feat(parser): mark dev-dependencies component.scope as 'excluded'

cyclonedx_py/_internal/pipenv.py

@@ -26,7 +26,7 @@
 
 from cyclonedx.exception.model import InvalidUriException, UnknownHashTypeException
 from cyclonedx.model import ExternalReference, ExternalReferenceType, HashType, Property, XsUri
-from cyclonedx.model.component import Component, ComponentType
+from cyclonedx.model.component import Component, ComponentScope, ComponentType
 from packageurl import PackageURL
 
 from . import BomBuilder, PropertyName, PurlTypePypi
@@ -160,19 +160,30 @@ def _make_bom(self, root_c: Optional['Component'],
         if root_c:
             # root for possible self-installs
             all_components[normalize_packagename(root_c.name)] = root_c
+        non_develop_packages = {
+            normalize_packagename(pkg_name)
+            for gname, pkgs in locker.items()
+            if gname != self.__LOCKFILE_META and gname != 'develop' and isinstance(pkgs, dict)
+            for pkg_name in pkgs
+        }
         for group_name in use_groups:
             self._logger.debug('processing group %r ...', group_name)
             for package_name, package_data in locker.get(group_name, {}).items():
                 package_name_normalized = normalize_packagename(package_name)
                 if package_name_normalized in all_components:
                     component = all_components[package_name_normalized]
                     self._logger.info('existing component for package %r', package_name)
+                    if group_name != 'develop':
+                        component.scope = None
                 else:
                     component = all_components[package_name_normalized] = Component(
                         bom_ref=f'{package_name}{package_data.get("version", "")}',
                         type=ComponentType.LIBRARY,
                         name=package_name,
                         version=package_data['version'][2:] if 'version' in package_data else None,
+                        scope=ComponentScope.EXCLUDED if (
+                            group_name == 'develop' and package_name_normalized not in non_develop_packages
+                        ) else None,
                         external_references=self.__make_extrefs(package_name, package_data, source_urls),
                     )
                     component.purl = PackageURL(

cyclonedx_py/_internal/poetry.py

@@ -292,7 +292,9 @@ def _make_bom(self, project: 'T_NameDict', locker: 'T_NameDict',
 
         use_extras_dep_names = frozenset(map(normalize_packagename,
                                              chain.from_iterable(po_cfg['extras'][e] for e in use_extras)))
-        for group_name in use_groups:
+        sorted_groups = sorted(use_groups, key=lambda g: 1 if g == 'dev' else 0)
+        for group_name in sorted_groups:
+            is_dev = group_name == 'dev'
             for dep_name, dep_specs in po_cfg['group'][group_name].get('dependencies', {}).items():
                 dep_name = normalize_packagename(dep_name)
                 if not isinstance(dep_specs, list):
@@ -319,16 +321,20 @@ def _make_bom(self, project: 'T_NameDict', locker: 'T_NameDict',
                     self.__add_dep(
                         bom, lock_entry,
                         chain.from_iterable(ds.get('extras', ()) for ds in dep_specs),
-                        lock_data)
+                        lock_data,
+                        is_dev=is_dev)
 
         return bom
 
-    def __add_dep(self, bom: 'Bom', lock_entry: _LockEntry, use_extras: Iterable[str], lock_data: 'T_LockData') -> None:
+    def __add_dep(self, bom: 'Bom', lock_entry: _LockEntry, use_extras: Iterable[str], lock_data: 'T_LockData',
+                  *, is_dev: bool = False) -> None:
         if lock_entry.added2bom:
             self._logger.debug('existing component: %r', lock_entry.component)
             lock_entry_dep = None
         else:
             lock_entry.added2bom = True
+            if is_dev:
+                lock_entry.component.scope = ComponentScope.EXCLUDED
             self._logger.info('add component for package %r', lock_entry.name)
             self._logger.debug('add component: %r', lock_entry.component)
             bom.components.add(lock_entry.component)
@@ -347,7 +353,7 @@ def __add_dep(self, bom: 'Bom', lock_entry: _LockEntry, use_extras: Iterable[str
                     continue
                 for dep_lock_entry in dep_lock_entries:
                     lock_entry_dep.dependencies.add(Dependency(dep_lock_entry.component.bom_ref))
-                    self.__add_dep(bom, dep_lock_entry, dep_spec.get('extras', ()), lock_data)
+                    self.__add_dep(bom, dep_lock_entry, dep_spec.get('extras', ()), lock_data, is_dev=is_dev)
         if use_extras:
             use_extras = frozenset(map(normalize_packagename, use_extras))
             lock_entry.component.properties.update(
@@ -369,7 +375,7 @@ def __add_dep(self, bom: 'Bom', lock_entry: _LockEntry, use_extras: Iterable[str
                     continue
                 for dep_lock_entry in dep_lock_entries:
                     lock_entry_dep.dependencies.add(Dependency(dep_lock_entry.component.bom_ref))
-                    self.__add_dep(bom, dep_lock_entry, req.extras, lock_data)
+                    self.__add_dep(bom, dep_lock_entry, req.extras, lock_data, is_dev=is_dev)
 
     @staticmethod
     def _get_lockfile_version(locker: 'T_NameDict') -> tuple[int, ...]: