Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

ops/offline-kit/build_offline_kit.py

@@ -175,22 +175,41 @@ def copy_debug_store(release_dir: Path, staging_dir: Path) -> None:
     )
 
 
-def copy_plugins_and_assets(staging_dir: Path) -> None:
-    copy_if_exists(REPO_ROOT / "plugins" / "scanner", staging_dir / "plugins" / "scanner")
-    copy_if_exists(REPO_ROOT / "certificates", staging_dir / "certificates")
-    copy_if_exists(REPO_ROOT / "seed-data", staging_dir / "seed-data")
-    docs_dir = staging_dir / "docs"
-    docs_dir.mkdir(parents=True, exist_ok=True)
-    copy_if_exists(REPO_ROOT / "docs" / "24_OFFLINE_KIT.md", docs_dir / "24_OFFLINE_KIT.md")
-    copy_if_exists(REPO_ROOT / "docs" / "ops" / "telemetry-collector.md", docs_dir / "telemetry-collector.md")
-    copy_if_exists(REPO_ROOT / "docs" / "ops" / "telemetry-storage.md", docs_dir / "telemetry-storage.md")
-
-
-def package_telemetry_bundle(staging_dir: Path) -> None:
-    script = TELEMETRY_TOOLS_DIR / "package_offline_bundle.py"
-    if not script.exists():
-        return
-    TELEMETRY_BUNDLE_PATH.parent.mkdir(parents=True, exist_ok=True)
+def copy_plugins_and_assets(staging_dir: Path) -> None:
+    copy_if_exists(REPO_ROOT / "plugins" / "scanner", staging_dir / "plugins" / "scanner")
+    copy_if_exists(REPO_ROOT / "certificates", staging_dir / "certificates")
+    copy_if_exists(REPO_ROOT / "seed-data", staging_dir / "seed-data")
+    docs_dir = staging_dir / "docs"
+    docs_dir.mkdir(parents=True, exist_ok=True)
+    copy_if_exists(REPO_ROOT / "docs" / "24_OFFLINE_KIT.md", docs_dir / "24_OFFLINE_KIT.md")
+    copy_if_exists(REPO_ROOT / "docs" / "ops" / "telemetry-collector.md", docs_dir / "telemetry-collector.md")
+    copy_if_exists(REPO_ROOT / "docs" / "ops" / "telemetry-storage.md", docs_dir / "telemetry-storage.md")
+
+
+def copy_bootstrap_configs(staging_dir: Path) -> None:
+    notify_config = REPO_ROOT / "etc" / "notify.airgap.yaml"
+    notify_secret = REPO_ROOT / "etc" / "secrets" / "notify-web-airgap.secret.example"
+    notify_doc = REPO_ROOT / "docs" / "modules" / "notify" / "bootstrap-pack.md"
+
+    if not notify_config.exists():
+        raise FileNotFoundError(f"Missing notifier air-gap config: {notify_config}")
+    if not notify_secret.exists():
+        raise FileNotFoundError(f"Missing notifier air-gap secret template: {notify_secret}")
+
+    notify_bootstrap_dir = staging_dir / "bootstrap" / "notify"
+    notify_bootstrap_dir.mkdir(parents=True, exist_ok=True)
+    copy_if_exists(REPO_ROOT / "etc" / "bootstrap" / "notify", notify_bootstrap_dir)
+
+    copy_if_exists(notify_config, notify_bootstrap_dir / "notify.yaml")
+    copy_if_exists(notify_secret, notify_bootstrap_dir / "notify-web.secret.example")
+    copy_if_exists(notify_doc, notify_bootstrap_dir / "README.md")
+
+
+def package_telemetry_bundle(staging_dir: Path) -> None:
+    script = TELEMETRY_TOOLS_DIR / "package_offline_bundle.py"
+    if not script.exists():
+        return
+    TELEMETRY_BUNDLE_PATH.parent.mkdir(parents=True, exist_ok=True)
     run(["python", str(script), "--output", str(TELEMETRY_BUNDLE_PATH)], cwd=REPO_ROOT)
     telemetry_dir = staging_dir / "telemetry"
     telemetry_dir.mkdir(parents=True, exist_ok=True)
@@ -323,10 +342,11 @@ def build_offline_kit(args: argparse.Namespace) -> MutableMapping[str, Any]:
         release_manifest_sha = checksums.get("sha256")
 
