WIP

analyzer/src/main/kotlin/AnalyzerResultBuilder.kt

@@ -29,6 +29,7 @@ import org.ossreviewtoolkit.model.Project
 import org.ossreviewtoolkit.model.ProjectAnalyzerResult
 import org.ossreviewtoolkit.model.config.Excludes
 import org.ossreviewtoolkit.model.createAndLogIssue
+import org.ossreviewtoolkit.model.dependenciesSequence
 import org.ossreviewtoolkit.model.utils.DependencyGraphBuilder
 import org.ossreviewtoolkit.model.utils.convertToDependencyGraph
 import org.ossreviewtoolkit.utils.common.getDuplicates
@@ -108,23 +109,22 @@ private fun AnalyzerResult.resolvePackageManagerDependencies(): AnalyzerResult {
  val handler = PackageManagerDependencyHandler(this)
  val navigator = DependencyGraphNavigator(dependencyGraphs)
 
- val graphs = projects.groupBy { it.id.type }.entries.associate { (type, projectsForType) ->
+ val graphs = dependencyGraphs.mapValues { (managerName, graph) ->
  val builder = DependencyGraphBuilder(handler)
 
- projectsForType.forEach { project ->
- project.scopeNames?.forEach { scopeName ->
- val qualifiedScopeName = DependencyGraph.qualifyScope(project, scopeName)
- navigator.directDependencies(project, scopeName).forEach { node ->
- handler.resolvePackageManagerDependency(node).forEach {
- builder.addDependency(qualifiedScopeName, it)
- }
+ graph.scopes.forEach { (scopeName, rootIndices) ->
+ val a = rootIndices.map { navigator.referenceFor(managerName, it) }
+ val b = dependenciesSequence(graph, a)
+ b.forEach { node ->
+ handler.resolvePackageManagerDependency(node).forEach {
+ builder.addDependency(scopeName, it)
  }
  }
  }
 
  // Package managers that do not use the dependency graph representation might not have a check implemented to
  // verify that packages exist for all dependencies, so the reference check needs to be disabled here.
- type to builder.build(checkReferences = false)
+ builder.build(checkReferences = false)
  }
 
  return copy(dependencyGraphs = graphs)

analyzer/src/test/kotlin/AnalyzerResultBuilderTest.kt

@@ -211,7 +211,7 @@ class AnalyzerResultBuilderTest : WordSpec() {
 
  analyzerResult.getAllIssues() should containExactly(
  package1.id to setOf(issue1),
- package3.id to setOf(issue2),
+ package3.id to setOf(issue2, issue5),
  project1.id to setOf(issue3, issue4),
  project2.id to setOf(issue4)
  )

model/src/main/kotlin/DependencyGraphNavigator.kt

@@ -119,7 +119,7 @@ class DependencyGraphNavigator(
  * Resolve a [DependencyGraphNode] in the [DependencyGraph] for the specified [package manager][manager] that
  * corresponds to the given [rootIndex]. Throw an exception if no such reference can be found.
  */
- private fun referenceFor(manager: String, rootIndex: RootDependencyIndex): DependencyGraphNode =
+ fun referenceFor(manager: String, rootIndex: RootDependencyIndex): DependencyGraphNode =
  referenceFor(manager, rootIndex.root, rootIndex.fragment)
 }
 
@@ -215,7 +215,7 @@ private fun DependencyGraph.dependencyRefMapping(): Array<MutableList<Dependency
  * Generate a sequence that allows accessing the given [dependencies] from the provided [graph] via the
  * [DependencyNode] interface.
  */
-private fun dependenciesSequence(
+fun dependenciesSequence(
  graph: DependencyGraph,
  dependencies: Collection<DependencyGraphNode>
 ): Sequence<DependencyNode> =