feat: make lockfile optional

HISTORY.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file.
 
+## unreleased 
+
+* Changed
+  * The existence of a lock file is no longer enforced, as long as there are other evidence. ([#247] via [#248])  
+
+[#247]: https://github.com/CycloneDX/cyclonedx-node-npm/issues/247
+[#248]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/248
+
 ## 1.1.0 - 2022-10-22
 
 * Added

src/builders.ts

@@ -21,7 +21,7 @@ import { Builders, Enums, Factories, Models } from '@cyclonedx/cyclonedx-library
 import { execFileSync, execSync, ExecSyncOptionsWithBufferEncoding } from 'child_process'
 import { existsSync } from 'fs'
 import { PackageURL } from 'packageurl-js'
-import { dirname, resolve } from 'path'
+import { resolve } from 'path'
 
 import { PropertyNames, PropertyValueBool } from './properties'
 import { makeThisTool } from './thisTool'
@@ -98,12 +98,9 @@ export class BomBuilder {
     this.console = console_
   }
 
-  buildFromLockFile (filePath: string, process: NodeJS.Process): Models.Bom {
+  buildFromProjectDir (projectDir: string, process: NodeJS.Process): Models.Bom {
     return this.buildFromNpmLs(
-      this.fetchNpmLs(
-        dirname(filePath),
-        process
-      )
+      this.fetchNpmLs(projectDir, process)
     )
   }
 

src/cli.ts

@@ -188,27 +188,21 @@ export function run (process: NodeJS.Process): void {
   const projectDir = dirname(packageFile)
   myConsole.debug('DEBUG | projectDir: %s', projectDir)
 
-  /**
-   * The path to the used npm lock file.
-   *
-   * > If both `package-lock.json` and `npm-shrinkwrap.json` are present in a package root,
-   * > `npm-shrinkwrap.json` will be preferred over the `package-lock.json` file.
-   * source: {@link https://docs.npmjs.com/cli/v8/configuring-npm/npm-shrinkwrap-json}
-   */
-  let lockFile: string
-  const shrinkwrapFile = resolve(projectDir, 'npm-shrinkwrap.json')
-  const packageLockFile = resolve(projectDir, 'package-lock.json')
-  if (existsSync(shrinkwrapFile)) {
-    lockFile = shrinkwrapFile
-  } else if (existsSync(packageLockFile)) {
-    lockFile = packageLockFile
+  if (existsSync(resolve(projectDir, 'npm-shrinkwrap.json'))) {
+    myConsole.debug('DEBUG | detected a npm shrinkwrap file')
+  } else if (existsSync(resolve(projectDir, 'package-lock.json'))) {
+    myConsole.debug('DEBUG | detected a package lock file')
+  } else if (!options.packageLockOnly && existsSync(resolve(projectDir, 'node_modules'))) {
+    myConsole.debug('DEBUG | detected a node_modules dir')
+    // npm7 and later also might put a `node_modules/.package-lock.json` file
   } else {
-    throw new Error(
-      'Missing package lock file or npm shrinkwrap file.\n' +
-      'Did you forget to run `npm install` on your project accordingly?'
-    )
+    myConsole.log('LOG   | No evidence: no package lock file nor npm shrinkwrap file')
+    if (!options.packageLockOnly) {
+      myConsole.log('LOG   | No evidence: no node_modules dir')
+    }
+    myConsole.info('INFO  | ? Did you forget to run `npm install` on your project accordingly ?')
+    throw new Error('missing evidence')
   }
-  myConsole.debug('DEBUG | lockFile: %s', lockFile)
 
   const extRefFactory = new Factories.FromNodePackageJson.ExternalReferenceFactory()
 
@@ -230,7 +224,7 @@ export function run (process: NodeJS.Process): void {
       shortPURLs: options.shortPURLs
     },
     myConsole
-  ).buildFromLockFile(lockFile, process)
+  ).buildFromProjectDir(projectDir, process)
 
   const spec = Spec.SpecVersionDict[options.specVersion]
   if (undefined === spec) {

tests/integration/synthetics/cli.run.test.js

@@ -41,7 +41,7 @@ describe('cli.run()', () => {
     mkdirSync(tmpRootRun)
 
     test.each([
-      ['no-lockfile', /missing .*(?:lock|shrinkwrap) file/i],
+      ['no-lockfile', /missing evidence/i],
       ['no-manifest', /missing .*manifest file/i]
     ])('%s', (folderName, expectedError) => {
       const logFileBase = join(tmpRootRun, folderName)