Merge pull request #143 from snyk/fix/parse-poetry-dependencies-based…

…-on-poetry-lock fix: use poetry-lock file as a target file for poetry project
snyk · May 6, 2021 · 0f466d0 · 0f466d0
2 parents b9842df + 105accd
commit 0f466d0
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 9 deletions.
diff --git a/lib/dependencies/index.ts b/lib/dependencies/index.ts
@@ -28,7 +28,7 @@ export async function getDependencies(
   const includeDevDeps = !!(options.dev || false);
 
   // handle poetry projects by parsing manifest & lockfile and return a dep-graph
-  if (path.basename(targetFile) === FILENAMES.poetry.manifest) {
+  if (path.basename(targetFile) === FILENAMES.poetry.lockfile) {
     return getPoetryDependencies(command, root, targetFile, includeDevDeps);
   }
 

diff --git a/lib/dependencies/inspect-implementation.ts b/lib/dependencies/inspect-implementation.ts
@@ -23,7 +23,7 @@ export function getMetaData(
         // specify targetFile only in case of Pipfile or setup.py
         targetFile: path
           .basename(targetFile)
-          .match(/^(Pipfile|setup\.py|pyproject\.toml)$/)
+          .match(/^(Pipfile|setup\.py|poetry\.lock)$/)
           ? targetFile
           : undefined,
       };

diff --git a/lib/dependencies/poetry.ts b/lib/dependencies/poetry.ts
@@ -11,10 +11,11 @@ export async function getPoetryDependencies(
   targetFile: string,
   includeDevDeps = false
 ): Promise<SinglePackageResult> {
-  const manifestPath = path.join(root, targetFile);
-  const baseDir = path.dirname(manifestPath);
-  const lockfilePath = path.join(baseDir, FILENAMES.poetry.lockfile);
+  const lockfilePath = path.join(root, targetFile);
+  const baseDir = path.dirname(lockfilePath);
+  const manifestPath = path.join(baseDir, FILENAMES.poetry.manifest);
   const manifestExists = fs.existsSync(manifestPath);
+
   if (!manifestExists) {
     throw new Error('Cannot find manifest file ' + manifestPath);
   }

diff --git a/test/system/inspect.spec.ts b/test/system/inspect.spec.ts
@@ -1,19 +1,20 @@
 import { inspect } from '../../lib';
 import { chdirWorkspaces } from '../test-utils';
 import { DepGraphBuilder } from '@snyk/dep-graph';
+import { FILENAMES } from '../../lib/types';
 
 // TODO: jestify tap tests in ./inspect.test.js here
 describe('inspect', () => {
   it('should return expected dependencies for poetry-app', async () => {
     const workspace = 'poetry-app';
     chdirWorkspaces(workspace);
 
-    const result = await inspect('.', 'pyproject.toml');
+    const result = await inspect('.', FILENAMES.poetry.lockfile);
     expect(result).toMatchObject({
       plugin: {
         name: 'snyk-python-plugin',
         runtime: expect.any(String), // any version of Python
-        targetFile: 'pyproject.toml',
+        targetFile: FILENAMES.poetry.lockfile,
       },
       package: null, // no dep-tree
       dependencyGraph: {}, // match any dep-graph (equality checked below)

diff --git a/test/unit/poetry.spec.ts b/test/unit/poetry.spec.ts
@@ -11,7 +11,7 @@ describe('getPoetryDepencies', () => {
     try {
       await getPoetryDependencies('python', root, targetFile);
     } catch (e) {
-      const expectedPath = path.join(root, targetFile);
+      const expectedPath = path.join(root, FILENAMES.poetry.manifest);
       const expected = new Error(`Cannot find manifest file ${expectedPath}`);
       expect(e).toEqual(expected);
     }
@@ -25,7 +25,7 @@ describe('getPoetryDepencies', () => {
       'workspaces',
       'poetry-app-without-lockfile'
     );
-    const targetFile = 'pyproject.toml';
+    const targetFile = FILENAMES.poetry.lockfile;
     try {
       await getPoetryDependencies('python', root, targetFile);
     } catch (e) {