Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

ops/offline-kit/test_build_offline_kit.py

@@ -9,7 +9,9 @@ import sys
 from collections import OrderedDict
 from pathlib import Path
 
-sys.path.append(str(Path(__file__).resolve().parent))
+current_dir = Path(__file__).resolve().parent
+sys.path.append(str(current_dir))
+sys.path.append(str(current_dir.parent / "devops" / "release"))
 
 from build_release import write_manifest  # type: ignore import-not-found
 
@@ -231,25 +233,31 @@ class OfflineKitBuilderTests(unittest.TestCase):
             skip_smoke=True,
         )
         result = build_offline_kit(args)
-        bundle_path = Path(result["bundlePath"])
-        self.assertTrue(bundle_path.exists())
-        offline_manifest = self.output_dir.parent / "staging" / "manifest" / "offline-manifest.json"
-        self.assertTrue(offline_manifest.exists())
-
-        with offline_manifest.open("r", encoding="utf-8") as handle:
-            manifest_data = json.load(handle)
-        artifacts = manifest_data["artifacts"]
-        self.assertTrue(any(item["name"].startswith("sboms/") for item in artifacts))
+        bundle_path = Path(result["bundlePath"])
+        self.assertTrue(bundle_path.exists())
+        offline_manifest = self.output_dir.parent / "staging" / "manifest" / "offline-manifest.json"
+        self.assertTrue(offline_manifest.exists())
+
+        bootstrap_notify = self.staging_dir / "bootstrap" / "notify"
+        self.assertTrue((bootstrap_notify / "notify.yaml").exists())
+        self.assertTrue((bootstrap_notify / "notify-web.secret.example").exists())
+
+        with offline_manifest.open("r", encoding="utf-8") as handle:
+            manifest_data = json.load(handle)
+        artifacts = manifest_data["artifacts"]
+        self.assertTrue(any(item["name"].startswith("sboms/") for item in artifacts))
 
         metadata_path = Path(result["metadataPath"])
         data = json.loads(metadata_path.read_text(encoding="utf-8"))
         self.assertTrue(data["bundleSha256"].startswith("sha256:"))
         self.assertTrue(data["manifestSha256"].startswith("sha256:"))
 
-        with tarfile.open(bundle_path, "r:gz") as tar:
-            members = tar.getnames()
-            self.assertIn("manifest/release.yaml", members)
-            self.assertTrue(any(name.startswith("sboms/sample-") for name in members))
+        with tarfile.open(bundle_path, "r:gz") as tar:
+            members = tar.getnames()
+            self.assertIn("manifest/release.yaml", members)
+            self.assertTrue(any(name.startswith("sboms/sample-") for name in members))
+            self.assertIn("bootstrap/notify/notify.yaml", members)
+            self.assertIn("bootstrap/notify/notify-web.secret.example", members)
 
 
 if __name__ == "__main__":