The problem with yarn workspaces is, that is forms a sort of mono repo where little java apps are stored in folders specified on the root 

package.json file. When building these apps there will only be a single 

yarn.lock file on the root folder. This yarn.lock usually only has devDependencies and therefore always returns 0 results with Veracode's SCA agent based SCA. The individual apps on the other folders only have a package.json but never a yarn.lock.

Veracode's agent based SCA cannot create these yarn.lock files and therefore cannot scan it at all. With upload and scan SCA you also need a 

yarn.lock that never exists. So there will be no results on the individual apps as well.

With the below you will get the possibility to create individual  yarn.lock files for each of the workspaces specified on the root package.json and you can start scanning these type of mono repos with agent based SCA and possibly with upload and scan SCA. One more problem you should keep in mind is that the workspaces can reference themselves. Within the process of creating a yarn.lock file dependencies must be resolvable, available via a package manager or artifactory or similar. These self-referencing dependencies can obviously not be resolved. Some of them show up on the generated yarn.lock, some won’t. I wasn’t able to find out why. But also doesn’t matter too much as the individual folders will still be scanned. Yarn also changed the syntax of their yarn.lock with version 3 and higher of yarn! I had to build two complete independent versions that supports each format of the yarn.lock, as there is no way to support both formats within the same script as you need either yarn v2 or yarn v3 installed as dependency previous to run the script 

The scripts are below and work the same way. Just run node index.js --folder ROOT-FOLDER from the dist directory and it should generate the files for you.

After that run a recursive ABS scan, best with --recursive --scan-collectors yarn

Results should show up on the platform.

https://github.com/julz0815/yarnv2-workspaces-helper

for everything below version 3 of yarn and as well

https://github.com/julz0815/yarnv3-workspaces-helper

for everything that is above version 3 of yarn

Both scripts are also on our community GitHub repo

https://github.com/veracode/Veracode-Community-Projects

This will most probably work perfectly fine in an automated environment like a CI system. It will most probably not work on a local environment where node_modules are already installed.

For that to work locally you could try need to remove the node_modules folder first and rerun the scripts.