Exclude editable root packages when scanning uv lockfile

[RKS (rksharma-owg)]

Summary

Fixes an issue where non-virtual root packages in uv projects (defined in uv.lock with source = { editable = "." }) are improperly reported as external components.

Fixes #1586

Problem

In uv.lock, root projects configured with standard project definitions or workspace layouts specify their source as editable (source = { editable = "." } or relative paths) rather than virtual (source = { virtual = "." }).

Previously:

1. UvSource did not model or parse the editable property from the lockfile's source table.
2. UvLockComponentDetector.IsRootPackage only checked pck.Source?.Virtual != null.
3. Consequently, editable root packages were not identified as roots, causing them to be registered as detected PipComponent dependencies, while their direct dependencies were omitted from explicitPackages and development dependencies were not correctly categorized.

Solution

1. Add Editable property to UvSource.
2. Parse editable from the TOML source table in UvLock.ParsePackage.
3. Update IsRootPackage to check pck.Source?.Virtual != null || pck.Source?.Editable != null.
4. In OnFileFoundAsync, evaluate all root packages (uvLock.Packages.Where(IsRootPackage)) to aggregate direct dependencies (requires-dist), development dependencies (requires-dev), and production roots across workspace roots.
5. Bump UvLockComponentDetector.Version from 2 to 3.

Tests

• Added TestUvLockDetector_EditableRootPackage_ExcludedFromDetectedComponents in UvLockDetectorTests reproducing the lockfile structure from Root package issue when scanning uv repository #1586 and asserting:
  • Root project is not included in detected components.
  • Third-party dependencies are detected with correct explicit reference and development dependency flags.
• Added ParsePackage_ParsesSource_EditableOnly and ParsePackage_ParsesSource_EditableAndRegistry unit tests in UvLockTests.

[Copilot]

🔵 Needs a closer look

Update docs/detectors/uv.md so it reflects the new editable-root behavior.

Pull request overview

Updates uv lockfile scanning to exclude editable root packages from detected components.

Changes:

• Parse and model source.editable.
• Aggregate dependencies across editable and virtual roots.
• Bump the detector version and add regression tests.

File summaries

File	Summary
test/Microsoft.ComponentDetection.Detectors.Tests/UvLockTests.cs	Tests editable-source parsing.
test/Microsoft.ComponentDetection.Detectors.Tests/UvLockDetectorTests.cs	Tests editable-root exclusion and dependency classification.
src/Microsoft.ComponentDetection.Detectors/uv/UvSource.cs	Adds editable source modeling. Nit (1 vote): update the stale detector documentation.
src/Microsoft.ComponentDetection.Detectors/uv/UvLockComponentDetector.cs	Filters editable roots and aggregates dependencies. Nit (1 vote): update the stale detector documentation.
src/Microsoft.ComponentDetection.Detectors/uv/UvLock.cs	Parses editable source values.

Review details

Suppressed comments (2)

src/Microsoft.ComponentDetection.Detectors/uv/UvLockComponentDetector.cs:38

• This changes the behavior documented in docs/detectors/uv.md:19: editable and workspace-member packages are now filtered by IsRootPackage instead of being registered as regular components. Please update that known-limitations entry so users are not told the opposite behavior.

        return pck.Source?.Virtual != null || pck.Source?.Editable != null;

src/Microsoft.ComponentDetection.Detectors/uv/UvSource.cs:11

• This behavior change leaves docs/detectors/uv.md:19 inaccurate: it still says editable packages are registered as regular components, while IsRootPackage now filters them out. Please update/remove that known limitation in the same PR so the detector documentation does not describe the opposite behavior.

    public string? Editable { get; set; }

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Editable workspace members may be incorrectly excluded, and the virtual-source documentation needs correction.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

src/Microsoft.ComponentDetection.Detectors/uv/UvLockComponentDetector.cs:138

• The new Where(IsRootPackage) path is the behavior that supports multiple workspace roots, but the added detector test only exercises one root package. Add a fixture with at least two editable/virtual roots and distinct production/dev dependencies to verify that both roots contribute to explicitPackages, devRootNames, and prodRoots; otherwise this central aggregation can regress back to handling only one root without a failing test.

            var rootPackages = uvLock.Packages.Where(IsRootPackage).ToList();
            var explicitPackages = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
            var devRootNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase);

            foreach (var rootPackage in rootPackages)

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

No unresolved issues were identified, and all review assessments indicate approval readiness.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 0 new
• Review effort level: Lite