feat: add error to fail early on workspace scanned as single proj (#15)

Author: gemaxim

lib/lock-parser/build-dep-graph.ts

@@ -33,10 +33,24 @@ export async function buildDepGraph(
   const manifestFileContents = fs.readFileSync(manifestFileFullPath, 'utf-8');
   const lockFileContents = fs.readFileSync(lockFileFullPath, 'utf-8');
 
+  const workspaceRootPath = path.parse(lockFileFullPath).dir;
+  const workspaceFileFullPath = path.resolve(
+    workspaceRootPath,
+    'pnpm-workspace.yaml',
+  );
+
   switch (lockfileVersion) {
     case NodeLockfileVersion.PnpmLockV5:
     case NodeLockfileVersion.PnpmLockV6:
     case NodeLockfileVersion.PnpmLockV9:
+      if (fs.existsSync(workspaceFileFullPath)) {
+        throw new InvalidUserInputError(
+          'Both `pnpm-lock.yaml` and `pnpm-workspace.yaml` were found in ' +
+            workspaceRootPath +
+            '.\n' +
+            'Please run your command again specifying `--all-projects` flag.',
+        );
+      }
       return await lockFileParser.parsePnpmProject(
         manifestFileContents,
         lockFileContents,

test/inspect.spec.ts

@@ -1,3 +1,4 @@
+import { InvalidUserInputError } from 'snyk-nodejs-lockfile-parser';
 import { inspect } from '../lib/index';
 import * as path from 'path';
 
@@ -64,5 +65,29 @@ describe('inspect', () => {
         expect(result.scannedProjects[0].depGraph?.toJSON()).not.toEqual({});
       },
     );
+
+    it('should throw error trying to scan a pnpm workspace as a simple file', async () => {
+      const packageManager = 'pnpm',
+        lockFileVersion = '9',
+        fixture = 'workspace-with-cross-ref',
+        targetFile = 'pnpm-lock.yaml';
+      const fixturePath = path.resolve(
+        __dirname,
+        'fixtures',
+        packageManager,
+        `lock-v${lockFileVersion}`,
+        fixture,
+      );
+      process.chdir(fixturePath);
+
+      await expect(() => inspect('.', targetFile, {})).rejects.toThrow(
+        new InvalidUserInputError(
+          'Both `pnpm-lock.yaml` and `pnpm-workspace.yaml` were found in ' +
+            fixturePath +
+            '.\n' +
+            'Please run your command again specifying `--all-projects` flag.',
+        ),
+      );
+    });
   });
 });