sprints work

tests/fixtures/invalid/README.md

@@ -0,0 +1,24 @@
+# Invalid Fixtures for Negative Testing
+
+This directory contains intentionally invalid SBOM fixtures used for CI negative testing.
+These fixtures MUST fail schema validation to ensure the CI pipeline correctly detects errors.
+
+## CycloneDX Invalid Fixtures
+
+| File | Defect | Expected Error |
+|------|--------|----------------|
+| `cyclonedx-wrong-version.json` | specVersion "2.0" doesn't exist | Invalid enum value for specVersion |
+| `cyclonedx-missing-required.json` | Missing required specVersion field | Missing required property: specVersion |
+| `cyclonedx-invalid-component.json` | Component missing name and type | Required properties missing in component |
+
+## CI Usage
+
+The schema validation workflow uses the `tests/fixtures/invalid/` directory for negative test cases.
+When `--expect-failures` is passed, the CI expects these files to fail validation.
+
+## Adding New Test Cases
+
+1. Create a new JSON file with an intentional schema violation
+2. Add a `$comment` field explaining the defect
+3. Update this README with the expected error
+4. Ensure the file has the correct format marker (e.g., `"bomFormat": "CycloneDX"`)

tests/fixtures/invalid/cyclonedx-invalid-component.json

@@ -0,0 +1,15 @@
+{
+  "$comment": "INTENTIONALLY INVALID CycloneDX fixture - component missing required 'name' and 'type' fields.",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2025-12-25T00:00:00Z"
+  },
+  "components": [
+    {
+      "invalid-field": "this-is-not-valid",
+      "purl": "pkg:npm/missing-required-fields@1.0.0"
+    }
+  ]
+}

tests/fixtures/invalid/cyclonedx-missing-required.json

@@ -0,0 +1,9 @@
+{
+  "$comment": "INTENTIONALLY INVALID CycloneDX fixture - missing required 'specVersion' field.",
+  "bomFormat": "CycloneDX",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2025-12-25T00:00:00Z"
+  },
+  "components": []
+}

tests/fixtures/invalid/cyclonedx-wrong-version.json

@@ -0,0 +1,11 @@
+{
+  "$comment": "INTENTIONALLY INVALID CycloneDX fixture for negative testing.",
+  "$comment2": "specVersion 2.0 does not exist and should fail schema validation.",
+  "bomFormat": "CycloneDX",
+  "specVersion": "2.0",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2025-12-25T00:00:00Z"
+  },
+  "components": []
+}