uv detector improvements - multi group dev dependencies, git source detection, transitive dev propagation

docs/detectors/uv.md

@@ -1,6 +1,20 @@
 # uv Detection
+
 ## Requirements
+
 [uv](https://docs.astral.sh/uv/) detection relies on a [uv.lock](https://docs.astral.sh/uv/concepts/projects/layout/#the-lockfile) file being present.
 
 ## Detection strategy
+
 uv detection is performed by parsing a <em>uv.lock</em> found under the scan directory.
+
+Full dependency graph generation is supported.
+
+Dev dependencies across all dependency groups (e.g., `dev`, `lint`, `test`) are identified via transitive reachability analysis. A package reachable from both production and dev roots is classified as non-dev.
+
+Git-sourced packages are registered as `GitComponent` with the repository URL and commit hash extracted from the lockfile.
+
+## Known limitations
+
+1. Editable (`source = { editable = "..." }`) and non-root workspace member packages are registered as regular components rather than being filtered out.
+2. Lockfile version validation is not performed; only lockfile version 1 has been tested.

src/Microsoft.ComponentDetection.Detectors/uv/UvLock.cs

@@ -84,6 +84,7 @@ internal static List<UvPackage> ParsePackagesFromModel(object? model)
                 {
                     Registry = sourceTable.TryGetValue("registry", out var regObj) && regObj is string reg ? reg : null,
                     Virtual = sourceTable.TryGetValue("virtual", out var virtObj) && virtObj is string virt ? virt : null,
+                    Git = sourceTable.TryGetValue("git", out var gitObj) && gitObj is string git ? git : null,
                 };
                 uvPackage.Source = source;
             }
@@ -133,9 +134,12 @@ internal static void ParseMetadata(TomlTable? metadataTable, UvPackage uvPackage
 
         if (metadataTable.TryGetValue("requires-dev", out var requiresDevObj) && requiresDevObj is TomlTable requiresDevTable)
         {
-            if (requiresDevTable.TryGetValue("dev", out var devObj) && devObj is TomlArray devArr)
+            foreach (var kvp in requiresDevTable)
             {
-                uvPackage.MetadataRequiresDev = ParseDependenciesArray(devArr);
+                if (kvp.Value is TomlArray groupArr)
+                {
+                    uvPackage.MetadataRequiresDev.AddRange(ParseDependenciesArray(groupArr));
+                }
             }
         }
     }

src/Microsoft.ComponentDetection.Detectors/uv/UvLockComponentDetector.cs

@@ -26,7 +26,7 @@
 
     public override IList<string> SearchPatterns { get; } = ["uv.lock"];
 
-    public override IEnumerable<ComponentType> SupportedComponentTypes => [ComponentType.Pip];
+    public override IEnumerable<ComponentType> SupportedComponentTypes => [ComponentType.Pip, ComponentType.Git];
 
     public override int Version => 1;
 
@@ -37,6 +37,40 @@
         return pck.Source?.Virtual != null;
     }
 
+    internal static (Uri RepositoryUrl, string CommitHash) ParseGitUrl(string gitUrl)
+    {
+        var uri = new Uri(gitUrl);
+        var repoUrl = new Uri(uri.GetLeftPart(UriPartial.Path));
+        var commitHash = uri.Fragment.TrimStart('#');
+        return (repoUrl, commitHash);
+    }
+
+    internal static HashSet<string> GetTransitivePackages(IEnumerable<string> roots, List<UvPackage> packages)
+    {
+        var lookup = packages.ToDictionary(p => p.Name, p => p, StringComparer.OrdinalIgnoreCase);
+        var visited = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var queue = new Queue<string>(roots);
+
+        while (queue.Count > 0)
+        {
+            var name = queue.Dequeue();
+            if (!visited.Add(name))
+            {
+                continue;
+            }
+
+            if (lookup.TryGetValue(name, out var pkg))
+            {
+                foreach (var dep in pkg.Dependencies)
+                {
+                    queue.Enqueue(dep.Name);
+                }
+            }
+        }
+
+        return visited;
+    }
+
     protected override Task OnFileFoundAsync(ProcessRequest processRequest, IDictionary<string, string> detectorArgs, CancellationToken cancellationToken = default)
     {
         var singleFileComponentRecorder = processRequest.SingleFileComponentRecorder;
@@ -49,8 +83,8 @@
             var uvLock = UvLock.Parse(file.Stream);
 
