Monorepos - A discussion

[munntjlx]

We have lots of mono repos, but scans are really per 'repo' rather than subdivided by directory. I was wondering what would be a good way to 'separate' scans by directory in a monorepo? Its not required, but it would be nice if we could subdivide within a repo for the "monorepo" case.

[bradlarsen]

Good question.

There are a couple general approaches when you have a use case like this:

1. Separate the input into logical pieces (like "projects" in the monorepo case) and scan each of those separately
2. Scan everything together and postprocess the findings to separate them into logical pieces

There isn't currently any special support in Nosey Parker for either of these approaches, and so some scripting would be required.

For approach 1 (separating monorepo projects when scanning), if #17 were implemented, you could use the poorly-documented path-based ignore mechanism to restrict the scan to particular paths within the monorepo. But the implementation is missing today.

Approach 2 might be the best option today: you could write a postprocessor that would consume Nosey Parker's JSON output (for example), and split the set of findings into N different sets, one for each project in the monorepo.