Track relative virtual path for workspaces

Signed-off-by: Prabhu Subramanian <[email protected]>
CycloneDX · Jan 20, 2025 · c91d431 · c91d431
1 parent 7576c90
commit c91d431
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 1 deletion.
diff --git a/lib/helpers/utils.js b/lib/helpers/utils.js
@@ -23,6 +23,7 @@ import path, {
   extname,
   join,
   resolve,
+  relative,
   sep as _sep,
 } from "node:path";
 import process from "node:process";
@@ -2213,6 +2214,10 @@ export async function parsePnpmLock(
             }
             if (matchSrcFile) {
               psObj.properties.push({ name: "SrcFile", value: matchSrcFile });
+              psObj.properties.push({
+                name: "internal:virtual_path",
+                value: relative(dirname(pnpmLock), dirname(matchSrcFile)),
+              });
             }
             parentSubComponents.push(psObj);
             fallbackMode = false;
@@ -2573,6 +2578,15 @@ export async function parsePnpmLock(
               name: "internal:is_workspace",
               value: "true",
             });
+            const wsSrcFile =
+              workspaceSrcFiles[decodeURIComponent(purlNoVersion)] ||
+              workspaceSrcFiles[theBomRef];
+            if (wsSrcFile) {
+              properties.push({
+                name: "internal:virtual_path",
+                value: relative(dirname(pnpmLock), dirname(wsSrcFile)),
+              });
+            }
           }
           // Capture all the workspaces that directly depend on this package and their source file
           for (const wref of Array.from(

diff --git a/types/lib/helpers/utils.d.ts.map b/types/lib/helpers/utils.d.ts.map