                    manifests.push(manifest);
-                    }
+                }
-                    try {
+                // Filter out self-references from topLevelReferrers
-                        const referrerPackage = packageCache.lookupPackage(referrerUrl);
+                const nonSelfReferrers = pkg.topLevelReferrers.filter((referrer) => {
-                        if (referrerPackage) {
+                    if (!referrer.packageUrlString)
-                            referrerPackage.dependsOn(pkg);
+                        return false;
-                        }
+                    return referrer.packageUrlString !== pkg.packageUrlString;
-                    }
+                });
-                    catch (error) {
+                if (nonSelfReferrers.length == 0) {
-                        core.debug(`Error looking up referrer package: ${error}`);
+                    (_a = manifests.find((manifest) => manifest.name == location)) === null || _a === void 0 ? void 0 : _a.addDirectDependency(pkg, ComponentDetection.getDependencyScope(pkg));
-                    }
+                }
-                }));
+                else {
-            }));
+                    (_b = manifests.find((manifest) => manifest.name == location)) === null || _b === void 0 ? void 0 : _b.addIndirectDependency(pkg, ComponentDetection.getDependencyScope(pkg));
-            // Create manifests
+                }
-            const manifests = [];
+            });
-            // Check the locationsFoundAt for every package and add each as a manifest
-            packages.forEach((pkg) => __awaiter(this, void 0, void 0, function* () {
-                pkg.locationsFoundAt.forEach((location) => __awaiter(this, void 0, void 0, function* () {
-                    var _a, _b;
-                    if (!manifests.find((manifest) => manifest.name == location)) {
-                        const manifest = new dependency_submission_toolkit_1.Manifest(location, location);
-                        manifests.push(manifest);
-                    }
-                    if (pkg.topLevelReferrers.length == 0) {
-                        (_a = manifests.find((manifest) => manifest.name == location)) === null || _a === void 0 ? void 0 : _a.addDirectDependency(pkg, ComponentDetection.getDependencyScope(pkg));
-                    }
-                    else {
-                        (_b = manifests.find((manifest) => manifest.name == location)) === null || _b === void 0 ? void 0 : _b.addIndirectDependency(pkg, ComponentDetection.getDependencyScope(pkg));
-                    }
-                }));
-            }));
-            return manifests;
         });
     }
     static getDependencyScope(pkg) {
@@ -36216,6 +36229,7 @@ class ComponentDetectionPackage extends dependency_submission_toolkit_1.Package
         this.locationsFoundAt = locationsFoundAt;
         this.containerDetailIds = containerDetailIds;
         this.containerLayerIds = containerLayerIds;
+        this.packageUrlString = packageUrl;
     }
 }