Nx reads files outside `workspaceRoot` and produces incorrect results

[axiac]

Current Behavior

nx show projects produces an empty list.

Expected Behavior

nx show projects lists the names of the packages found to the directories listed in the workspaces property of package.json.

GitHub Repo

No response

Steps to Reproduce

1. Create an application that uses Nx, (optionally Lerna) and contains multiple packages in ~/projects/project-1 and configure it properly to manage multiple packages.
2. Run NX_DAEMON=false node_modules/.bin/nx show projects and confirm that it lists all the packages described in package.json under the workspaces key.
3. Create a .gitignore file in ~/projects (or directly in ~) and put in it:

   *
   !.gitignore
   

4. Run NX_DAEMON=false node_modules/.bin/nx show projects. It does not display anything.
5. Remove the .gitignore file created at step 3.
   Run NX_DAEMON=false node_modules/.bin/nx show projects again and confirm that it works as expected.

Note:
Use NX_DAEMON=false to ask Nx to do the computation directly in the CLI command, without asking the daemon. Using the daemon produces the same result but requires more steps to reproduce.

Nx Report

NX   Report complete - copy this into the issue template

Node           : 20.18.3
OS             : darwin-arm64
Native Target  : aarch64-macos
npm            : 10.9.2

nx          : 20.8.1
lerna       : 8.2.1
@nx/devkit  : 20.8.1
typescript  : 5.7.3
---------------------------------------
Cache Usage: 0.00 B / 92.64 GB

Failure Logs

Package Manager Version

No response

Operating System

• macOS
• Linux
• Windows
• Other (Please specify)

Additional Information

Running NX_DAEMON=false node_modules/.bin/nx show projects using a debugger reveals that the culprit is the call to multiGlobWithWorkspaceContext() in file /packages/nx/src/project-graph/utils/retrieve-workspace-files.ts, lines 72-75:

  const pluginConfigFiles = await multiGlobWithWorkspaceContext(
    workspaceRoot,
    globPatterns
  );

The function is invoked with (the expanded form of) ~/projects/project-1 for workspaceRoot and the following value in globPatterns:

[
  "{yarn.lock,package-lock.json,pnpm-lock.yaml,bun.lockb}",
  "{package.json,**/package.json,project.json,**/project.json}",
  "{project.json,**/project.json}",
]

In the absence of ~/projects/.gitignore, it returns:

[
  [
    "package-lock.json",
  ],
  [
    "backend/.../package.json",
    "backend/.../package.json",
    ... all subdirectories of `backend` that contain a `package.json` file are listed here...
    "package.json",
    "frontend/.../package.json",
    "frontend/.../package.json",
    ... 
    "packages/.../package.json",
    "packages/.../package.json",    
    ... 
  ],
  [
  ],
]

When ~/projects/.gitignore is present, multiGlobWithWorkspaceContext() returns three empty arrays:

[
  [
  ],
  [
  ],
  [
  ]
]

---

~/projects/project-1/package.json contains this section:

{
  ...
  "workspaces": [
    "frontend/**",
    "backend/**",
    "packages/**"
  ],
  ...
}

~/projects/project-1/nx.json looks like this:

{
  "namedInputs": { ... },
  "targetDefaults": { ... },
  "parallel": 2
}

Its content or even its presence does not influence the outcome described in this issue.
The project does not use project.json files.