feat(go): construct dependencies in the parser

[knqyf263]

Description

The construction of the relationship between the root package and direct dependencies is now done by the SBOM package, etc.

trivy/pkg/sbom/io/encode.go

Lines 420 to 462 in 542a380

	// belongToParent determines if a package should be directly included in the parent based on its relationship and dependencies.
	func (*Encoder) belongToParent(pkg ftypes.Package, pkgType ftypes.TargetType, parents map[string]ftypes.Packages) bool {
	// Case 1: Direct/Indirect/Workspace: known , DependsOn: known
	// 1-1: Only direct packages are included in the parent (RelationshipContains or RelationshipDependsOn)
	// 1-2: Each direct package includes its dependent packages (RelationshipDependsOn).
	// 1-3: All workspace packages and included in the parent (RelationshipContains or RelationshipDependsOn)
	// 1-4: Maven only: direct package is include in the workspace package only (e.g. dependencies of maven modules)
	// Case 2: Direct/Indirect/Workspace: unknown, DependsOn: unknown (e.g., conan lockfile v2)
	// All packages are included in the parent (RelationshipContains or RelationshipDependsOn).
	// Case 3: Direct/Indirect/Workspace: unknown, DependsOn: known (e.g., OS packages)
	// All packages are included in the parent (RelationshipContains or RelationshipDependsOn).
	// Case 4: Direct/Indirect/Workspace: known , DependsOn: unknown (e.g., go.mod without $GOPATH)
	// All packages are included in the parent (RelationshipContains or RelationshipDependsOn).
	switch {
	// Case 1-1: direct packages
	case pkg.Relationship == ftypes.RelationshipDirect && pkgType != ftypes.Pom:
	return true
	// Case 1-2: indirect packages
	case pkg.Relationship == ftypes.RelationshipIndirect && len(parents[pkg.ID]) != 0:
	return false
	// Case 1-3: workspace packages
	case pkg.Relationship == ftypes.RelationshipWorkspace:
	return true
	// Case 1-4: maven direct packages
	case pkg.Relationship == ftypes.RelationshipDirect && pkgType == ftypes.Pom:
	// Add a package to the parent relation if one of the parents is a root package
	if _, found := lo.Find(parents[pkg.ID], func(p ftypes.Package) bool {
	return p.Relationship == ftypes.RelationshipRoot
	}); found {
	return true
	}
	// Case where this package is a child of workspace(s) only
	return false
	// Case 2 & 3:
	case pkg.Relationship == ftypes.RelationshipUnknown:
	return true
	// Case 4:
	case pkg.Relationship == ftypes.RelationshipIndirect && len(parents[pkg.ID]) == 0:
	return true
	default:
	return true
	}
	}

However, since the logic has become complicated, it should be changed to be done on the analyzer side (strictly speaking, on the parser side) for the sake of simplification.

Related PRs

• feat: add workspaceRelationship #7889

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

LGTM
left 1 small comment