ci(mend): fix mend sca scan of packages

.github/actions/mend-sast/action.yml

@@ -1,12 +1,8 @@
 name: 'Mend SAST Scan'
 description: 'SAST scan packages for release'
 inputs:
-  scan_dir:
-    description: 'Directory to scan'
-    required: false
-    default: 'packages/'
   full_scan:
-    description: 'Scan full repo if true'
+    description: 'Scan full repo'
     required: false
     default: 'false'
   MEND_SAST_REPORT_NAME:
@@ -25,7 +21,6 @@ runs:
   steps:
     - name: Mend SAST scan
       env:
-        SCAN_DIR: ${{ inputs.scan_dir }}
         FULL_SCAN: ${{ inputs.full_scan }}
         REPORT_NAME: ${{ inputs.MEND_SAST_REPORT_NAME }}
         MEND_EMAIL: ${{ inputs.MEND_EMAIL }}
@@ -36,8 +31,8 @@ runs:
       run: |
         args=(--scope 'Mobile//unified-sdk-javascript' --retries 2 --non-interactive --report --filename "$REPORT_NAME" --formats json --name "${REPORT_NAME}_$(date +%s)")
         # Omit `--dir` on a full scan so Mend scans the whole repo.
-        if [ "$FULL_SCAN" != "true" ]; then
-          args+=(--dir "$SCAN_DIR")
+        if [ "$FULL_SCAN" = "false" ]; then
+          args+=(--dir packages)
         fi
         mend code "${args[@]}" > "$REPORT_NAME.txt"
 

.github/actions/mend-sca/action.yml

@@ -1,14 +1,14 @@
 name: 'Mend SCA Scan'
 description: 'SCA scan packages for release'
 inputs:
-  scan_dir:
-    description: 'Directory to scan'
-    required: false
-    default: 'packages/'
   full_scan:
-    description: 'Scan full repo if true'
+    description: 'Scan full repo'
     required: false
     default: 'false'
+  temp_dir:
+    description: 'Directory for staging manifests'
+    required: false
+    default: 'mend-scan-dir'
   MEND_SCA_REPORT_NAME:
     description: 'Filename for the output of the scan'
     required: false
@@ -23,40 +23,74 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - uses: pnpm/action-setup@v4
+    - name: Isolate package manifests in a temporary directory
+      if: inputs.full_scan != 'true'
+      shell: bash
+      env:
+        MEND_TEMP_DIR: ${{ inputs.temp_dir }}
+      # Mend SCA scans need a matching lockfile, so stage it and package manifests
+      # in a temporary directory
+      run: |
+        mkdir -p "$MEND_TEMP_DIR"/packages/sdk-effects
+        cp package.json pnpm-workspace.yaml pnpm-lock.yaml .npmrc "$MEND_TEMP_DIR/"
+
+        # Copy only manifests, preserving relative paths
+        for d in packages/*/ packages/sdk-effects/*/; do
+          # Skip directories which aren't npm packages
+          [ -f "$d/package.json" ] || continue
+          mkdir -p "$MEND_TEMP_DIR/$d" && cp "$d/package.json" "$MEND_TEMP_DIR/$d"
+        done
+
+    - name: Install pnpm
+      uses: pnpm/action-setup@v4
       with:
         run_install: false
 
     - name: Setup pnpm config
       run: pnpm config set store-dir '.pnpm-store' --global
       shell: bash
 
-    - uses: actions/setup-node@v6
+    - name: Install Node.js
+      uses: actions/setup-node@v6
       with:
         node-version-file: '.node-version'
         cache: 'pnpm'
         registry-url: 'https://registry.npmjs.org'
 
     - name: Install dependencies
-      run: pnpm install --frozen-lockfile
+      env:
+        FULL_SCAN: ${{ inputs.full_scan }}
+        MEND_TEMP_DIR: ${{ inputs.temp_dir }}
       shell: bash
+      run: |
+        if [ "$FULL_SCAN" = "false" ]; then
+          if [ ! -d "$MEND_TEMP_DIR" ]; then
+            echo "::error::Staging directory $MEND_TEMP_DIR does not exist."
+            exit 1
+          fi
+          cd "$MEND_TEMP_DIR"
+        fi
+
+        # Install deps with --prod flag to skip devDependencies
+        pnpm install --frozen-lockfile --ignore-scripts --prod
 
     - name: Mend SCA scan
       env:
-        SCAN_DIR: ${{ inputs.scan_dir }}
         FULL_SCAN: ${{ inputs.full_scan }}
+        MEND_TEMP_DIR: ${{ inputs.temp_dir }}
         REPORT_NAME: ${{ inputs.MEND_SCA_REPORT_NAME }}
         MEND_EMAIL: ${{ inputs.MEND_EMAIL }}
         MEND_USER_KEY: ${{ inputs.MEND_USER_KEY }}
         MEND_URL: ${{ inputs.MEND_SERVER_URL }}
       shell: bash
       # Mend SCA scan does not generate a report so tee output to both console and file
       # --update flag syncs the results to the Mend portal and overwrites any pre-existing vulnerabilities
+      # --no-default-exclusions flag is necessary to scan `packages/` directory
       run: |
-        args=(--non-interactive --update --scope 'Mobile//unified-sdk-javascript')
+        args=(--non-interactive --update --no-default-exclusions --scope 'Mobile//unified-sdk-javascript')
         # Omit `--dir` on a full scan so Mend scans the whole repo.
-        if [ "$FULL_SCAN" != "true" ]; then
-          args+=(--dir "$SCAN_DIR")
+        if [ "$FULL_SCAN" = "false" ]; then
+          args+=(--dir "$MEND_TEMP_DIR")
         fi
         mend dep "${args[@]}" 2>&1 | tee "$REPORT_NAME.txt"
 

.github/workflows/mend-release-scan.yml

@@ -8,13 +8,9 @@ name: Mend Scans for Release
 on:
   workflow_dispatch:
     inputs:
-      scan_dir:
-        description: 'Directory to scan'
-        required: false
-        default: 'packages/'
-        type: string
+      # When full_scan is off, only `packages/` are scanned by default
       full_scan:
-        description: 'Scan full repo if true'
+        description: 'Scan full repo (optional)'
         required: false
         type: boolean
         default: false
@@ -51,7 +47,6 @@ jobs:
         uses: ./.github/actions/mend-sast
         timeout-minutes: 10
         with:
-          scan_dir: ${{ inputs.scan_dir }}
           full_scan: ${{ inputs.full_scan }}
           MEND_SAST_REPORT_NAME: ${{ inputs.sast_report_name }}
           MEND_EMAIL: ${{ env.MEND_EMAIL }}
@@ -77,7 +72,6 @@ jobs:
         uses: ./.github/actions/mend-sca
         timeout-minutes: 10
         with:
-          scan_dir: ${{ inputs.scan_dir }}
           full_scan: ${{ inputs.full_scan }}
           MEND_SCA_REPORT_NAME: ${{ inputs.sca_report_name }}
           MEND_EMAIL: ${{ env.MEND_EMAIL }}

.gitignore

@@ -102,3 +102,6 @@ tasks/
 .polaris-setup-progress.json
 .playwright-mcp
 .polaris/
+
+# Mend
+mend-scan-dir/