feat(cli): add include-dev-deps flag

[DmitriyLewen]

Description

aquasecurity/go-dep-parser#237 adds Dev field for Package to mark dev dependencies.
Add include-dev-deps flag to work with these field.

These changes are currently only supported for npm.

Related issues

• Close Include DevDependencies scans for npm packages #3742

Related PRs

• #feat(npm): don't skip dev deps go-dep-parser#237

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

I asked someone to list candidates with the CLI flag name.

• --scan-dev-deps: Indicates explicitly that you want to scan devDependencies. The "scan" part represents the main function of Trivy, and "-dev-deps" shows that this function is applied to devDependencies.
• --include-dev-deps: Indicates that devDependencies are included in the scan when this flag is specified. The "include" part suggests the specification of additional targets.
• --dev-deps-scan: This is another option with the same meaning as "--scan-dev-deps". However, with "dev-deps" at the beginning of the flag, users can quickly understand that this option is related to devDependencies.
• --enable-dev-scan: This flag indicates that you are enabling the scanning of devDependencies. "Enable" suggests the activation of this particular function.
• --dev-deps-detect: This flag indicates that you are detecting vulnerabilities in devDependencies. "Detect" represents the vulnerability detection feature of Trivy.
• --check-dev-deps: "Check" suggests the action of inspecting or verifying, indicating that you are checking devDependencies.

@itaysk @DmitriyLewen Any preference? I'd vote on --include-dev-deps as it affects SBOM as well as vulnerability scanning, but it is not a strong opinion. I'm open to any options.

[DmitriyLewen]

I think --include-dev-deps or --enable-dev-scan would be better. For other names users can this that we will only scan dev deps, but we will use prod + dev deps.

Thinking about SBOM, as you said - --include-dev-deps is better name.

[knqyf263]

@DmitriyLewen Let's go for --include-dev-deps, then.

[DmitriyLewen]

@knqyf263 i updated flag name.

[knqyf263]

We don't have to update this golden, right?

[DmitriyLewen]

I thought the same when i got error.
But we need to fix this golden file.

I added new Dev boolean field to Package - https://github.com/aquasecurity/trivy/pull/4700/files#diff-11d06805c304c7fe1d7be3057aede873f853bffbb46c6e997e92b1e7c60f80dfR72

To calculate ID for spdx package we use Package struct -

trivy/pkg/sbom/spdx/marshal.go

Line 332 in 790c805

pkgID, err := calcPkgID(m.hasher, pkg)

That is why ID was changed.

About spdx tests - we overwrite hash fucntion. This fucntion only uses Name and FilePath -

trivy/pkg/sbom/spdx/marshal_test.go

Line 860 in 790c805

str = v.(ftypes.Package).Name + v.(ftypes.Package).FilePath

Correctly me, if i missed something.

[knqyf263]

Yeah, you're right. I forgot about how to calculate the SPDX package IDs. Thanks!