fix: pnpm workspace exclude

lib/dep-graph-builders/pnpm/parse-workspace.ts

@@ -1,18 +1,18 @@
+import { DepGraph } from '@snyk/dep-graph';
 import * as debugModule from 'debug';
 import * as path from 'path';
-import { parsePkgJson } from '../util';
+import { getPnpmLockfileVersion } from '../../utils';
 import {
   PackageJsonBase,
   PnpmProjectParseOptions,
   ScannedNodeProject,
 } from '../types';
+import { parsePkgJson } from '../util';
 import { buildDepGraphPnpm } from './build-dep-graph-pnpm';
-import { DepGraph } from '@snyk/dep-graph';
+import { UNDEFINED_VERSION } from './constants';
 import { getPnpmLockfileParser } from './lockfile-parser/index';
 import { PnpmLockfileParser } from './lockfile-parser/lockfile-parser';
-import { getPnpmLockfileVersion } from '../../utils';
 import { getFileContents } from './utils';
-import { UNDEFINED_VERSION } from './constants';
 
 const debug = debugModule('snyk-pnpm-workspaces');
 
@@ -55,6 +55,7 @@ export const parsePnpmWorkspace = async (
     includeOptionalDeps,
     strictOutOfSync,
     pruneWithinTopLevelDeps,
+    exclude,
   } = options;
 
   const pnpmLockfileContents = getFileContents(
@@ -73,7 +74,20 @@ export const parsePnpmWorkspace = async (
     Object.keys(lockFileParser.importers),
   );
 
+  const excludeList = exclude ? exclude.split(',').map((s) => s.trim()) : [];
+
   for (const importer of Object.keys(lockFileParser.importers)) {
+    if (excludeList.length > 0) {
+      const importerParts = importer.split('/');
+      const shouldExclude = excludeList.some((excludeName) =>
+        importerParts.includes(excludeName),
+      );
+
+      if (shouldExclude) {
+        debug(`Skipping excluded importer: ${importer}`);
+        continue;
+      }
+    }
     const resolvedImporterPath = path.join(workspaceDir, importer);
     const packagePath = path.join(resolvedImporterPath, 'package.json');
     debug(`Processing project ${packagePath} as part of a pnpm workspace`);

lib/dep-graph-builders/types.ts

@@ -112,6 +112,7 @@ export type PnpmProjectParseOptions = {
   includeOptionalDeps: boolean;
   strictOutOfSync: boolean;
   pruneWithinTopLevelDeps: boolean;
+  exclude?: string;
 };
 
 type NodePkgManagers = 'npm' | 'yarn' | 'pnpm';

test/jest/dep-graph-builders/pnpm-workspaces.test.ts

@@ -313,3 +313,150 @@ describe('pnpm-lock-v9 catalogs support tests', () => {
     );
   });
 });
+
+describe('pnpm workspaces with exclude option', () => {
+  describe.each(['pnpm-lock-v5', 'pnpm-lock-v6', 'pnpm-lock-v9'])(
+    '%s',
+    (lockFileVersionPath) => {
+      it('excludes single directory', async () => {
+        const fixtureName = 'workspace-cyclic';
+        const result = await parsePnpmWorkspace(
+          __dirname,
+          join(__dirname, `./fixtures/${lockFileVersionPath}/${fixtureName}`),
+          {
+            includeDevDeps: false,
+            includeOptionalDeps: true,
+            pruneWithinTopLevelDeps: true,
+            strictOutOfSync: false,
+            exclude: 'backend',
+          },
+        );
+
+        expect(result).toHaveLength(2);
+
+        const targetFiles = result.map((r) => r.targetFile.replace(/\\/g, '/'));
+        expect(targetFiles).toContain(
+          `fixtures/${lockFileVersionPath}/${fixtureName}/package.json`,
+        );
+        expect(targetFiles).toContain(
+          `fixtures/${lockFileVersionPath}/${fixtureName}/shared/react/package.json`,
+        );
+        expect(targetFiles).not.toContain(
+          `fixtures/${lockFileVersionPath}/${fixtureName}/shared/backend/package.json`,
+        );
+      });
+
+      it('excludes multiple directories', async () => {
+        const fixtureName = 'workspace-cyclic';
+        const result = await parsePnpmWorkspace(
+          __dirname,
+          join(__dirname, `./fixtures/${lockFileVersionPath}/${fixtureName}`),
+          {
+            includeDevDeps: false,
+            includeOptionalDeps: true,
+            pruneWithinTopLevelDeps: true,
+            strictOutOfSync: false,
+            exclude: 'backend,react',
+          },
+        );
+
+        expect(result).toHaveLength(1);
+
+        const targetFiles = result.map((r) => r.targetFile.replace(/\\/g, '/'));
+        expect(targetFiles).toContain(
+          `fixtures/${lockFileVersionPath}/${fixtureName}/package.json`,
+        );
+        expect(targetFiles).not.toContain(
+          `fixtures/${lockFileVersionPath}/${fixtureName}/shared/backend/package.json`,
+        );
+        expect(targetFiles).not.toContain(
+          `fixtures/${lockFileVersionPath}/${fixtureName}/shared/react/package.json`,
+        );
+      });
+
+      it('matches any path segment', async () => {
+        const fixtureName = 'workspace-cyclic';
+        const result = await parsePnpmWorkspace(
+          __dirname,
+          join(__dirname, `./fixtures/${lockFileVersionPath}/${fixtureName}`),
+          {
+            includeDevDeps: false,
+            includeOptionalDeps: true,
+            pruneWithinTopLevelDeps: true,
+            strictOutOfSync: false,
+            exclude: 'shared',
+          },
+        );
+
+        expect(result).toHaveLength(1);
+
+        const targetFiles = result.map((r) => r.targetFile.replace(/\\/g, '/'));
+        expect(targetFiles).toContain(
+          `fixtures/${lockFileVersionPath}/${fixtureName}/package.json`,
+        );
+        expect(targetFiles).not.toContain(
+          `fixtures/${lockFileVersionPath}/${fixtureName}/shared/backend/package.json`,
+        );
+        expect(targetFiles).not.toContain(
+          `fixtures/${lockFileVersionPath}/${fixtureName}/shared/react/package.json`,
+        );
+      });
+
+      it('handles spaces in comma-separated list', async () => {
+        const fixtureName = 'workspace-cyclic';
+        const result = await parsePnpmWorkspace(
+          __dirname,
+          join(__dirname, `./fixtures/${lockFileVersionPath}/${fixtureName}`),
+          {
+            includeDevDeps: false,
+            includeOptionalDeps: true,
+            pruneWithinTopLevelDeps: true,
+            strictOutOfSync: false,
+            exclude: ' backend , react ',
+          },
+        );
+
+        expect(result).toHaveLength(1);
+
+        const targetFiles = result.map((r) => r.targetFile.replace(/\\/g, '/'));
+        expect(targetFiles).toContain(
+          `fixtures/${lockFileVersionPath}/${fixtureName}/package.json`,
+        );
+      });
+
+      it('works normally when exclude is undefined', async () => {
+        const fixtureName = 'workspace-cyclic';
+        const result = await parsePnpmWorkspace(
+          __dirname,
+          join(__dirname, `./fixtures/${lockFileVersionPath}/${fixtureName}`),
+          {
+            includeDevDeps: false,
+            includeOptionalDeps: true,
+            pruneWithinTopLevelDeps: true,
+            strictOutOfSync: false,
+            exclude: undefined,
+          },
+        );
+
+        expect(result).toHaveLength(3);
+      });
+
+      it('works normally when exclude is empty string', async () => {
+        const fixtureName = 'workspace-cyclic';
+        const result = await parsePnpmWorkspace(
+          __dirname,
+          join(__dirname, `./fixtures/${lockFileVersionPath}/${fixtureName}`),
+          {
+            includeDevDeps: false,
+            includeOptionalDeps: true,
+            pruneWithinTopLevelDeps: true,
+            strictOutOfSync: false,
+            exclude: '',
+          },
+        );
+
+        expect(result).toHaveLength(3);
+      });
+    },
+  );
+});