     copy_release_manifests(release_dir, staging_dir)
-    copy_component_artifacts(manifest_data, release_dir, staging_dir)
-    copy_collections(manifest_data, release_dir, staging_dir)
-    copy_plugins_and_assets(staging_dir)
-    package_telemetry_bundle(staging_dir)
+    copy_component_artifacts(manifest_data, release_dir, staging_dir)
+    copy_collections(manifest_data, release_dir, staging_dir)
+    copy_plugins_and_assets(staging_dir)
+    copy_bootstrap_configs(staging_dir)
+    package_telemetry_bundle(staging_dir)
 
     offline_manifest_path, offline_manifest_sha = write_offline_manifest(
         staging_dir,

ops/offline-kit/test_build_offline_kit.py

@@ -9,7 +9,9 @@ import sys
 from collections import OrderedDict
 from pathlib import Path
 
-sys.path.append(str(Path(__file__).resolve().parent))
+current_dir = Path(__file__).resolve().parent
+sys.path.append(str(current_dir))
+sys.path.append(str(current_dir.parent / "devops" / "release"))
 
 from build_release import write_manifest  # type: ignore import-not-found
 
@@ -231,25 +233,31 @@ class OfflineKitBuilderTests(unittest.TestCase):
             skip_smoke=True,
         )
         result = build_offline_kit(args)
-        bundle_path = Path(result["bundlePath"])
-        self.assertTrue(bundle_path.exists())
-        offline_manifest = self.output_dir.parent / "staging" / "manifest" / "offline-manifest.json"
-        self.assertTrue(offline_manifest.exists())
-
-        with offline_manifest.open("r", encoding="utf-8") as handle:
-            manifest_data = json.load(handle)
-        artifacts = manifest_data["artifacts"]
-        self.assertTrue(any(item["name"].startswith("sboms/") for item in artifacts))
+        bundle_path = Path(result["bundlePath"])
+        self.assertTrue(bundle_path.exists())
+        offline_manifest = self.output_dir.parent / "staging" / "manifest" / "offline-manifest.json"
+        self.assertTrue(offline_manifest.exists())
+
+        bootstrap_notify = self.staging_dir / "bootstrap" / "notify"
+        self.assertTrue((bootstrap_notify / "notify.yaml").exists())
+        self.assertTrue((bootstrap_notify / "notify-web.secret.example").exists())
+
+        with offline_manifest.open("r", encoding="utf-8") as handle:
+            manifest_data = json.load(handle)
+        artifacts = manifest_data["artifacts"]
+        self.assertTrue(any(item["name"].startswith("sboms/") for item in artifacts))
 
         metadata_path = Path(result["metadataPath"])
         data = json.loads(metadata_path.read_text(encoding="utf-8"))
         self.assertTrue(data["bundleSha256"].startswith("sha256:"))
         self.assertTrue(data["manifestSha256"].startswith("sha256:"))
 
-        with tarfile.open(bundle_path, "r:gz") as tar:
-            members = tar.getnames()
-            self.assertIn("manifest/release.yaml", members)
-            self.assertTrue(any(name.startswith("sboms/sample-") for name in members))
+        with tarfile.open(bundle_path, "r:gz") as tar:
+            members = tar.getnames()
+            self.assertIn("manifest/release.yaml", members)
+            self.assertTrue(any(name.startswith("sboms/sample-") for name in members))
+            self.assertIn("bootstrap/notify/notify.yaml", members)
+            self.assertIn("bootstrap/notify/notify-web.secret.example", members)
 
 
 if __name__ == "__main__":