[lockfile-explorer] Support repositories that use PNPM but do not use Rush

[walkerburgin]

Summary

Are you open to lockfile explorer supporting repositories that use PNPM but not Rush?

Repro steps

• Clone a project that uses PNPM, but not Rush
• Run pnpm install
• Run lockfile-explorer
• Note that lockfile explorer looks for package.json files in the wrong location

Details

I'm responsible for a large internal monorepo that uses PNPM, but does not use Rush. I'm pretty excited about the lockfile explorer, it looks awesome. The "getting started" page suggests that it might work for non-Rush based projects:

# Run "rush install" to ensure common/temp/node_modules is up to date.
# (If your monorepo is using PNPM without Rush, substitute "pnpm install" for this step.)
rush install 

I took it for a spin in our repository this morning and it almost works (!!!).

It looks like it finds & understands pnpm-lock.yaml, pnpm-workspace.yaml, and .pnpmfile.cjs, but is making a Rush based assumption (here and here, I think) when mapping from lockfile entry to package.json file on disk. I'm seeing this for both in-repo projects and out of repo packages installed from the registry.

Is it possible to either make this work out of the box in both scenarios, or to make it configurable?

Standard questions

Please answer these questions to help us investigate your issue more quickly:

Question	Answer
@rushstack/lockfile-explorer version?	1.0.30
Operating system?	Mac
Would you consider contributing a PR?	Yes
Node.js version (node -v)?	v16.17.1

[iclanton]

Seems useful to me. @william2958, thoughts?

[AlejandroFabianCampos]

Bumping! this would be very useful and fwiw pnpm lists this project as part of their tooling ecosystem https://pnpm.io/community/tools#:~:text=apps%20in%20TypeScript.-,Lockfile%20Explorer,-%2D%20A%20desktop%20app 🙏