             var rootPackage = uvLock.Packages.FirstOrDefault(IsRootPackage);
-            var explicitPackages = new HashSet<string>();
-            var devPackages = new HashSet<string>();
+            var explicitPackages = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            var devRootNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
 
             if (rootPackage != null)
             {
@@ -61,30 +95,57 @@
 
                 foreach (var devDep in rootPackage.MetadataRequiresDev)
                 {
-                    devPackages.Add(devDep.Name);
+                    devRootNames.Add(devDep.Name);
                 }
             }
 
+            // Compute dev-only packages via transitive reachability analysis.
+            // A package is dev-only if it is reachable from dev roots but NOT from production roots.
+            var prodRoots = rootPackage?.Dependencies.Select(d => d.Name) ?? [];
+            var prodTransitive = GetTransitivePackages(prodRoots, uvLock.Packages);
+            var devTransitive = GetTransitivePackages(devRootNames, uvLock.Packages);
+            var devOnlyPackages = new HashSet<string>(devTransitive.Except(prodTransitive), StringComparer.OrdinalIgnoreCase);
+
             foreach (var pkg in uvLock.Packages)
             {
                 if (IsRootPackage(pkg))
                 {
                     continue;
                 }
 
-                var pipComponent = new PipComponent(pkg.Name, pkg.Version);
                 var isExplicit = explicitPackages.Contains(pkg.Name);
-                var isDev = devPackages.Contains(pkg.Name);
-                var detectedComponent = new DetectedComponent(pipComponent);
+                var isDev = devOnlyPackages.Contains(pkg.Name);
+
+                TypedComponent component;
+                if (pkg.Source?.Git != null)
+                {
+                    var (repoUrl, commitHash) = ParseGitUrl(pkg.Source.Git);
+                    component = new GitComponent(repoUrl, commitHash);
+                }
+                else
+                {
+                    component = new PipComponent(pkg.Name, pkg.Version);
+                }
+
+                var detectedComponent = new DetectedComponent(component);
                 singleFileComponentRecorder.RegisterUsage(detectedComponent, isDevelopmentDependency: isDev, isExplicitReferencedDependency: isExplicit);
 
                 foreach (var dep in pkg.Dependencies)
                 {
                     var depPkg = uvLock.Packages.FirstOrDefault(p => p.Name.Equals(dep.Name, StringComparison.OrdinalIgnoreCase));
                     if (depPkg != null)
                     {
-                        var depComponentWithVersion = new PipComponent(depPkg.Name, depPkg.Version);
-                        singleFileComponentRecorder.RegisterUsage(new DetectedComponent(depComponentWithVersion), parentComponentId: pipComponent.Id);
+                        TypedComponent depComponent;
+                        if (depPkg.Source?.Git != null)
+                        {
+                            var (depRepoUrl, depCommitHash) = ParseGitUrl(depPkg.Source.Git);
+                            depComponent = new GitComponent(depRepoUrl, depCommitHash);
+                        }
+                        else
+                        {
+                            depComponent = new PipComponent(depPkg.Name, depPkg.Version);
+                        }
+                        singleFileComponentRecorder.RegisterUsage(new DetectedComponent(depComponent), parentComponentId: component.Id, isDevelopmentDependency: isDev);
                     }
                     else
                     {

src/Microsoft.ComponentDetection.Detectors/uv/UvSource.cs

@@ -5,4 +5,6 @@ public class UvSource
     public string? Registry { get; set; }
 
     public string? Virtual { get; set; }
+
+    public string? Git { get; set; }
 }