Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly. - Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps. - Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges. - Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges. - Set up project file for the test project with necessary dependencies and configurations. - Include JSON fixture files for testing purposes.
2025-11-04 07:49:39 +02:00
parent f72c5c513a
commit 2eb6852d34
491 changed files with 39445 additions and 3917 deletions
--- a/tests/Graph/StellaOps.Graph.Indexer.Tests/Fixtures/v1/sbom-snapshot.json
+++ b/tests/Graph/StellaOps.Graph.Indexer.Tests/Fixtures/v1/sbom-snapshot.json
@@ -0,0 +1,110 @@
+{
+  "tenant": "tenant-alpha",
+  "source": "scanner.sbom.v1",
+  "artifactDigest": "sha256:aaa111",
+  "sbomDigest": "sha256:sbom111",
+  "collectedAt": "2025-10-30T12:00:00Z",
+  "eventOffset": 1182,
+  "artifact": {
+    "displayName": "registry.example.com/team/app:1.2.3",
+    "environment": "prod",
+    "labels": [
+      "critical",
+      "payments"
+    ],
+    "originRegistry": "registry.example.com",
+    "supplyChainStage": "deploy"
+  },
+  "build": {
+    "builderId": "builder://tekton/pipeline/default",
+    "buildType": "https://slsa.dev/provenance/v1",
+    "attestationDigest": "sha256:attestation001",
+    "source": "scanner.provenance.v1",
+    "collectedAt": "2025-10-30T12:00:05Z",
+    "eventOffset": 2103
+  },
+  "components": [
+    {
+      "purl": "pkg:nuget/Newtonsoft.Json@13.0.3",
+      "version": "13.0.3",
+      "ecosystem": "nuget",
+      "scope": "runtime",
+      "license": {
+        "spdx": "MIT",
+        "name": "MIT License",
+        "classification": "permissive",
+        "noticeUri": "https://opensource.org/licenses/MIT",
+        "sourceDigest": "sha256:ccc333"
+      },
+      "usage": "direct",
+      "detectedBy": "sbom.analyzer.nuget",
+      "layerDigest": "sha256:layer123",
+      "evidenceDigest": "sha256:evidence001",
+      "collectedAt": "2025-10-30T12:00:01Z",
+      "eventOffset": 1183,
+      "source": "scanner.sbom.v1",
+      "files": [
+        {
+          "path": "/src/app/Program.cs",
+          "contentSha256": "sha256:bbb222",
+          "languageHint": "csharp",
+          "sizeBytes": 3472,
+          "scope": "build",
+          "detectedBy": "sbom.analyzer.nuget",
+          "evidenceDigest": "sha256:evidence003",
+          "collectedAt": "2025-10-30T12:00:02Z",
+          "eventOffset": 1185,
+          "source": "scanner.layer.v1"
+        }
+      ],
+      "dependencies": [
+        {
+          "purl": "pkg:nuget/System.Text.Encoding.Extensions@4.7.0",
+          "version": "4.7.0",
+          "relationship": "direct",
+          "evidenceDigest": "sha256:evidence002",
+          "collectedAt": "2025-10-30T12:00:01Z",
+          "eventOffset": 1183
+        }
+      ]
+    },
+    {
+      "purl": "pkg:nuget/System.Text.Encoding.Extensions@4.7.0",
+      "version": "4.7.0",
+      "ecosystem": "nuget",
+      "scope": "runtime",
+      "license": {
+        "spdx": "MIT",
+        "name": "MIT License",
+        "classification": "permissive",
+        "noticeUri": "https://opensource.org/licenses/MIT",
+        "sourceDigest": "sha256:ccc333"
+      },
+      "usage": "transitive",
+      "detectedBy": "sbom.analyzer.nuget",
+      "layerDigest": "sha256:layer123",
+      "evidenceDigest": "sha256:evidence001",
+      "collectedAt": "2025-10-30T12:00:01Z",
+      "eventOffset": 1184,
+      "source": "scanner.sbom.v1",
+      "files": [],
+      "dependencies": []
+    }
+  ],
+  "baseArtifacts": [
+    {
+      "artifactDigest": "sha256:base000",
+      "sbomDigest": "sha256:sbom-base",
+      "displayName": "registry.example.com/base/runtime:2025.09",
+      "environment": "prod",
+      "labels": [
+        "base-image"
+      ],
+      "originRegistry": "registry.example.com",
+      "supplyChainStage": "build",
+      "collectedAt": "2025-10-22T08:00:00Z",
+      "eventOffset": 800,
+      "source": "scanner.sbom.v1"
+    }
+  ]
+}