fix: handle multiple exclude patterns in exclude package contents (#2131)

Author: Mivr

e2e/npm_translate_lock_exclude_package_contents/BUILD.bazel

@@ -4,7 +4,7 @@ npm_link_all_packages(name = "node_modules")
 
 sh_test(
     name = "test_sh",
-    srcs = ["is-odd-exclude-test.sh"],
+    srcs = ["exclude-test.sh"],
     data = [
         ":node_modules/is-odd",
     ],

e2e/npm_translate_lock_exclude_package_contents/MODULE.bazel

@@ -17,7 +17,11 @@ npm.npm_translate_lock(
     name = "npm",
     data = ["//:package.json"],
     exclude_package_contents = {
-        "[email protected]": ["**/README*"],
+        "[email protected]": [
+            "**/README*",
+            "",
+            "**/LICENSE*",
+        ],
     },
     npmrc = "//:.npmrc",
     pnpm_lock = "//:pnpm-lock.yaml",

e2e/npm_translate_lock_exclude_package_contents/WORKSPACE

@@ -16,7 +16,11 @@ load("@aspect_rules_js//npm:repositories.bzl", "npm_translate_lock")
 npm_translate_lock(
     name = "npm",
     exclude_package_contents = {
-        "[email protected]": ["**/README*"],
+        "[email protected]": [
+            "**/README*",
+            "",
+            "**/LICENSE*",
+        ],
     },
     npmrc = "//:.npmrc",
     pnpm_lock = "//:pnpm-lock.yaml",

e2e/npm_translate_lock_exclude_package_contents/is-odd-exclude-test.sh renamed to e2e/npm_translate_lock_exclude_package_contents/exclude-test.sh

@@ -21,4 +21,10 @@ if ls "$TARGET_DIR"/README* >/dev/null 2>&1; then
     exit 1
 fi
 
+# Check if any LICENSE file exists
+if ls "$TARGET_DIR"/LICENSE* >/dev/null 2>&1; then
+    echo "Error: LICENSE file found in $TARGET_DIR, exclusion did not work."
+    exit 1
+fi
+
 echo "All tests passed"

npm/private/npm_import.bzl

@@ -455,9 +455,16 @@ def _download_and_extract_archive(rctx, package_json_only):
         msg = "Failed to create package directory. '{}' exited with {}: \nSTDOUT:\n{}\nSTDERR:\n{}".format(" ".join(mkdir_args), result.return_code, result.stdout, result.stderr)
         fail(msg)
 
+    exclude_pattern_args = []
+    if rctx.attr.exclude_package_contents:
+        for pattern in rctx.attr.exclude_package_contents:
+            if pattern == "":
+                continue
+            exclude_pattern_args.append("--exclude")
+            exclude_pattern_args.append(pattern)
+
     # npm packages are always published with one top-level directory inside the tarball, tho the name is not predictable
     # so we use tar here which takes a --strip-components N argument instead of rctx.download_and_extract
-    exclude_pattern_args = ["--exclude", rctx.attr.exclude_package_contents] if rctx.attr.exclude_package_contents else []
     tar_args = ["tar", "-xf", _TARBALL_FILENAME] + ["--strip-components", "1", "-C", _EXTRACT_TO_DIRNAME, "--no-same-owner", "--no-same-permissions"] + exclude_pattern_args
 
     system_tar = detect_system_tar(rctx) if rctx.attr.system_tar == "auto" else rctx.attr.system_tar

npm/private/npm_package_store.bzl

@@ -229,7 +229,15 @@ def _npm_package_store_impl(ctx):
                 # tar to strip one directory level. Some packages have directory permissions missing
                 # executable which make the directories not listable ([email protected] for example).
                 bsdtar = ctx.toolchains["@aspect_bazel_lib//lib:tar_toolchain_type"]
-                tar_exclude_package_contents = (["--exclude"] + ctx.attr.exclude_package_contents) if ctx.attr.exclude_package_contents else []
+
+                tar_exclude_package_contents = []
+                if ctx.attr.exclude_package_contents:
+                    for pattern in ctx.attr.exclude_package_contents:
+                        if pattern == "":
+                            continue
+                        tar_exclude_package_contents.append("--exclude")
+                        tar_exclude_package_contents.append(pattern)
+
                 ctx.actions.run(
                     executable = bsdtar.tarinfo.binary,
                     inputs = depset(direct = [src], transitive = [bsdtar.default.files]),