Conan: Add support for Conan lockfiles

Filter output of `conan info` to only include packages listed in
lockfile.

For now only lockfiles located in the same directory as the definition
file are supported.

Signed-off-by: Oleksandr Yarosevych <[email protected]>

Author: yarosevych

analyzer/src/main/kotlin/managers/Conan.kt

@@ -107,7 +107,7 @@ class Conan(
 
     // TODO: Add support for Conan lock files.
 
-    // protected open fun hasLockFile(projectDir: File) = null
+    private fun hasLockFile(directory: String) = File(directory).isFile
 
     override fun transformVersion(output: String) =
         // Conan could report version strings like:
@@ -143,25 +143,47 @@ class Conan(
         stashDirectories(directoryToStash).use {
             configureRemoteAuthentication(conanConfig)
 
+            // TODO: Support lockfiles which are located in a different directory than the definition file.
+            val lockfileName = analyzerConfig.packageManagers?.get(managerName)?.options?.get("lockfileName")
+            requireLockfile(workingDir) { lockfileName?.let { hasLockFile(it) } ?: false }
+
             val jsonFile = createOrtTempDir().resolve("info.json")
             run(workingDir, "info", definitionFile.name, "--json", jsonFile.absolutePath, *DUMMY_COMPILER_SETTINGS)
 
             val pkgInfos = jsonMapper.readTree(jsonFile)
             jsonFile.parentFile.safeDeleteRecursively(force = true)
 
-            val packageList = removeProjectPackage(pkgInfos, definitionFile.name)
+            val filteredPkgInfos = if (!analyzerConfig.allowDynamicVersions && lockfileName != null) {
+                val lockfileNodes = jsonMapper.readTree(definitionFile.resolveSibling(lockfileName))
+                val lockfilePackages = lockfileNodes["graph_lock"]["nodes"].mapNotNull {
+                    it["ref"]?.textValue()
+                }
+
+                jsonMapper.createArrayNode().addAll(
+                    pkgInfos.filter { jsonNode ->
+                        lockfilePackages.contains(jsonNode["reference"].textValueOrEmpty())
+                                || definitionFile.name.equals(jsonNode["reference"].textValueOrEmpty())
+                    }
+                )
+            } else {
+                pkgInfos
+            }
+
+            val packageList = removeProjectPackage(filteredPkgInfos, definitionFile.name)
             val packages = parsePackages(packageList, workingDir)
 
             val dependenciesScope = Scope(
                 name = SCOPE_NAME_DEPENDENCIES,
-                dependencies = parseDependencies(pkgInfos, definitionFile.name, SCOPE_NAME_DEPENDENCIES, workingDir)
+                dependencies =
+                    parseDependencies(filteredPkgInfos, definitionFile.name, SCOPE_NAME_DEPENDENCIES, workingDir)
             )
             val devDependenciesScope = Scope(
                 name = SCOPE_NAME_DEV_DEPENDENCIES,
-                dependencies = parseDependencies(pkgInfos, definitionFile.name, SCOPE_NAME_DEV_DEPENDENCIES, workingDir)
+                dependencies =
+                    parseDependencies(filteredPkgInfos, definitionFile.name, SCOPE_NAME_DEV_DEPENDENCIES, workingDir)
             )
 
-            val projectPackage = parseProjectPackage(pkgInfos, definitionFile, workingDir)
+            val projectPackage = parseProjectPackage(filteredPkgInfos, definitionFile, workingDir)
 
             return listOf(
                 ProjectAnalyzerResult(