fix: don't panic on empty files

Copied from G-Rath/osv-detector#191

Co-authored-by: Gareth Jones <Jones258@Gmail.com>

fixes: #364

pkg/lockfile/fixtures/pnpm/empty.yaml

@@ -1,7 +1 @@
-lockfileVersion: 5.3
-
-specifiers:
-
-dependencies:
-
-packages:
+# this is an empty file!

pkg/lockfile/fixtures/pnpm/no-packages.yaml

@@ -0,0 +1,7 @@
+lockfileVersion: 5.3
+
+specifiers:
+
+dependencies:
+
+packages:

pkg/lockfile/parse-pnpm-lock.go

@@ -177,5 +177,10 @@ func ParsePnpmLock(pathToLockfile string) ([]PackageDetails, error) {
 		return []PackageDetails{}, fmt.Errorf("could not parse %s: %w", pathToLockfile, err)
 	}
 
+	// this will happen if the file is empty
+	if parsedLockfile == nil {
+		parsedLockfile = &PnpmLockfile{}
+	}
+
 	return parsePnpmLock(*parsedLockfile), nil
 }

pkg/lockfile/parse-pnpm-lock_test.go

@@ -23,7 +23,7 @@ func TestParsePnpmLock_InvalidYaml(t *testing.T) {
 	expectPackages(t, packages, []lockfile.PackageDetails{})
 }
 
-func TestParsePnpmLock_NoPackages(t *testing.T) {
+func TestParsePnpmLock_Empty(t *testing.T) {
 	t.Parallel()
 
 	packages, err := lockfile.ParsePnpmLock("fixtures/pnpm/empty.yaml")
@@ -35,6 +35,18 @@ func TestParsePnpmLock_NoPackages(t *testing.T) {
 	expectPackages(t, packages, []lockfile.PackageDetails{})
 }
 
+func TestParsePnpmLock_NoPackages(t *testing.T) {
+	t.Parallel()
+
+	packages, err := lockfile.ParsePnpmLock("fixtures/pnpm/no-packages.yaml")
+
+	if err != nil {
+		t.Errorf("Got unexpected error: %v", err)
+	}
+
+	expectPackages(t, packages, []lockfile.PackageDetails{})
+}
+
 func TestParsePnpmLock_OnePackage(t *testing.T) {
 	t.Parallel()