cdxgen doesn't scan all lockfiles if --no-recurse is enabled

[kiwiz]

I have a directory with a Gemfile and a Packages.resolved file in the root. When I invoke cdxgen . --no-recurse, I only get results from the former. Is there an option that tells cdxgen to scan all lockfiles AND to not recurse into subdirectories?

[prabhu]

Do you get results for swift if you invoke specifically with -t swift. Could you triage a bit more to identify the source of the problem?

[kiwiz]

Yup, I do. From a quick review at the code, it seems like cdxgen will return the first project it finds - which is reasonable. So this is more of a feature request: separating "recurse" and "multiProject". I can file a feature request if you agree.

[prabhu]

Thank you! You can also experiment with exclude arguments to ignore unwanted directories.

[kiwiz]

Actually, the problem appears to be that in recursive mode, Swift dependencies show up as "components" and not "dependencies". This means DepTrack doesn't pick them up when doing a scan.

[prabhu]

Any sample project to reproduce the issue?