[vet] Add vet for node_module source inclusion

Author: csweichel

pkg/vet/docker_test.go

@@ -59,7 +59,7 @@ ADD from-some-pkg--build/hello.txt hello.txt`,
 
 			tmpdir, err := os.MkdirTemp("", "leeway-test-*")
 			failOnErr(err)
-			// defer os.RemoveAll(tmpdir)
+			defer os.RemoveAll(tmpdir)
 
 			var pkgdeps string
 			failOnErr(os.WriteFile(filepath.Join(tmpdir, "WORKSPACE.yaml"), []byte("environmentManifest:\n  - name: \"docker\"\n    command: [\"echo\"]"), 0644))

pkg/vet/yarn.go

@@ -18,6 +18,7 @@ import (
 
 func init() {
 	register(&checkImplicitTransitiveDependencies{})
+	register(PackageCheck("node-modules-source", "checks if the package's sources include node_modules/", leeway.YarnPackage, checkYarnNodeModulesSource))
 }
 
 type pkgJSON struct {
@@ -185,3 +186,34 @@ func (c *checkImplicitTransitiveDependencies) RunPkg(pkg *leeway.Package) ([]Fin
 
 	return findings, nil
 }
+
+func checkYarnNodeModulesSource(pkg *leeway.Package) ([]Finding, error) {
+	var res []string
+	for _, src := range pkg.Sources {
+		segs := strings.Split(src, "/")
+		var found bool
+		for _, seg := range segs {
+			if seg == "node_modules" {
+				found = true
+				break
+			}
+		}
+		if !found {
+			continue
+		}
+		if res == nil || len(segs) < len(res) {
+			res = segs
+		}
+	}
+
+	if res == nil {
+		return nil, nil
+	}
+	return []Finding{
+		{
+			Component:   pkg.C,
+			Package:     pkg,
+			Description: fmt.Sprintf("package contains node_modules/ as source: %s", strings.Join(res, "/")),
+		},
+	}, nil
+}