sprints work

.gitea/workflows/determinism-gate.yml

@@ -1,6 +1,7 @@
 # .gitea/workflows/determinism-gate.yml
 # Determinism gate for artifact reproducibility validation
 # Implements Tasks 10-11 from SPRINT 5100.0007.0003
+# Updated: Task 13 from SPRINT 8200.0001.0003 - Add schema validation dependency
 
 name: Determinism Gate
 
@@ -11,6 +12,8 @@ on:
       - 'src/**'
       - 'tests/integration/StellaOps.Integration.Determinism/**'
       - 'tests/baselines/determinism/**'
+      - 'bench/golden-corpus/**'
+      - 'docs/schemas/**'
       - '.gitea/workflows/determinism-gate.yml'
   pull_request:
     branches: [ main ]
@@ -27,6 +30,11 @@ on:
         required: false
         default: false
         type: boolean
+      skip_schema_validation:
+        description: 'Skip schema validation step'
+        required: false
+        default: false
+        type: boolean
 
 env:
   DOTNET_VERSION: '10.0.100'
@@ -35,10 +43,90 @@ env:
   BASELINE_DIR: tests/baselines/determinism
 
 jobs:
+  # ===========================================================================
+  # Schema Validation Gate (runs before determinism checks)
+  # ===========================================================================
+  schema-validation:
+    name: Schema Validation
+    runs-on: ubuntu-22.04
+    if: github.event.inputs.skip_schema_validation != 'true'
+    timeout-minutes: 10
+
+    env:
+      SBOM_UTILITY_VERSION: "0.16.0"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install sbom-utility
+        run: |
+          curl -sSfL "https://github.com/CycloneDX/sbom-utility/releases/download/v${SBOM_UTILITY_VERSION}/sbom-utility-v${SBOM_UTILITY_VERSION}-linux-amd64.tar.gz" | tar xz
+          sudo mv sbom-utility /usr/local/bin/
+          sbom-utility --version
+
+      - name: Validate CycloneDX fixtures
+        run: |
+          set -e
+          SCHEMA="docs/schemas/cyclonedx-bom-1.6.schema.json"
+          FIXTURE_DIRS=(
+            "bench/golden-corpus"
+            "tests/fixtures"
+            "seed-data"
+          )
+
+          FOUND=0
+          PASSED=0
+          FAILED=0
+
+          for dir in "${FIXTURE_DIRS[@]}"; do
+            if [ -d "$dir" ]; then
+              # Skip invalid fixtures directory (used for negative testing)
+              while IFS= read -r -d '' file; do
+                if [[ "$file" == *"/invalid/"* ]]; then
+                  continue
+                fi
+                if grep -q '"bomFormat".*"CycloneDX"' "$file" 2>/dev/null; then
+                  FOUND=$((FOUND + 1))
+                  echo "::group::Validating: $file"
+                  if sbom-utility validate --input-file "$file" --schema "$SCHEMA" 2>&1; then
+                    echo "✅ PASS: $file"
+                    PASSED=$((PASSED + 1))
+                  else
+                    echo "❌ FAIL: $file"
+                    FAILED=$((FAILED + 1))
+                  fi
+                  echo "::endgroup::"
+                fi
+              done < <(find "$dir" -name '*.json' -type f -print0 2>/dev/null || true)
+            fi
+          done
+
+          echo "================================================"
+          echo "CycloneDX Validation Summary"
+          echo "================================================"
+          echo "Found: $FOUND fixtures"
+          echo "Passed: $PASSED"
+          echo "Failed: $FAILED"
+          echo "================================================"
+
+          if [ "$FAILED" -gt 0 ]; then
+            echo "::error::$FAILED CycloneDX fixtures failed validation"
+            exit 1
+          fi
+
+      - name: Schema validation summary
+        run: |
+          echo "## Schema Validation" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "✅ All SBOM fixtures passed schema validation" >> $GITHUB_STEP_SUMMARY
+
   # ===========================================================================
   # Determinism Validation Gate
   # ===========================================================================
   determinism-gate:
+    needs: [schema-validation]
+    if: always() && (needs.schema-validation.result == 'success' || needs.schema-validation.result == 'skipped')
     name: Determinism Validation
     runs-on: ubuntu-22.04
     timeout-minutes: 30
@@ -156,7 +244,7 @@ jobs:
   update-baselines:
     name: Update Baselines
     runs-on: ubuntu-22.04
-    needs: determinism-gate
+    needs: [schema-validation, determinism-gate]
     if: github.event_name == 'workflow_dispatch' && github.event.inputs.update_baselines == 'true'
 
     steps:
@@ -206,18 +294,26 @@ jobs:
   drift-check:
     name: Drift Detection Gate
     runs-on: ubuntu-22.04
-    needs: determinism-gate
+    needs: [schema-validation, determinism-gate]
     if: always()
 
     steps:
       - name: Check for drift
         run: |
+          SCHEMA_STATUS="${{ needs.schema-validation.result || 'skipped' }}"
           DRIFTED="${{ needs.determinism-gate.outputs.drifted || '0' }}"
           STATUS="${{ needs.determinism-gate.outputs.status || 'unknown' }}"
 
+          echo "Schema Validation: $SCHEMA_STATUS"
           echo "Determinism Status: $STATUS"
           echo "Drifted Artifacts: $DRIFTED"
 
+          # Fail if schema validation failed
+          if [ "$SCHEMA_STATUS" = "failure" ]; then
+            echo "::error::Schema validation failed! Fix SBOM schema issues before determinism check."
+            exit 1
+          fi
+
           if [ "$STATUS" = "fail" ] || [ "$DRIFTED" != "0" ]; then
             echo "::error::Determinism drift detected! $DRIFTED artifact(s) have changed."
             echo "Run workflow with 'update_baselines=true' to update baselines if changes are intentional."
@@ -230,4 +326,5 @@ jobs:
         run: |
           echo "## Drift Detection Gate" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Status: ${{ needs.determinism-gate.outputs.status || 'pass' }}" >> $GITHUB_STEP_SUMMARY
+          echo "Schema Validation: ${{ needs.schema-validation.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
+          echo "Determinism Status: ${{ needs.determinism-gate.outputs.status || 'pass' }}" >> $GITHUB_STEP_SUMMARY